Skip to content
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

Commit 66655b6

Browse files
davidmu1davidmu1
committedDec 19, 2017
new ssl tutorial
1 parent 0c08304 commit 66655b6

File tree

6 files changed

+347
-352
lines changed

6 files changed

+347
-352
lines changed
 

‎articles/application-gateway/application-gateway-ssl-arm.md

Lines changed: 211 additions & 211 deletions
Large diffs are not rendered by default.

‎articles/application-gateway/application-gateway-ssl-cli.md

Lines changed: 136 additions & 141 deletions
Original file line numberDiff line numberDiff line change
@@ -1,191 +1,186 @@
11
---
2-
title: Configure SSL offload - Azure Application Gateway - Azure CLI 2.0 | Microsoft Docs
3-
description: This article provides instructions to create an application gateway with SSL offload by using Azure CLI 2.0
4-
documentationcenter: na
2+
title: Create an application gateway with a certificate - Azure CLI | Microsoft Docs
3+
description: Learn how to create an application gateway and add a certificate for SSL termination using the Azure CLI.
54
services: application-gateway
65
author: davidmu1
76
manager: timlt
87
editor: tysonn
98

109
ms.service: application-gateway
11-
ms.devlang: na
1210
ms.topic: article
13-
ms.tgt_pltfrm: na
1411
ms.workload: infrastructure-services
15-
ms.date: 07/26/2017
12+
ms.date: 11/15/2017
1613
ms.author: davidmu
1714

1815
---
19-
# Configure an application gateway for SSL offload by using Azure CLI 2.0
16+
# Create an application gateway with a certificate using the Azure CLI
2017

21-
> [!div class="op_single_selector"]
22-
> * [Azure portal](application-gateway-ssl-portal.md)
23-
> * [Azure Resource Manager PowerShell](application-gateway-ssl-arm.md)
24-
> * [Azure classic PowerShell](application-gateway-ssl.md)
25-
> * [Azure CLI 2.0](application-gateway-ssl-cli.md)
18+
You can use the Azure CLI to create an [application gateway](application-gateway-introduction.md) with an SSL certificate that uses a [virtual machine scale set](../virtual-machine-scale-sets/virtual-machine-scale-sets-overview.md) for backend servers. In this example, the scale set contains two virtual machine instances that are added to the default backend pool of the application gateway.
2619

27-
Azure Application Gateway can be configured to terminate the Secure Sockets Layer (SSL) session at the gateway to avoid costly SSL decryption tasks to happen at the web farm. SSL offload also simplifies certificate management at the front-end server.
20+
In this article, you learn how to
2821

29-
## Prerequisite: Install the Azure CLI 2.0
22+
> [!div class="checklist"]
23+
> * Create a self-signed certificate
24+
> * Set up a network
25+
> * Create an application gateway with the certificate
26+
> * Create a virtual machine scale set with the default backend pool
3027
31-
To perform the steps in this article, you need to [install the Azure command-line interface for Mac, Linux, and Windows (Azure CLI)](https://docs.microsoft.com/cli/azure/install-az-cli2).
28+
If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/?WT.mc_id=A261C142F) before you begin.
3229

33-
## Required components
30+
[!INCLUDE [cloud-shell-try-it.md](../../includes/cloud-shell-try-it.md)]
3431

35-
* **Back-end server pool**: The list of IP addresses of the back-end servers. The IP addresses listed should belong to the virtual network subnet or should be a public IP address or virtual IP address (VIP).
36-
* **Back-end server pool settings**: Every pool has settings like port, protocol, and cookie-based affinity. These settings are tied to a pool and are applied to all servers within the pool.
37-
* **Front-end port**: This port is the public port that is opened on the application gateway. Traffic hits this port, and then gets redirected to one of the back-end servers.
38-
* **Listener**: The listener has a front-end port, a protocol (Http or Https; these settings are case-sensitive), and the SSL certificate name (if configuring SSL offload).
39-
* **Rule**: The rule binds the listener and the back-end server pool and defines which back-end server pool to direct the traffic to when it hits a particular listener. Currently, only the *basic* rule is supported. The *basic* rule is round-robin load distribution.
32+
If you choose to install and use the CLI locally, this quickstart requires that you are running the Azure CLI version 2.0.4 or later. To find the version, run `az --version`. If you need to install or upgrade, see [Install Azure CLI 2.0](/cli/azure/install-azure-cli).
4033

41-
**Additional configuration notes**
34+
## Create a self-signed certificate
4235

