|
| 1 | +--- |
| 2 | +title: Tutorial - Manage web traffic - Azure PowerShell |
| 3 | +description: Learn how to create an application gateway with a virtual machine scale set to manage web traffic using using Azure PowerShell. |
| 4 | +services: application-gateway |
| 5 | +author: vhorne |
| 6 | +manager: jpconnock |
| 7 | + |
| 8 | +ms.service: application-gateway |
| 9 | +ms.topic: tutorial |
| 10 | +ms.workload: infrastructure-services |
| 11 | +ms.date: 3/22/2018 |
| 12 | +ms.author: victorh |
| 13 | +ms.custom: mvc |
| 14 | +--- |
| 15 | +# Tutorial: Manage web traffic with an application gateway using Azure PowerShell |
| 16 | + |
| 17 | +Application gateway is used to manage and secure web traffic to servers that you maintain. You can use Azure PowerShell to create an [application gateway](overview.md) that uses a [virtual machine scale set](../virtual-machine-scale-sets/virtual-machine-scale-sets-overview.md) for backend servers to manage web traffic. In this example, the scale set contains two virtual machine instances that are added to the default backend pool of the application gateway. |
| 18 | + |
| 19 | +In this tutorial, you learn how to: |
| 20 | + |
| 21 | +> [!div class="checklist"] |
| 22 | +> * Set up the network |
| 23 | +> * Create an application gateway |
| 24 | +> * Create a virtual machine scale set with the default backend pool |
| 25 | +
|
| 26 | +If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/?WT.mc_id=A261C142F) before you begin. |
| 27 | + |
| 28 | +[!INCLUDE [cloud-shell-powershell.md](../../includes/cloud-shell-powershell.md)] |
| 29 | + |
| 30 | +If you choose to install and use PowerShell locally, this tutorial requires the Azure PowerShell module version 3.6 or later. To find the version, run `Get-Module -ListAvailable AzureRM`. If you need to upgrade, see [Install Azure PowerShell module](/powershell/azure/install-azurerm-ps). If you are running PowerShell locally, you also need to run `Login-AzureRmAccount` to create a connection with Azure. |
| 31 | + |
| 32 | +## Create a resource group |
| 33 | + |
| 34 | +A resource group is a logical container into which Azure resources are deployed and managed. Create an Azure resource group using [New-AzureRmResourceGroup](/powershell/module/azurerm.resources/new-azurermresourcegroup). |
| 35 | + |
| 36 | +```azurepowershell-interactive |
| 37 | +New-AzureRmResourceGroup -Name myResourceGroupAG -Location eastus |
| 38 | +``` |
| 39 | + |
| 40 | +## Create network resources |
| 41 | + |
| 42 | +Configure the subnets named *myBackendSubnet* and *myAGSubnet* using [New-AzureRmVirtualNetworkSubnetConfig](/powershell/module/azurerm.network/new-azurermvirtualnetworksubnetconfig). Create the virtual network *myVNet* using [New-AzureRmVirtualNetwork](/powershell/module/azurerm.network/new-azurermvirtualnetwork) with the subnet configurations. And finally, create the public IP address named *myAGPublicIPAddress* using [New-AzureRmPublicIpAddress](/powershell/module/azurerm.network/new-azurermpublicipaddress). These resources are used to provide network connectivity to the application gateway and its associated resources. |
| 43 | + |
| 44 | +```azurepowershell-interactive |
| 45 | +$backendSubnetConfig = New-AzureRmVirtualNetworkSubnetConfig ` |
| 46 | + -Name myBackendSubnet ` |
| 47 | + -AddressPrefix 10.0.1.0/24 |
| 48 | +
|
| 49 | +$agSubnetConfig = New-AzureRmVirtualNetworkSubnetConfig ` |
