Skip to content
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

Commit a09b58e

Browse files
vhornevhorne
committedApr 19, 2018
mvc-07
1 parent d17cdcd commit a09b58e

9 files changed

+906
-0
lines changed
 

‎articles/application-gateway/media/tutorial-url-route-cli/application-gateway-nginx-video.PNG

13.8 KB
Loading

‎articles/application-gateway/media/tutorial-url-route-cli/application-gateway-nginx.PNG

35 KB
Loading

‎articles/application-gateway/media/tutorial-url-route-cli/scenario.png

47.8 KB
Loading

‎articles/application-gateway/powershell-samples.md

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
---
2+
title: Azure Application Gateway PowerShell Samples | Microsoft Docs
3+
description: Azure Application Gateway PowerShell Samples
4+
services: application-gateway
5+
documentationcenter: networking
6+
author: davidmu1
7+
manager: timlt
8+
editor: tysonn
9+
tags: azure-resource-manager
10+
11+
ms.service: application-gateway
12+
ms.topic: article
13+
ms.tgt_pltfrm: vm-windows
14+
ms.workload: infrastructure
15+
ms.date: 01/29/2018
16+
ms.author: davidmu
17+
ms.custom: mvc
18+
---
19+
# Azure Application Gateway PowerShell samples
20+
21+
The following table includes links to Azure PowerShell script samples that create application gateways.
22+
23+
| | |
24+
|---|---|
25+
| [Manage web traffic](./scripts/create-vmss-powershell.md) | Creates an application gateway and all related resources.|
26+
| [Restrict web traffic](./scripts/create-vmss-waf-powershell.md) | Creates an application gateway that restricts traffic using OWASP rules.|
27+
| | |
28+

‎articles/application-gateway/redirect-external-site-cli.md

Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
---
2+
title: Create an application gateway with external traffic redirection - Azure CLI | Microsoft Docs
3+
description: Learn how to create an application gateway that redirects internal web traffic to the appropriate pool using the Azure CLI.
4+
services: application-gateway
5+
author: davidmu1
6+
manager: timlt
7+
editor: tysonn
8+
9+
ms.service: application-gateway
10+
ms.devlang: na
11+
ms.topic: article
12+
ms.tgt_pltfrm: na
13+
ms.workload: infrastructure-services
14+
ms.date: 01/24/2018
15+
ms.author: davidmu
16+
17+
---
18+
# Create an application gateway with external redirection using the Azure CLI
19+
20+
You can use the Azure CLI to configure [web traffic redirection](multiple-site-overview.md) when you create an [application gateway](overview.md). In this tutorial, you configure a listener and rule that redirects web traffic that arrives at the application gateway to an external site.
21+
22+
In this article, you learn how to:
23+
24+
> [!div class="checklist"]
25+
> * Set up the network
26+
> * Create a listener and redirection rule
27+
> * Create an application gateway
28+
29+
If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/?WT.mc_id=A261C142F) before you begin.
30+
31+
[!INCLUDE [cloud-shell-try-it.md](../../includes/cloud-shell-try-it.md)]
32+
33+
If you choose to install and use the CLI locally, this quickstart requires that you are running the Azure CLI version 2.0.4 or later. To find the version, run `az --version`. If you need to install or upgrade, see [Install Azure CLI 2.0](/cli/azure/install-azure-cli).
34+
35+
## Create a resource group
36+
37+
A resource group is a logical container into which Azure resources are deployed and managed. Create a resource group using [az group create](/cli/azure/group#create).
38+
39+
The following example creates a resource group named *myResourceGroupAG* in the *eastus* location.
40+
41+
```azurecli-interactive
42+
az group create --name myResourceGroupAG --location eastus
43+
```
44+
45+
## Create network resources
46+
47+
Create the virtual network named *myVNet* and the subnet named *myAGSubnet* using [az network vnet create](/cli/azure/network/vnet#az_net). Create the public IP address named *myAGPublicIPAddress* using [az network public-ip create](/cli/azure/public-ip#az_network_public_ip_create). These resources are used to provide network connectivity to the application gateway and its associated resources.
48+
49+
```azurecli-interactive
50+
az network vnet create \
51+
--name myVNet \
52+
--resource-group myResourceGroupAG \
53+
--location eastus \
54+
--address-prefix 10.0.0.0/16 \
55+
--subnet-name myAGSubnet \
56+
--subnet-prefix 10.0.1.0/24
57+
az network public-ip create \
58+
--resource-group myResourceGroupAG \
59+
--name myAGPublicIPAddress
60+
```
61+
62+
## Create an application gateway
63+
64+
You can use [az network application-gateway create](/cli/azure/application-gateway#create) to create the application gateway named *myAppGateway*. When you create an application gateway using the Azure CLI, you specify configuration information, such as capacity, sku, and HTTP settings. The application gateway is assigned to *myAGSubnet* and *myPublicIPSddress* that you previously created.
65+
66+
```azurecli-interactive
67+
az network application-gateway create \
68+
--name myAppGateway \
69+
--location eastus \
70+
--resource-group myResourceGroupAG \
71+
--vnet-name myVNet \
72+
--subnet myAGsubnet \
73+
--capacity 2 \
74+
--sku Standard_Medium \
75+
--http-settings-cookie-based-affinity Disabled \
76+
--frontend-port 8080 \
77+
--http-settings-port 80 \
78+
--http-settings-protocol Http \
79+
--public-ip-address myAGPublicIPAddress
80+
```
81+
82+
It may take several minutes for the application gateway to be created. After the application gateway is created, you can see these new features of it:
83+
84+
- *appGatewayBackendPool* - An application gateway must have at least one backend address pool.
85+
- *appGatewayBackendHttpSettings* - Specifies that port 80 and an HTTP protocol is used for communication.
86+
- *appGatewayHttpListener* - The default listener associated with *appGatewayBackendPool*.
87+
- *appGatewayFrontendIP* - Assigns *myAGPublicIPAddress* to *appGatewayHttpListener*.
88+
- *rule1* - The default routing rule that is associated with *appGatewayHttpListener*.
89+
90+
### Add the redirection configuration
91+
92+
Add the redirection configuration that sends traffic from *www.consoto.org* to the listener for *www.contoso.com* to the application gateway using [az network application-gateway redirect-config create](/cli/azure/network/application-gateway/redirect-config#az_network_application_gateway_redirect_config_create).
93+
94+
```azurecli-interactive
95+
az network application-gateway redirect-config create \
96+
--name myredirect \
97+
--gateway-name myAppGateway \
98+
--resource-group myResourceGroupAG \
99+
--type Temporary \
100+
--target-url "http://bing.com"
101+
```
102+
103+
### Add a listener and routing rule
104+
105+
A listener is required to enable the application gateway to appropriately route traffic. Create the listener using [az network application-gateway http-listener create](/cli/azure/application-gateway#az_network_application_gateway_http_listener_create) with the frontend port created with [az network application-gateway frontend-port create](/cli/azure/application-gateway#az_network_application_gateway_frontend_port_create). A rule is required for the listener to know where to send incoming traffic. Create a basic rule named *redirectRule* using [az network application-gateway rule create](/cli/azure/application-gateway#az_network_application_gateway_rule_create).
106+
107+
```azurecli-interactive
108+
az network application-gateway frontend-port create \
109+
--port 80 \
110+
--gateway-name myAppGateway \
111+
--resource-group myResourceGroupAG \
112+
--name redirectPort
113+
az network application-gateway http-listener create \
114+
--name redirectListener \
115+
--frontend-ip appGatewayFrontendIP \
116+
--frontend-port redirectPort \
117+
--resource-group myResourceGroupAG \
118+
--gateway-name myAppGateway
119+
az network application-gateway rule create \
120+
--gateway-name myAppGateway \
121+
--name redirectRule \
122+
--resource-group myResourceGroupAG \
123+
--http-listener redirectListener \
124+
--rule-type Basic \
125+
--redirect-config myredirect
126+
```
127+
128+
## Test the application gateway
129+
130+
To get the public IP address of the application gateway, you can use [az network public-ip show](/cli/azure/network/public-ip#az_network_public_ip_show). Copy the public IP address, and then paste it into the address bar of your browser.
131+
132+
You should see *bing.com* appear in your browser.
133+
134+
## Next steps
135+
136+
In this tutorial, you learned how to:
137+
138+
> * Set up the network
139+
> * Create a listener and redirection rule
140+
> * Create an application gateway