43-
For SSL certificates configuration, the protocol in **HttpListener** should change to *Https* (case sensitive). Add the **SslCertificate** element to **HttpListener** with the variable value configured for the SSL certificate. The front-end port should be updated to **443**.
36+
For production use, you should import a valid certificate signed by trusted provider. For this tutorial, you create a self-signed certificate and pfx file using the openssl command.
4437

45-
**To enable cookie-based affinity**: You can configure an application gateway to ensure that a request from a client session is always directed to the same VM in the web farm. To accomplish this, insert a session cookie that allows the gateway to direct traffic appropriately. To enable cookie-based affinity, set **CookieBasedAffinity** to *Enabled* in the **BackendHttpSettings** element.
46-
47-
## Configure SSL offload on an existing application gateway
38+
```azurecli-interactive
39+
openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout privateKey.key -out appgwcert.crt
40+
```
4841

49-
Enter the following commands to configure SSL offload to an existing application gateway:
42+
Enter values that make sense for youe certificate. You can accept the default values.
5043

5144
```azurecli-interactive
52-
#!/bin/bash
53-
54-
# Create a new front end port to be used for SSL
55-
az network application-gateway frontend-port create \
56-
--name sslport \
57-
--port 443 \
58-
--gateway-name "AdatumAppGateway" \
59-
--resource-group "AdatumAppGatewayRG"
60-
61-
# Upload the .pfx certificate for SSL offload
62-
az network application-gateway ssl-cert create \
63-
--name "newcert" \
64-
--cert-file /home/azureuser/self-signed/AdatumAppGatewayCert.pfx \
65-
--cert-password P@ssw0rd \
66-
--gateway-name "AdatumAppGateway" \
67-
--resource-group "AdatumAppGatewayRG"
68-
69-
# Create a new listener referencing the port and certificate created earlier
70-
az network application-gateway http-listener create \
71-
--frontend-ip "appGatewayFrontendIP" \
72-
--frontend-port sslport \
73-
--name sslListener \
74-
--ssl-cert newcert \
75-
--gateway-name "AdatumAppGateway" \
76-
--resource-group "AdatumAppGatewayRG"
77-
78-
# Create a new back-end pool to be used
79-
az network application-gateway address-pool create \
80-
--gateway-name "AdatumAppGateway" \
81-
--resource-group "AdatumAppGatewayRG" \
82-
--name "appGatewayBackendPool2" \
83-
--servers 10.0.0.7 10.0.0.8
84-
85-
# Create a new back-end HTTP settings using the new probe
86-
az network application-gateway http-settings create \
87-
--name "settings2" \
88-
--port 80 \
89-
--cookie-based-affinity Enabled \
90-
--protocol "Http" \
91-
--gateway-name "AdatumAppGateway" \
92-
--resource-group "AdatumAppGatewayRG"
93-
94-
# Create a new rule linking the listener to the back-end pool
95-
az network application-gateway rule create \
96-
--name "rule2" \
97-
--rule-type Basic \
98-
--http-settings settings2 \
99-
--http-listener ssllistener \
100-
--address-pool temp1 \
101-
--gateway-name "AdatumAppGateway" \
102-
--resource-group "AdatumAppGatewayRG"
45+
openssl pkcs12 -export -out appgwcert.pfx -inkey privateKey.key -in appgwcert.crt
46+
```
47+
48+
Enter the password for the certificate. In this example, *Azure123456!* is being used.
49+
50+
## Create a resource group
51+
52+
A resource group is a logical container into which Azure resources are deployed and managed. Create a resource group using [az group create](/cli/azure/group#create).
53+
54+
The following example creates a resource group named *myResourceGroupAG* in the *eastus* location.
10355

56+
```azurecli-interactive
57+
az group create --name myResourceGroupAG --location eastus
10458
```
10559

106-
## Create an application gateway with SSL offload
60+
## Create a virtual network, subnets, and public IP address
10761

108-
The following sample creates an application gateway with SSL offload. The certificate and certificate password must be updated to a valid private key.
62+
Create the virtual network and the subnet named *myAGSubnet* using [az network vnet create](/cli/azure/network/vnet#az_net). You can then add the subnet that's needed by the backend servers using [az network vnet subnet create](/cli/azure/network/vnet/subnet#az_network_vnet_subnet_create). Create the public IP address named *myAGPublicIPAddress* using [az network public-ip create](/cli/azure/public-ip#az_network_public_ip_create).
10963