| 50 | + -Name myAGSubnet ` |
| 51 | + -AddressPrefix 10.0.2.0/24 |
| 52 | +
|
| 53 | +$vnet = New-AzureRmVirtualNetwork ` |
| 54 | + -ResourceGroupName myResourceGroupAG ` |
| 55 | + -Location eastus ` |
| 56 | + -Name myVNet ` |
| 57 | + -AddressPrefix 10.0.0.0/16 ` |
| 58 | + -Subnet $backendSubnetConfig, $agSubnetConfig |
| 59 | +
|
| 60 | +$pip = New-AzureRmPublicIpAddress ` |
| 61 | + -ResourceGroupName myResourceGroupAG ` |
| 62 | + -Location eastus ` |
| 63 | + -Name myAGPublicIPAddress ` |
| 64 | + -AllocationMethod Dynamic |
| 65 | +``` |
| 66 | + |
| 67 | +## Create an application gateway |
| 68 | + |
| 69 | +In this section you create resources that support the application gateway, and then finally create it. The resources that you create include: |
| 70 | + |
| 71 | +- *IP configurations and frontend port* - Associates the subnet that you previously created to the application gateway and assigns a port to use to access it. |
| 72 | +- *Default pool* - All application gateways must have at least one backend pool of servers. |
| 73 | +- *Default listener and rule* - The default listener listens for traffic on the port that was assigned and the default rule sends traffic to the default pool. |
| 74 | + |
| 75 | +### Create the IP configurations and frontend port |
| 76 | + |
| 77 | +Associate *myAGSubnet* that you previously created to the application gateway using [New-AzureRmApplicationGatewayIPConfiguration](/powershell/module/azurerm.network/new-azurermapplicationgatewayipconfiguration). Assign *myAGPublicIPAddress* to the application gateway using [New-AzureRmApplicationGatewayFrontendIPConfig](/powershell/module/azurerm.network/new-azurermapplicationgatewayfrontendipconfig). |
| 78 | + |
| 79 | +```azurepowershell-interactive |
| 80 | +$vnet = Get-AzureRmVirtualNetwork ` |
| 81 | + -ResourceGroupName myResourceGroupAG ` |
| 82 | + -Name myVNet |
| 83 | +
|
| 84 | +$subnet=$vnet.Subnets[0] |
| 85 | +
|
| 86 | +$gipconfig = New-AzureRmApplicationGatewayIPConfiguration ` |
| 87 | + -Name myAGIPConfig ` |
| 88 | + -Subnet $subnet |
| 89 | +
|
| 90 | +$fipconfig = New-AzureRmApplicationGatewayFrontendIPConfig ` |
| 91 | + -Name myAGFrontendIPConfig ` |
| 92 | + -PublicIPAddress $pip |
| 93 | +
|
| 94 | +$frontendport = New-AzureRmApplicationGatewayFrontendPort ` |
| 95 | + -Name myFrontendPort ` |
| 96 | + -Port 80 |
| 97 | +``` |
| 98 | + |
| 99 | +### Create the backend pool and settings |
| 100 | + |
| 101 | +Create the backend pool named *appGatewayBackendPool* for the application gateway using [New-AzureRmApplicationGatewayBackendAddressPool](/powershell/module/azurerm.network/new-azurermapplicationgatewaybackendaddresspool). Configure the settings for the backend address pools using [New-AzureRmApplicationGatewayBackendHttpSettings](/powershell/module/azurerm.network/new-azurermapplicationgatewaybackendhttpsettings). |
| 102 | + |
| 103 | +```azurepowershell-interactive |
| 104 | +$defaultPool = New-AzureRmApplicationGatewayBackendAddressPool ` |
| 105 | + -Name appGatewayBackendPool |
| 106 | +
|
| 107 | +$poolSettings = New-AzureRmApplicationGatewayBackendHttpSettings ` |
| 108 | + -Name myPoolSettings ` |
| 109 | + -Port 80 ` |
| 110 | + -Protocol Http ` |
| 111 | + -CookieBasedAffinity Enabled ` |
| 112 | + -RequestTimeout 120 |
| 113 | +``` |
| 114 | + |
| 115 | +### Create the default listener and rule |
| 116 | + |