‎articles/application-gateway/redirect-external-site-powershell.md

Lines changed: 163 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,163 @@
1+
---
2+
title: Create an application gateway with external redirection - Azure PowerShell | Microsoft Docs
3+
description: Learn how to create an application gateway that redirects web traffic to an external site using Azure Powershell.
4+
services: application-gateway
5+
author: davidmu1
6+
manager: timlt
7+
editor: tysonn
8+
9+
ms.service: application-gateway
10+
ms.devlang: na
11+
ms.topic: article
12+
ms.tgt_pltfrm: na
13+
ms.workload: infrastructure-services
14+
ms.date: 01/24/2018
15+
ms.author: davidmu
16+
17+
---
18+
# Create an application gateway with external redirection using Azure PowerShell
19+
20+
You can use Azure Powershell to configure [web traffic redirection](multiple-site-overview.md) when you create an [application gateway](overview.md). In this tutorial, you configure a listener and rule that redirects web traffic that arrives at the application gateway to an external site.
21+
22+
In this article, you learn how to:
23+
24+
> [!div class="checklist"]
25+
> * Set up the network
26+
> * Create a listener and redirection rule
27+
> * Create an application gateway
28+
29+
If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/?WT.mc_id=A261C142F) before you begin.
30+
31+
[!INCLUDE [cloud-shell-powershell.md](../../includes/cloud-shell-powershell.md)]
32+
33+
If you choose to install and use the PowerShell locally, this tutorial requires the Azure PowerShell module version 3.6 or later. To find the version, run ` Get-Module -ListAvailable AzureRM` . If you need to upgrade, see [Install Azure PowerShell module](/powershell/azure/install-azurerm-ps). If you are running PowerShell locally, you also need to run `Login-AzureRmAccount` to create a connection with Azure.
34+
35+
## Create a resource group
36+
37+
A resource group is a logical container into which Azure resources are deployed and managed. Create an Azure resource group using [New-AzureRmResourceGroup](/powershell/module/azurerm.resources/new-azurermresourcegroup).
38+
39+
```azurepowershell-interactive
40+
New-AzureRmResourceGroup -Name myResourceGroupAG -Location eastus
41+
```
42+
43+
## Create network resources
44+
45+
Create the subnet configuration *myAGSubnet* using [New-AzureRmVirtualNetworkSubnetConfig](/powershell/module/azurerm.network/new-azurermvirtualnetworksubnetconfig). Create the virtual network named *myVNet* using [New-AzureRmVirtualNetwork](/powershell/module/azurerm.network/new-azurermvirtualnetwork) with the subnet configuration. And finally, create the public IP address using [New-AzureRmPublicIpAddress](/powershell/module/azurerm.network/new-azurermpublicipaddress). These resources are used to provide network connectivity to the application gateway and its associated resources.
46+
47+
```azurepowershell-interactive
48+
$agSubnetConfig = New-AzureRmVirtualNetworkSubnetConfig `
49+
-Name myAGSubnet `
50+
-AddressPrefix 10.0.1.0/24
51+
$vnet = New-AzureRmVirtualNetwork `
52+
-ResourceGroupName myResourceGroupAG `
53+
-Location eastus `
54+
-Name myVNet `
55+
-AddressPrefix 10.0.0.0/16 `
56+
-Subnet $agSubnetConfig
57+
$pip = New-AzureRmPublicIpAddress `
58+
-ResourceGroupName myResourceGroupAG `
59+
-Location eastus `
60+
-Name myAGPublicIPAddress `
61+
-AllocationMethod Dynamic
62+
```
63+
64+
## Create an application gateway
65+
66+
### Create the IP configurations and frontend port
67+
68+
Associate *myAGSubnet* that you previously created to the application gateway using [New-AzureRmApplicationGatewayIPConfiguration](/powershell/module/azurerm.network/new-azurermapplicationgatewayipconfiguration). Assign the public IP address to the application gateway using [New-AzureRmApplicationGatewayFrontendIPConfig](/powershell/module/azurerm.network/new-azurermapplicationgatewayfrontendipconfig). And then you can create the HTTP port using [New-AzureRmApplicationGatewayFrontendPort](/powershell/module/azurerm.network/new-azurermapplicationgatewayfrontendport).
69+
70+
```azurepowershell-interactive
71+
$vnet = Get-AzureRmVirtualNetwork `
72+
-ResourceGroupName myResourceGroupAG `
73+