11064
```azurecli-interactive
111-
#!/bin/bash
65+
az network vnet create \
66+
--name myVNet \
67+
--resource-group myResourceGroupAG \
68+
--location eastus \
69+
--address-prefix 10.0.0.0/16 \
70+
--subnet-name myAGSubnet \
71+
--subnet-prefix 10.0.1.0/24
72+
az network vnet subnet create \
73+
--name myBackendSubnet \
74+
--resource-group myResourceGroupAG \
75+
--vnet-name myVNet \
76+
--address-prefix 10.0.2.0/24
77+
az network public-ip create \
78+
--resource-group myResourceGroupAG \
79+
--name myAGPublicIPAddress
80+
```
81+
82+
### Create the application gateway
83+
84+
You can use [az network application-gateway create](/cli/azure/application-gateway#create) to create the application gateway. When you create an application gateway using the Azure CLI, you specify configuration information, such as capacity, sku, and HTTP settings.
85+
86+
The application gateway is assigned to *myAGSubnet* and *myPublicIPSddress* that you previously created. In this example, you associate the certificate that you created and its password when you create the application gateway.
11287

113-
# Creates an application gateway with SSL offload
88+
```azurecli-interactive
11489
az network application-gateway create \
115-
--name "AdatumAppGateway3" \
116-
--location "eastus" \
117-
--resource-group "AdatumAppGatewayRG2" \
118-
--vnet-name "AdatumAppGatewayVNET2" \
119-
--cert-file /home/azureuser/self-signed/AdatumAppGatewayCert.pfx \
120-
--cert-password P@ssw0rd \
121-
--vnet-address-prefix "10.0.0.0/16" \
122-
--subnet "Appgatewaysubnet" \
123-
--subnet-address-prefix "10.0.0.0/28" \
124-
--frontend-port 443 \
125-
--servers "10.0.0.5 10.0.0.4" \
90+
--name myAppGateway \
91+
--location eastus \
92+
--resource-group myResourceGroupAG \
93+
--vnet-name myVNet \
94+
--subnet myAGsubnet \
12695
--capacity 2 \
127-
--sku "Standard_Small" \
128-
--http-settings-cookie-based-affinity "Enabled" \
129-
--http-settings-protocol "Http" \
130-
--frontend-port "80" \
131-
--routing-rule-type "Basic" \
132-
--http-settings-port "80" \
133-
--public-ip-address "pip" \
134-
--public-ip-address-allocation "dynamic"
96+
--sku Standard_Medium \
97+
--http-settings-cookie-based-affinity Disabled \
98+
--frontend-port 443 \
99+
--http-settings-port 80 \
100+
--http-settings-protocol Http \
101+
--public-ip-address myAGPublicIPAddress \
102+
--cert-file appgwcert.pfx \
103+
--cert-password "Azure123456!"
104+
135105
```
136106

137-
## Get an application gateway DNS name
107+
It may take several minutes for the application gateway to be created. After the application gateway is created, you can see these new features of it:
138108

139-
After the gateway is created, the next step is to configure the front end for communication. Application Gateway requires a dynamically assigned DNS name when using a public IP, which is not friendly. To ensure end users can hit the application gateway, you can use a CNAME record to point to the public endpoint of the application gateway. For more information, see [Configuring a custom domain name for in Azure](../cloud-services/cloud-services-custom-domain-name-portal.md).
109+
- *appGatewayBackendPool* - An application gateway must have at least one backend address pool.
110+
- *appGatewayBackendHttpSettings* - Specifies that port 80 and an HTTP protocol is used for communication.
111+
- *appGatewayHttpListener* - The default listener associated with *appGatewayBackendPool*.
112+
- *appGatewayFrontendIP* - Assigns *myAGPublicIPAddress* to *appGatewayHttpListener*.
113+
- *rule1* - The default routing rule that is associated with *appGatewayHttpListener*.
140114

141-
To configure an alias, retrieve details of the application gateway and its associated IP/DNS name using the **PublicIPAddress** element attached to the application gateway. Use the application gateway's DNS name to create a CNAME record, which points the two web applications to this DNS name. We don't recommend the use of A-records because the VIP can change on restart of the application gateway.
115+
## Create a virtual machine scale set with the default backend pool
142116

117+
In this example, you create a virtual machine scale set that provides servers for the default backend pool in the application gateway. The virtual machines in the scale set are associated with *myBackendSubnet* and *appGatewayBackendPool*. You can use [az vmss create](/cli/azure/vmss#az_vmss_create) to create the scale set.
143118