| 117 | +A listener is required to enable the application gateway to route traffic appropriately to the backend pool. In this example, you create a basic listener that listens for traffic at the root URL. |
| 118 | + |
| 119 | +Create a listener named *mydefaultListener* using [New-AzureRmApplicationGatewayHttpListener](/powershell/module/azurerm.network/new-azurermapplicationgatewayhttplistener) with the frontend configuration and frontend port that you previously created. A rule is required for the listener to know which backend pool to use for incoming traffic. Create a basic rule named *rule1* using [New-AzureRmApplicationGatewayRequestRoutingRule](/powershell/module/azurerm.network/new-azurermapplicationgatewayrequestroutingrule). |
| 120 | + |
| 121 | +```azurepowershell-interactive |
| 122 | +$defaultlistener = New-AzureRmApplicationGatewayHttpListener ` |
| 123 | + -Name mydefaultListener ` |
| 124 | + -Protocol Http ` |
| 125 | + -FrontendIPConfiguration $fipconfig ` |
| 126 | + -FrontendPort $frontendport |
| 127 | +
|
| 128 | +$frontendRule = New-AzureRmApplicationGatewayRequestRoutingRule ` |
| 129 | + -Name rule1 ` |
| 130 | + -RuleType Basic ` |
| 131 | + -HttpListener $defaultlistener ` |
| 132 | + -BackendAddressPool $defaultPool ` |
| 133 | + -BackendHttpSettings $poolSettings |
| 134 | +``` |
| 135 | + |
| 136 | +### Create the application gateway |
| 137 | + |
| 138 | +Now that you created the necessary supporting resources, specify parameters for the application gateway using [New-AzureRmApplicationGatewaySku](/powershell/module/azurerm.network/new-azurermapplicationgatewaysku), and then create it using [New-AzureRmApplicationGateway](/powershell/module/azurerm.network/new-azurermapplicationgateway). |
| 139 | + |
| 140 | +```azurepowershell-interactive |
| 141 | +$sku = New-AzureRmApplicationGatewaySku ` |
| 142 | + -Name Standard_Medium ` |
| 143 | + -Tier Standard ` |
| 144 | + -Capacity 2 |
| 145 | +
|
| 146 | +$appgw = New-AzureRmApplicationGateway ` |
| 147 | + -Name myAppGateway ` |
| 148 | + -ResourceGroupName myResourceGroupAG ` |
| 149 | + -Location eastus ` |
| 150 | + -BackendAddressPools $defaultPool ` |
| 151 | + -BackendHttpSettingsCollection $poolSettings ` |
| 152 | + -FrontendIpConfigurations $fipconfig ` |
| 153 | + -GatewayIpConfigurations $gipconfig ` |
| 154 | + -FrontendPorts $frontendport ` |
| 155 | + -HttpListeners $defaultlistener ` |
| 156 | + -RequestRoutingRules $frontendRule ` |
| 157 | + -Sku $sku |
| 158 | +``` |
| 159 | + |
| 160 | +## Create a virtual machine scale set |
| 161 | + |
| 162 | +In this example, you create a virtual machine scale set to provide servers for the backend pool in the application gateway. You assign the scale set to the backend pool when you configure the IP settings. |
| 163 | + |
| 164 | +```azurepowershell-interactive |
| 165 | +$vnet = Get-AzureRmVirtualNetwork ` |
| 166 | + -ResourceGroupName myResourceGroupAG ` |
| 167 | + -Name myVNet |
| 168 | +
|
| 169 | +$appgw = Get-AzureRmApplicationGateway ` |
| 170 | + -ResourceGroupName myResourceGroupAG ` |
| 171 | + -Name myAppGateway |
| 172 | +
|
| 173 | +$backendPool = Get-AzureRmApplicationGatewayBackendAddressPool ` |
| 174 | + -Name appGatewayBackendPool ` |
| 175 | + -ApplicationGateway $appgw |
| 176 | +
|
| 177 | +$ipConfig = New-AzureRmVmssIpConfig ` |
| 178 | + -Name myVmssIPConfig ` |
| 179 | + -SubnetId $vnet.Subnets[1].Id ` |