-Name myVNet
74+
$subnet=$vnet.Subnets[0]
75+
$gipconfig = New-AzureRmApplicationGatewayIPConfiguration `
76+
-Name myAGIPConfig `
77+
-Subnet $subnet
78+
$fipconfig = New-AzureRmApplicationGatewayFrontendIPConfig `
79+
-Name myAGFrontendIPConfig `
80+
-PublicIPAddress $pip
81+
$frontendport = New-AzureRmApplicationGatewayFrontendPort `
82+
-Name myFrontendPort `
83+
-Port 80
84+
```
85+
86+
### Create the backend pool and settings
87+
88+
Create the backend pool named *defaultPool* for the application gateway using [New-AzureRmApplicationGatewayBackendAddressPool](/powershell/module/azurerm.network/new-azurermapplicationgatewaybackendaddresspool). Configure the settings for the pool using [New-AzureRmApplicationGatewayBackendHttpSettings](/powershell/module/azurerm.network/new-azurermapplicationgatewaybackendhttpsettings).
89+
90+
```azurepowershell-interactive
91+
$defaultPool = New-AzureRmApplicationGatewayBackendAddressPool `
92+
-Name defaultPool
93+
$poolSettings = New-AzureRmApplicationGatewayBackendHttpSettings `
94+
-Name myPoolSettings `
95+
-Port 80 `
96+
-Protocol Http `
97+
-CookieBasedAffinity Enabled `
98+
-RequestTimeout 120
99+
```
100+
101+
### Create the listener and rule
102+
103+
A listener is required to enable the application gateway to appropriately route traffic. Create the listener using [New-AzureRmApplicationGatewayHttpListener](/powershell/module/azurerm.network/new-azurermapplicationgatewayhttplistener) with the frontend configuration and frontend port that you previously created. A rule is required for the listener to know where to send incoming traffic. Create a basic rule named *redirectRule* using [New-AzureRmApplicationGatewayRequestRoutingRule](/powershell/module/azurerm.network/new-azurermapplicationgatewayrequestroutingrule).
104+
105+
```azurepowershell-interactive
106+
$defaultListener = New-AzureRmApplicationGatewayHttpListener `
107+
-Name defaultListener `
108+
-Protocol Http `
109+
-FrontendIPConfiguration $fipconfig `
110+
-FrontendPort $frontendport
111+
$redirectConfig = New-AzureRmApplicationGatewayRedirectConfiguration `
112+
-Name myredirect `
113+
-RedirectType Temporary `
114+
-TargetUrl "http://bing.com"
115+
$redirectRule = New-AzureRmApplicationGatewayRequestRoutingRule `
116+
-Name redirectRule `
117+
-RuleType Basic `
118+
-HttpListener $defaultListener `
119+
-RedirectConfiguration $redirectConfig
120+
```
121+
122+
### Create the application gateway
123+
124+
Now that you created the necessary supporting resources, specify parameters for the application gateway named *myAppGateway* using [New-AzureRmApplicationGatewaySku](/powershell/module/azurerm.network/new-azurermapplicationgatewaysku), and then create it using [New-AzureRmApplicationGateway](/powershell/module/azurerm.network/new-azurermapplicationgateway).
125+
126+
```azurepowershell-interactive
127+
$sku = New-AzureRmApplicationGatewaySku `
128+
-Name Standard_Medium `
129+
-Tier Standard `
130+
-Capacity 2
131+
$appgw = New-AzureRmApplicationGateway `
132+
-Name myAppGateway `
133+
-ResourceGroupName myResourceGroupAG `
134+
-Location eastus `
135+
-BackendAddressPools $defaultPool `
136+
-BackendHttpSettingsCollection $poolSettings `
137+
-FrontendIpConfigurations $fipconfig `
138+
-GatewayIpConfigurations $gipconfig `
139+
-FrontendPorts $frontendport `
140+
-HttpListeners $defaultListener `
141+
-RequestRoutingRules $redirectRule `
142+
-RedirectConfigurations $redirectConfig `
143+
-Sku $sku
144+
```
145+
146+
## Test the application gateway
147+
148+
You can use [Get-AzureRmPublicIPAddress](/powershell/module/azurerm.network/get-azurermpublicipaddress) to get the public IP address of the application gateway. Copy the public IP address, and then paste it into the address bar of your browser.
149+
150+
```azurepowershell-interactive
151+
Get-AzureRmPublicIPAddress -ResourceGroupName myResourceGroupAG -Name myAGPublicIPAddress
152+
```
153+
154+
You should see *bing.com* appear in your browser.
155+
156+
## Next steps
157+
158+
In this article, you learned how to:
159+
160+
> [!div class="checklist"]
161+
> * Set up the network
162+
> * Create a listener and redirection rule
163+
> * Create an application gateway