144119
```azurecli-interactive
145-
az network public-ip show --name "pip" --resource-group "AdatumAppGatewayRG"
120+
az vmss create \
121+
--name myvmss \
122+
--resource-group myResourceGroupAG \
123+
--image UbuntuLTS \
124+
--admin-username azureuser \
125+
--admin-password Azure123456! \
126+
--instance-count 2 \
127+
--vnet-name myVNet \
128+
--subnet myBackendSubnet \
129+
--vm-sku Standard_DS2 \
130+
--upgrade-policy-mode Automatic \
131+
--app-gateway myAppGateway \
132+
--backend-pool-name appGatewayBackendPool
146133
```
147134

148-
```
135+
### Install NGINX
136+
137+
In your current shell, create a file named customConfig.json and paste the following configuration. You can use any editor you wish to create the file in the Cloud Shell. Enter `sensible-editor cloudConfig.json` to see a list of available editors to create the file.
138+
139+
```json
149140
{
150-
"dnsSettings": {
151-
"domainNameLabel": null,
152-
"fqdn": "8c786058-96d4-4f3e-bb41-660860ceae4c.cloudapp.net",
153-
"reverseFqdn": null
154-
},
155-
"etag": "W/\"3b0ac031-01f0-4860-b572-e3c25e0c57ad\"",
156-
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/AdatumAppGatewayRG/providers/Microsoft.Network/publicIPAddresses/pip2",
157-
"idleTimeoutInMinutes": 4,
158-
"ipAddress": "40.121.167.250",
159-
"ipConfiguration": {
160-
"etag": null,
161-
"id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/AdatumAppGatewayRG/providers/Microsoft.Network/applicationGateways/AdatumAppGateway2/frontendIPConfigurations/appGatewayFrontendIP",
162-
"name": null,
163-
"privateIpAddress": null,
164-
"privateIpAllocationMethod": null,
165-
"provisioningState": null,
166-
"publicIpAddress": null,
167-
"resourceGroup": "AdatumAppGatewayRG",
168-
"subnet": null
169-
},
170-
"location": "eastus",
171-
"name": "pip2",
172-
"provisioningState": "Succeeded",
173-
"publicIpAddressVersion": "IPv4",
174-
"publicIpAllocationMethod": "Dynamic",
175-
"resourceGroup": "AdatumAppGatewayRG",
176-
"resourceGuid": "3c30d310-c543-4e9d-9c72-bbacd7fe9b05",
177-
"tags": {
178-
"cli[2] owner[administrator]": ""
179-
},
180-
"type": "Microsoft.Network/publicIPAddresses"
141+
"fileUris": ["https://raw.githubusercontent.com/davidmu1/samplescripts/master/install_nginx.sh"],
142+
"commandToExecute": "./install_nginx.sh"
181143
}
182144
```
183145

146+
Run this command in the shell window:
147+
148+
```azurecli-interactive
149+
az vmss extension set \
150+
--publisher Microsoft.Azure.Extensions \
151+
--version 2.0 \
152+
--name CustomScript \
153+
--resource-group myResourceGroupAG \
154+
--vmss-name myvmss \
155+
--settings @cloudConfig.json
156+
```
157+
158+
## Test the application gateway
159+
160+
You can use [az network public-ip show](/cli/azure/network/public-ip#az_network_public_ip_show) to get the public IP address of the application gateway. Copy the public IP address, and then paste it into the address bar of your browser.
161+
162+
```azurepowershell-interactive
163+
az network public-ip show \
164+
--resource-group myResourceGroupAG \
165+
--name myAGPublicIPAddress \
166+
--query [ipAddress] \
167+
--output tsv
168+
```
169+
170+
![Secure warning](./media/application-gateway-ssl-cli/application-gateway-secure.png)
171+
172+
Your secured IIS website is then displayed as in the following example:
173+
174+
![Test base URL in application gateway](./media/application-gateway-ssl-cli/application-gateway-nginx.png)
175+
184176
## Next steps
185177

186-
If you want to configure an application gateway to use with an internal load balancer, see [Create an application gateway with an internal load balancer](application-gateway-ilb.md).
178+
In this tutorial, you learned how to:
179+
180+
> [!div class="checklist"]
181+
> * Create a self-signed certificate
182+
> * Set up a network
183+
> * Create an application gateway with the certificate
184+
> * Create a virtual machine scale set with the default backend pool
187185
188-
For more information about load balancing options in general, see:
189186

190-
* [Azure Load Balancer](https://azure.microsoft.com/documentation/services/load-balancer/)
191-
* [Azure Traffic Manager](https://azure.microsoft.com/documentation/services/traffic-manager/)

‎articles/application-gateway/media/application-gateway-ssl-cli/application-gateway-nginx.PNG

15.2 KB
Loading

0 commit comments

Comments
 (0)
Please sign in to comment.