| 180 | + -ApplicationGatewayBackendAddressPoolsId $backendPool.Id |
| 181 | +
|
| 182 | +$vmssConfig = New-AzureRmVmssConfig ` |
| 183 | + -Location eastus ` |
| 184 | + -SkuCapacity 2 ` |
| 185 | + -SkuName Standard_DS2 ` |
| 186 | + -UpgradePolicyMode Automatic |
| 187 | +
|
| 188 | +Set-AzureRmVmssStorageProfile $vmssConfig ` |
| 189 | + -ImageReferencePublisher MicrosoftWindowsServer ` |
| 190 | + -ImageReferenceOffer WindowsServer ` |
| 191 | + -ImageReferenceSku 2016-Datacenter ` |
| 192 | + -ImageReferenceVersion latest |
| 193 | +
|
| 194 | +Set-AzureRmVmssOsProfile $vmssConfig ` |
| 195 | + -AdminUsername azureuser ` |
| 196 | + -AdminPassword "Azure123456!" ` |
| 197 | + -ComputerNamePrefix myvmss |
| 198 | +
|
| 199 | +Add-AzureRmVmssNetworkInterfaceConfiguration ` |
| 200 | + -VirtualMachineScaleSet $vmssConfig ` |
| 201 | + -Name myVmssNetConfig ` |
| 202 | + -Primary $true ` |
| 203 | + -IPConfiguration $ipConfig |
| 204 | +
|
| 205 | +New-AzureRmVmss ` |
| 206 | + -ResourceGroupName myResourceGroupAG ` |
| 207 | + -Name myvmss ` |
| 208 | + -VirtualMachineScaleSet $vmssConfig |
| 209 | +``` |
| 210 | + |
| 211 | +### Install IIS |
| 212 | + |
| 213 | +```azurepowershell-interactive |
| 214 | +$publicSettings = @{ "fileUris" = (,"https://raw.githubusercontent.com/davidmu1/samplescripts/master/appgatewayurl.ps1"); |
| 215 | + "commandToExecute" = "powershell -ExecutionPolicy Unrestricted -File appgatewayurl.ps1" } |
| 216 | +
|
| 217 | +$vmss = Get-AzureRmVmss -ResourceGroupName myResourceGroupAG -VMScaleSetName myvmss |
| 218 | +
|
| 219 | +Add-AzureRmVmssExtension -VirtualMachineScaleSet $vmss ` |
| 220 | + -Name "customScript" ` |
| 221 | + -Publisher "Microsoft.Compute" ` |
| 222 | + -Type "CustomScriptExtension" ` |
| 223 | + -TypeHandlerVersion 1.8 ` |
| 224 | + -Setting $publicSettings |
| 225 | +
|
| 226 | +Update-AzureRmVmss ` |
| 227 | + -ResourceGroupName myResourceGroupAG ` |
| 228 | + -Name myvmss ` |
| 229 | + -VirtualMachineScaleSet $vmss |
| 230 | +``` |
| 231 | + |
| 232 | +## Test the application gateway |
| 233 | + |
| 234 | +Use [Get-AzureRmPublicIPAddress](/powershell/module/azurerm.network/get-azurermpublicipaddress) to get the public IP address of the application gateway. Copy the public IP address, and then paste it into the address bar of your browser. |
| 235 | + |
| 236 | +```azurepowershell-interactive |
| 237 | +Get-AzureRmPublicIPAddress -ResourceGroupName myResourceGroupAG -Name myAGPublicIPAddress |
| 238 | +``` |
| 239 | + |
| 240 | + |
| 241 | + |
| 242 | +## Clean up resources |
| 243 | + |
| 244 | +When no longer needed, remove the resource group, application gateway, and all related resources using [Remove-AzureRmResourceGroup](/powershell/module/azurerm.resources/remove-azurermresourcegroup). |
| 245 | + |
| 246 | +```azurepowershell-interactive |
| 247 | +Remove-AzureRmResourceGroup -Name myResourceGroupAG |
| 248 | +``` |
| 249 | + |
| 250 | +## Next steps |
| 251 | + |
| 252 | +In this tutorial, you learned how to: |
| 253 | + |
| 254 | +> [!div class="checklist"] |
| 255 | +> * Set up the network |
| 256 | +> * Create an application gateway |
| 257 | +> * Create a virtual machine scale set with the default backend pool |
| 258 | +
|
| 259 | +> [!div class="nextstepaction"] |
| 260 | +> [Restrict web traffic with a web application firewall](./tutorial-restrict-web-traffic-powershell.md) |
0 commit comments