‎articles/application-gateway/redirect-http-to-https-cli.md

Lines changed: 234 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,234 @@
1+
---
2+
title: Create an application gateway with a certificate - Azure CLI | Microsoft Docs
3+
description: Learn how to create an application gateway and add a certificate for SSL termination using the Azure CLI.
4+
services: application-gateway
5+
author: davidmu1
6+
manager: timlt
7+
editor: tysonn
8+
9+
ms.service: application-gateway
10+
ms.topic: article
11+
ms.workload: infrastructure-services
12+
ms.date: 01/23/2018
13+
ms.author: davidmu
14+
15+
---
16+
# Create an application gateway with HTTP to HTTPS redirection using the Azure CLI
17+
18+
You can use the Azure CLI to create an [application gateway](overview.md) with a certificate for SSL termination. A routing rule is used to redirect HTTP traffic to the HTTPS port in your application gateway. In this example, you also create a [virtual machine scale set](../virtual-machine-scale-sets/virtual-machine-scale-sets-overview.md) for the backend pool of the application gateway that contains two virtual machine instances.
19+
20+
In this article, you learn how to:
21+
22+
> [!div class="checklist"]
23+
> * Create a self-signed certificate
24+
> * Set up a network
25+
> * Create an application gateway with the certificate
26+
> * Add a listener and redirection rule
27+
> * Create a virtual machine scale set with the default backend pool
28+
29+
If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/?WT.mc_id=A261C142F) before you begin.
30+
31+
[!INCLUDE [cloud-shell-try-it.md](../../includes/cloud-shell-try-it.md)]
32+
33+
If you choose to install and use the CLI locally, this quickstart requires that you are running the Azure CLI version 2.0.4 or later. To find the version, run `az --version`. If you need to install or upgrade, see [Install Azure CLI 2.0](/cli/azure/install-azure-cli).
34+
35+
## Create a self-signed certificate
36+
37+
For production use, you should import a valid certificate signed by a trusted provider. For this tutorial, you create a self-signed certificate and pfx file using the openssl command.
38+
39+
```azurecli-interactive
40+
openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout privateKey.key -out appgwcert.crt
41+
```
42+
43+
Enter values that make sense for your certificate. You can accept the default values.
44+
45+
```azurecli-interactive
46+
openssl pkcs12 -export -out appgwcert.pfx -inkey privateKey.key -in appgwcert.crt
47+
```
48+
49+
Enter the password for the certificate. In this example, *Azure123456!* is being used.
50+
51+
## Create a resource group
52+
53+
A resource group is a logical container into which Azure resources are deployed and managed. Create a resource group using [az group create](/cli/azure/group#create).
54+
55+
The following example creates a resource group named *myResourceGroupAG* in the *eastus* location.
56+
57+
```azurecli-interactive
58+
az group create --name myResourceGroupAG --location eastus
59+
```
60+
61+
## Create network resources
62+
63+
Create the virtual network named *myVNet* and the subnet named *myAGSubnet* using [az network vnet create](/cli/azure/network/vnet#az_net). You can then add the subnet named *myBackendSubnet* that's needed by the backend servers using [az network vnet subnet create](/cli/azure/network/vnet/subnet#az_network_vnet_subnet_create). Create the public IP address named *myAGPublicIPAddress* using [az network public-ip create](/cli/azure/public-ip#az_network_public_ip_create).
64+
65+
```azurecli-interactive
66+
az network vnet create \
67+
--name myVNet \
68+
--resource-group myResourceGroupAG \
69+
--location eastus \
70+
--address-prefix 10.0.0.0/16 \
71+
--subnet-name myAGSubnet \
72+
--subnet-prefix 10.0.1.0/24
73+
az network vnet subnet create \
74+
--name myBackendSubnet \
75+
--resource-group myResourceGroupAG \
76+
--vnet-name myVNet \
77+
--address-prefix 10.0.2.0/24
78+
az network public-ip create \
79+
--resource-group myResourceGroupAG \
80+
--name myAGPublicIPAddress
81+
```
82+
83+
## Create the application gateway
84+
85+
You can use [az network application-gateway create](/cli/azure/network/application-gateway#az_network_application_gateway_create) to create the application gateway named *myAppGateway*. When you create an application gateway using the Azure CLI, you specify configuration information, such as capacity, sku, and HTTP settings.
86+
87+
The application gateway is assigned to *myAGSubnet* and *myAGPublicIPAddress* that you previously created. In this example, you associate the certificate that you created and its password when you create the application gateway.
88+
89+
```azurecli-interactive
90+
az network application-gateway create \
91+
--name myAppGateway \
92+
--location eastus \
93+
--resource-group myResourceGroupAG \
94+
--vnet-name myVNet \
95+
--subnet myAGsubnet \
96+
--capacity 2 \
97+
--sku Standard_Medium \
98+
--http-settings-cookie-based-affinity Disabled \
99+
--frontend-port 443 \
100+
--http-settings-port 80 \
101+
--http-settings-protocol Http \
102+
--public-ip-address myAGPublicIPAddress \
103+
--cert-file appgwcert.pfx \
104+
--cert-password "Azure123456!"
105+
106+
```
107+
108+
It may take several minutes for the application gateway to be created. After the application gateway is created, you can see these new features of it:
109+
110+
- *appGatewayBackendPool* - An application gateway must have at least one backend address pool.
111+
- *appGatewayBackendHttpSettings* - Specifies that port 80 and an HTTP protocol is used for communication.
112+
- *appGatewayHttpListener* - The default listener associated with *appGatewayBackendPool*.
113+
- *appGatewayFrontendIP* - Assigns *myAGPublicIPAddress* to *appGatewayHttpListener*.
114+
- *rule1* - The default routing rule that is associated with *appGatewayHttpListener*.
115+
116+
## Add a listener and redirection rule
117+
118+
### Add the HTTP port
119+
120+
You can use [az network application-gateway frontend-port create](/cli/azure/network/application-gateway/frontend-port#az_network_application_gateway_frontend_port_create) to add the HTTP port to the application gateway.
121+
122+
```azurecli-interactive
123+
az network application-gateway frontend-port create \
124+
--port 80 \
125+
--gateway-name myAppGateway \
126+
--resource-group myResourceGroupAG \
127+
--name httpPort
128+
```
129+
130+
### Add the HTTP listener
131+
132+
You can use [az network application-gateway http-listener create](/cli/azure/network/application-gateway/http-listener#az_network_application_gateway_http_listener_create) to add the listener named *myListener* to the application gateway.
133+
134+
```azurecli-interactive
135+
az network application-gateway http-listener create \
136+
--name myListener \
137+
--frontend-ip appGatewayFrontendIP \
138+
--frontend-port httpPort \
139+
--resource-group myResourceGroupAG \
140+
--gateway-name myAppGateway
141+
```
142+
143+
### Add the redirection configuration
144+
145+
Add the HTTP to HTTPS redirection configuration to the application gateway using [az network application-gateway redirect-config create](/cli/azure/network/application-gateway/redirect-config#az_network_application_gateway_redirect_config_create).
146+
147+
```azurecli-interactive
148+
az network application-gateway redirect-config create \
149+
--name httpToHttps \
150+
--gateway-name myAppGateway \
151+
--resource-group myResourceGroupAG \
152+
--type Permanent \
153+
--target-listener appGatewayHttpListener \
154+
--include-path true \
155+
--include-query-string true
156+
```
157+
158+
### Add the routing rule
159+
160+
Add the routing rule named *rule2* with the redirection configuration to the application gateway using [az network application-gateway rule create](/cli/azure/network/application-gateway/rule#az_network_application_gateway_rule_create).
161+
162+
```azurecli-interactive
163+
az network application-gateway rule create \
164+
--gateway-name myAppGateway \
165+
--name rule2 \
166+
--resource-group myResourceGroupAG \
167+
--http-listener myListener \
168+
--rule-type Basic \
169+
--redirect-config httpToHttps
170+
```
171+
172+
## Create a virtual machine scale set
173+
174+
In this example, you create a virtual machine scale set named *myvmss* that provides servers for the backend pool in the application gateway. The virtual machines in the scale set are associated with *myBackendSubnet* and *appGatewayBackendPool*. To create the scale set, you can use [az vmss create](/cli/azure/vmss#az_vmss_create).
175+
176+
```azurecli-interactive
177+
az vmss create \
178+
--name myvmss \
179+
--resource-group myResourceGroupAG \
180+
--image UbuntuLTS \
181+
--admin-username azureuser \
182+
--admin-password Azure123456! \
183+
--instance-count 2 \
184+
--vnet-name myVNet \
185+
--subnet myBackendSubnet \
186+
--vm-sku Standard_DS2 \
187+
--upgrade-policy-mode Automatic \
188+
--app-gateway myAppGateway \
189+
--backend-pool-name appGatewayBackendPool
190+
```
191+
192+
### Install NGINX
193+
194+
```azurecli-interactive
195+
az vmss extension set \
196+
--publisher Microsoft.Azure.Extensions \
197+
--version 2.0 \
198+
--name CustomScript \
199+
--resource-group myResourceGroupAG \
200+
--vmss-name myvmss \
201+
--settings '{ "fileUris": ["https://raw.githubusercontent.com/davidmu1/samplescripts/master/install_nginx.sh"],
202+
"commandToExecute": "./install_nginx.sh" }'
203+
```
204+
205+
## Test the application gateway
206+
207+
To get the public IP address of the application gateway, you can use [az network public-ip show](/cli/azure/network/public-ip#az_network_public_ip_show). Copy the public IP address, and then paste it into the address bar of your browser.
208+
209+
```azurepowershell-interactive
210+
az network public-ip show \
211+
--resource-group myResourceGroupAG \
212+
--name myAGPublicIPAddress \
213+
--query [ipAddress] \
214+
--output tsv
215+
```
216+
217+
![Secure warning](./media/redirect-http-to-https-cli/application-gateway-secure.png)
218+
219+
To accept the security warning if you used a self-signed certificate, select **Details** and then **Go on to the webpage**. Your secured NGINX site is then displayed as in the following example:
220+
221+
![Test base URL in application gateway](./media/redirect-http-to-https-cli/application-gateway-nginxtest.png)
222+
223+
## Next steps
224+
225+
In this tutorial, you learned how to:
226+
227+
> [!div class="checklist"]
228+
> * Create a self-signed certificate
229+
> * Set up a network
230+
> * Create an application gateway with the certificate
231+
> * Add a listener and redirection rule
232+
> * Create a virtual machine scale set with the default backend pool
233+
234+

‎articles/application-gateway/redirect-http-to-https-powershell.md

Lines changed: 341 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,341 @@
1+
---
2+
title: Create an application gateway with HTTP to HTTPS redirection - Azure PowerShell | Microsoft Docs
3+
description: Learn how to create an application gateway with redirected traffic from HTTP to HTTPS using Azure PowerShell.
4+
services: application-gateway
5+
author: davidmu1
6+
manager: timlt
7+
editor: tysonn
8+
tags: azure-resource-manager
9+
10+
ms.service: application-gateway
11+
ms.topic: article
12+
ms.workload: infrastructure-services
13+
ms.date: 01/23/2018
14+
ms.author: davidmu
15+
16+
---
17+
# Create an application gateway with HTTP to HTTPS redirection using Azure PowerShell
18+
19+
You can use the Azure PowerShell to create an [application gateway](overview.md) with a certificate for SSL termination. A routing rule is used to redirect HTTP traffic to the HTTPS port in your application gateway. In this example, you also create a [virtual machine scale set](../virtual-machine-scale-sets/virtual-machine-scale-sets-overview.md) for the backend pool of the application gateway that contains two virtual machine instances.
20+
21+
In this article, you learn how to:
22+
23+
> [!div class="checklist"]
24+
> * Create a self-signed certificate
25+
> * Set up a network
26+
> * Create an application gateway with the certificate
27+
> * Add a listener and redirection rule
28+
> * Create a virtual machine scale set with the default backend pool
29+
30+
If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/?WT.mc_id=A261C142F) before you begin.
31+
32+
This tutorial requires the Azure PowerShell module version 3.6 or later. Run `Get-Module -ListAvailable AzureRM` to find the version. If you need to upgrade, see [Install Azure PowerShell module](/powershell/azure/install-azurerm-ps). To run the commands in this tutorial, you also need to run `Login-AzureRmAccount` to create a connection with Azure.
33+
34+
## Create a self-signed certificate
35+
36+
For production use, you should import a valid certificate signed by a trusted provider. For this tutorial, you create a self-signed certificate using [New-SelfSignedCertificate](https://docs.microsoft.com/powershell/module/pkiclient/new-selfsignedcertificate). You can use [Export-PfxCertificate](https://docs.microsoft.com/powershell/module/pkiclient/export-pfxcertificate) with the Thumbprint that was returned to export a pfx file from the certificate.
37+
38+
```powershell
39+
New-SelfSignedCertificate `
40+
-certstorelocation cert:\localmachine\my `
41+
-dnsname www.contoso.com
42+
```
43+
44+
You should see something like this result:
45+
46+
```
47+
PSParentPath: Microsoft.PowerShell.Security\Certificate::LocalMachine\my
48+
49+
Thumbprint Subject
50+
---------- -------
51+
E1E81C23B3AD33F9B4D1717B20AB65DBB91AC630 CN=www.contoso.com
52+
```
53+
54+
Use the thumbprint to create the pfx file:
55+
56+
```powershell
57+
$pwd = ConvertTo-SecureString -String "Azure123456!" -Force -AsPlainText
58+
Export-PfxCertificate `
59+
-cert cert:\localMachine\my\E1E81C23B3AD33F9B4D1717B20AB65DBB91AC630 `
60+
-FilePath c:\appgwcert.pfx `
61+
-Password $pwd
62+
```
63+
64+
## Create a resource group
65+
66+
A resource group is a logical container into which Azure resources are deployed and managed. Create an Azure resource group named *myResourceGroupAG* using [New-AzureRmResourceGroup](/powershell/module/azurerm.resources/new-azurermresourcegroup).
67+
68+
```powershell
69+
New-AzureRmResourceGroup -Name myResourceGroupAG -Location eastus
70+
```
71+
72+
## Create network resources
73+
74+
Create the subnet configurations for *myBackendSubnet* and *myAGSubnet* using [New-AzureRmVirtualNetworkSubnetConfig](/powershell/module/azurerm.network/new-azurermvirtualnetworksubnetconfig). Create the virtual network named *myVNet* using [New-AzureRmVirtualNetwork](/powershell/module/azurerm.network/new-azurermvirtualnetwork) with the subnet configurations. And finally, create the public IP address named *myAGPublicIPAddress* using [New-AzureRmPublicIpAddress](/powershell/module/azurerm.network/new-azurermpublicipaddress). These resources are used to provide network connectivity to the application gateway and its associated resources.
75+
76+
```powershell
77+
$backendSubnetConfig = New-AzureRmVirtualNetworkSubnetConfig `
78+
-Name myBackendSubnet `
79+
-AddressPrefix 10.0.1.0/24
80+
$agSubnetConfig = New-AzureRmVirtualNetworkSubnetConfig `
81+
-Name myAGSubnet `
82+
-AddressPrefix 10.0.2.0/24
83+
$vnet = New-AzureRmVirtualNetwork `
84+
-ResourceGroupName myResourceGroupAG `
85+
-Location eastus `
86+
-Name myVNet `
87+
-AddressPrefix 10.0.0.0/16 `
88+
-Subnet $backendSubnetConfig, $agSubnetConfig
89+
$pip = New-AzureRmPublicIpAddress `
90+
-ResourceGroupName myResourceGroupAG `
91+
-Location eastus `
92+
-Name myAGPublicIPAddress `
93+
-AllocationMethod Dynamic
94+
```
95+
96+
## Create an application gateway
97+
98+
### Create the IP configurations and frontend port
99+
100+
Associate *myAGSubnet* that you previously created to the application gateway using [New-AzureRmApplicationGatewayIPConfiguration](/powershell/module/azurerm.network/new-azurermapplicationgatewayipconfiguration). Assign *myAGPublicIPAddress* to the application gateway using [New-AzureRmApplicationGatewayFrontendIPConfig](/powershell/module/azurerm.network/new-azurermapplicationgatewayfrontendipconfig). And then you can create the HTTPS port using [New-AzureRmApplicationGatewayFrontendPort](/powershell/module/azurerm.network/new-azurermapplicationgatewayfrontendport).
101+
102+
```powershell
103+
$vnet = Get-AzureRmVirtualNetwork `
104+
-ResourceGroupName myResourceGroupAG `
105+
-Name myVNet
106+
$subnet=$vnet.Subnets[0]
107+
$gipconfig = New-AzureRmApplicationGatewayIPConfiguration `
108+
-Name myAGIPConfig `
109+
-Subnet $subnet
110+
$fipconfig = New-AzureRmApplicationGatewayFrontendIPConfig `
111+
-Name myAGFrontendIPConfig `
112+
-PublicIPAddress $pip
113+
$frontendPort = New-AzureRmApplicationGatewayFrontendPort `
114+
-Name myFrontendPort `
115+
-Port 443
116+
```
117+
118+
### Create the backend pool and settings
119+
120+
Create the backend pool named *appGatewayBackendPool* for the application gateway using [New-AzureRmApplicationGatewayBackendAddressPool](/powershell/module/azurerm.network/new-azurermapplicationgatewaybackendaddresspool). Configure the settings for the backend pool using [New-AzureRmApplicationGatewayBackendHttpSettings](/powershell/module/azurerm.network/new-azurermapplicationgatewaybackendhttpsettings).
121+
122+
```powershell
123+
$defaultPool = New-AzureRmApplicationGatewayBackendAddressPool `
124+
-Name appGatewayBackendPool
125+
$poolSettings = New-AzureRmApplicationGatewayBackendHttpSettings `
126+
-Name myPoolSettings `
127+
-Port 80 `
128+
-Protocol Http `
129+
-CookieBasedAffinity Enabled `
130+
-RequestTimeout 120
131+
```
132+
133+
### Create the default listener and rule
134+
135+
A listener is required to enable the application gateway to route traffic appropriately to the backend pool. In this example, you create a basic listener that listens for HTTPS traffic at the root URL.
136+
137+
Create a certificate object using [New-AzureRmApplicationGatewaySslCertificate](/powershell/module/azurerm.network/new-azurermapplicationgatewaysslcertificate) and then create a listener named *appGatewayHttpListener* using [New-AzureRmApplicationGatewayHttpListener](/powershell/module/azurerm.network/new-azurermapplicationgatewayhttplistener) with the frontend configuration, frontend port, and certificate that you previously created. A rule is required for the listener to know which backend pool to use for incoming traffic. Create a basic rule named *rule1* using [New-AzureRmApplicationGatewayRequestRoutingRule](/powershell/module/azurerm.network/new-azurermapplicationgatewayrequestroutingrule).
138+
139+
```powershell
140+
$pwd = ConvertTo-SecureString `
141+
-String "Azure123456!" `
142+
-Force `
143+
-AsPlainText
144+
$cert = New-AzureRmApplicationGatewaySslCertificate `
145+
-Name "appgwcert" `
146+
-CertificateFile "c:\appgwcert.pfx" `
147+
-Password $pwd
148+
$defaultListener = New-AzureRmApplicationGatewayHttpListener `
149+
-Name appGatewayHttpListener `
150+
-Protocol Https `
151+
-FrontendIPConfiguration $fipconfig `
152+
-FrontendPort $frontendPort `
153+
-SslCertificate $cert
154+
$frontendRule = New-AzureRmApplicationGatewayRequestRoutingRule `
155+
-Name rule1 `
156+
-RuleType Basic `
157+
-HttpListener $defaultListener `
158+
-BackendAddressPool $defaultPool `
159+
-BackendHttpSettings $poolSettings
160+
```
161+
162+
### Create the application gateway
163+
164+
Now that you created the necessary supporting resources, specify parameters for the application gateway named *myAppGateway* using [New-AzureRmApplicationGatewaySku](/powershell/module/azurerm.network/new-azurermapplicationgatewaysku), and then create it using [New-AzureRmApplicationGateway](/powershell/module/azurerm.network/new-azurermapplicationgateway) with the certificate.
165+
166+
```powershell
167+
$sku = New-AzureRmApplicationGatewaySku `
168+
-Name Standard_Medium `
169+
-Tier Standard `
170+
-Capacity 2
171+
$appgw = New-AzureRmApplicationGateway `
172+
-Name myAppGateway `
173+
-ResourceGroupName myResourceGroupAG `
174+
-Location eastus `
175+
-BackendAddressPools $defaultPool `
176+
-BackendHttpSettingsCollection $poolSettings `
177+
-FrontendIpConfigurations $fipconfig `
178+
-GatewayIpConfigurations $gipconfig `
179+
-FrontendPorts $frontendPort `
180+
-HttpListeners $defaultListener `
181+
-RequestRoutingRules $frontendRule `
182+
-Sku $sku `
183+
-SslCertificates $cert
184+
```
185+
186+
## Add a listener and redirection rule
187+
188+
### Add the HTTP port
189+
190+
Add the HTTP port to the application gateway using [Add-AzureRmApplicationGatewayFrontendPort](/powershell/module/azurerm.network/add-azurermapplicationgatewayfrontendport).
191+
192+
```powershell
193+
$appgw = Get-AzureRmApplicationGateway `
194+
-Name myAppGateway `
195+
-ResourceGroupName myResourceGroupAG
196+
Add-AzureRmApplicationGatewayFrontendPort `
197+
-Name httpPort `
198+
-Port 80 `
199+
-ApplicationGateway $appgw
200+
```
201+
202+
### Add the HTTP listener
203+
204+
Add the HTTP listener named *myListener* to the application gateway using [Add-AzureRmApplicationGatewayHttpListener](/powershell/module/azurerm.network/add-azurermapplicationgatewayhttplistener).
205+
206+
```powershell
207+
$fipconfig = Get-AzureRmApplicationGatewayFrontendIPConfig `
208+
-Name myAGFrontendIPConfig `
209+
-ApplicationGateway $appgw
210+
$fp = Get-AzureRmApplicationGatewayFrontendPort `
211+
-Name httpPort `
212+
-ApplicationGateway $appgw
213+
Add-AzureRmApplicationGatewayHttpListener `
214+
-Name myListener `
215+
-Protocol Http `
216+
-FrontendPort $fp `
217+
-FrontendIPConfiguration $fipconfig `
218+
-ApplicationGateway $appgw
219+
```
220+
221+
### Add the redirection configuration
222+
223+
Add the HTTP to HTTPS redirection configuration to the application gateway using [Add-AzureRmApplicationGatewayRedirectConfiguration](/powershell/module/azurerm.network/add-azurermapplicationgatewayredirectconfiguration).
224+
225+
```powershell
226+
$defaultListener = Get-AzureRmApplicationGatewayHttpListener `
227+
-Name appGatewayHttpListener `
228+
-ApplicationGateway $appgw
229+
Add-AzureRmApplicationGatewayRedirectConfiguration -Name httpToHttps `
230+
-RedirectType Permanent `
231+
-TargetListener $defaultListener `
232+
-IncludePath $true `
233+
-IncludeQueryString $true `
234+
-ApplicationGateway $appgw
235+
```
236+
237+
### Add the routing rule
238+
239+
Add the routing rule with the redirection configuration to the application gateway using [Add-AzureRmApplicationGatewayRequestRoutingRule](/powershell/module/azurerm.network/add-azurermapplicationgatewayrequestroutingrule).
240+
241+
```powershell
242+
$myListener = Get-AzureRmApplicationGatewayHttpListener `
243+
-Name myListener `
244+
-ApplicationGateway $appgw
245+
$redirectConfig = Get-AzureRmApplicationGatewayRedirectConfiguration `
246+
-Name httpToHttps `
247+
-ApplicationGateway $appgw
248+
Add-AzureRmApplicationGatewayRequestRoutingRule `
249+
-Name rule2 `
250+
-RuleType Basic `
251+
-HttpListener $myListener `
252+
-RedirectConfiguration $redirectConfig `
253+
-ApplicationGateway $appgw
254+
Set-AzureRmApplicationGateway -ApplicationGateway $appgw
255+
```
256+
257+
## Create a virtual machine scale set
258+
259+
In this example, you create a virtual machine scale set to provide servers for the backend pool in the application gateway. You assign the scale set to the backend pool when you configure the IP settings.
260+
261+
```powershell
262+
$vnet = Get-AzureRmVirtualNetwork `
263+
-ResourceGroupName myResourceGroupAG `
264+
-Name myVNet
265+
$appgw = Get-AzureRmApplicationGateway `
266+
-ResourceGroupName myResourceGroupAG `
267+
-Name myAppGateway
268+
$backendPool = Get-AzureRmApplicationGatewayBackendAddressPool `
269+
-Name appGatewayBackendPool `
270+
-ApplicationGateway $appgw
271+
$ipConfig = New-AzureRmVmssIpConfig `
272+
-Name myVmssIPConfig `
273+
-SubnetId $vnet.Subnets[1].Id `
274+
-ApplicationGatewayBackendAddressPoolsId $backendPool.Id
275+
$vmssConfig = New-AzureRmVmssConfig `
276+
-Location eastus `
277+
-SkuCapacity 2 `
278+
-SkuName Standard_DS2 `
279+
-UpgradePolicyMode Automatic
280+
Set-AzureRmVmssStorageProfile $vmssConfig `
281+
-ImageReferencePublisher MicrosoftWindowsServer `
282+
-ImageReferenceOffer WindowsServer `
283+
-ImageReferenceSku 2016-Datacenter `
284+
-ImageReferenceVersion latest
285+
Set-AzureRmVmssOsProfile $vmssConfig `
286+
-AdminUsername azureuser `
287+
-AdminPassword "Azure123456!" `
288+
-ComputerNamePrefix myvmss
289+
Add-AzureRmVmssNetworkInterfaceConfiguration `
290+
-VirtualMachineScaleSet $vmssConfig `
291+
-Name myVmssNetConfig `
292+
-Primary $true `
293+
-IPConfiguration $ipConfig
294+
New-AzureRmVmss `
295+
-ResourceGroupName myResourceGroupAG `
296+
-Name myvmss `
297+
-VirtualMachineScaleSet $vmssConfig
298+
```
299+
300+
### Install IIS
301+
302+
```powershell
303+
$publicSettings = @{ "fileUris" = (,"https://raw.githubusercontent.com/davidmu1/samplescripts/master/appgatewayurl.ps1");
304+
"commandToExecute" = "powershell -ExecutionPolicy Unrestricted -File appgatewayurl.ps1" }
305+
$vmss = Get-AzureRmVmss -ResourceGroupName myResourceGroupAG -VMScaleSetName myvmss
306+
Add-AzureRmVmssExtension -VirtualMachineScaleSet $vmss `
307+
-Name "customScript" `
308+
-Publisher "Microsoft.Compute" `
309+
-Type "CustomScriptExtension" `
310+
-TypeHandlerVersion 1.8 `
311+
-Setting $publicSettings
312+
Update-AzureRmVmss `
313+
-ResourceGroupName myResourceGroupAG `
314+
-Name myvmss `
315+
-VirtualMachineScaleSet $vmss
316+
```
317+
318+
## Test the application gateway
319+
320+
You can use [Get-AzureRmPublicIPAddress](/powershell/module/azurerm.network/get-azurermpublicipaddress) to get the public IP address of the application gateway. Copy the public IP address, and then paste it into the address bar of your browser. For example, http://52.170.203.149
321+
322+
```powershell
323+
Get-AzureRmPublicIPAddress -ResourceGroupName myResourceGroupAG -Name myAGPublicIPAddress
324+
```
325+
326+
![Secure warning](./media/redirect-http-to-https-powershell/application-gateway-secure.png)
327+
328+
To accept the security warning if you used a self-signed certificate, select **Details** and then **Go on to the webpage**. Your secured IIS website is then displayed as in the following example:
329+
330+
![Test base URL in application gateway](./media/redirect-http-to-https-powershell/application-gateway-iistest.png)
331+
332+
## Next steps
333+
334+
In this tutorial, you learned how to:
335+
336+
> [!div class="checklist"]
337+
> * Create a self-signed certificate
338+
> * Set up a network
339+
> * Create an application gateway with the certificate
340+
> * Add a listener and redirection rule
341+
> * Create a virtual machine scale set with the default backend pool

0 commit comments

Comments
 (0)
Please sign in to comment.