How to reuse an existing virtual network

You can create a payment HSM on an existing virtual network by skipping the "Create a resource group" and "Create a virtual network" steps of Create a payment HSM with host and management port in same virtual network, and jumping directly to the creation of a subnet.

Create a subnet on an existing virtual network

Azure CLI

To create a subnet, you must know the name, resource group, and address space of the existing virtual network. To find them, use the Azure CLI az network vnet list command. The output is easier to read if you format it as a table using the -o flag:

az network vnet list -o table

The value returned in the "Prefixes" column, before the backslash, is the address space.

Now use the Azure CLI az network vnet subnet create command to create a new subnet with a delegation of "Microsoft.HardwareSecurityModules/dedicatedHSMs". The address prefixes must fall within the VNet's address space:

az network vnet subnet create -g "myResourceGroup" --vnet-name "myVNet" -n "myPHSMSubnet" --delegations "Microsoft.HardwareSecurityModules/dedicatedHSMs" --address-prefixes "10.0.0.0/24"

To verify that the VNet and subnet were created correctly, use the Azure CLI az network vnet subnet show command:

az network vnet subnet show -g "myResourceGroup" --vnet-name "myVNet" -n myPHSMSubnet

Make note of the subnet's ID, as it is needed for the next step. The ID of the subnet ends with the name of the subnet:

"id": "/subscriptions/<subscriptionID>/resourceGroups/myResourceGroup/providers/Microsoft.Network/virtualNetworks/myVNet/subnets/myPHSMSubnet",

Azure PowerShell

To create a subnet, you must know the name, resource group, and address space of the existing virtual network. To find them, use the Azure PowerShell Get-AzVirtualNetwork cmdlet.

Get-AzVirtualNetwork

Run Get-AzVirtualNetwork again, this time providing the names of the resource group and the virtual network, and save the output to the $vnet variable:

$vnet = Get-AzVirtualNetwork -Name "myVNet" -ResourceGroupName "myResourceGroup" 

Use the Azure PowerShell New-AzDelegation cmdlet to create a service delegation to be added to your new subnet, and save the output to the $myDelegation variable:

$myDelegation = New-AzDelegation -Name "myHSMDelegation" -ServiceName "Microsoft.HardwareSecurityModules/dedicatedHSMs"

Use the Azure PowerShell New-AzVirtualNetworkSubnetConfig cmdlet to create a virtual network subnet configuration, and save the output to the $myPHSMSubnet variable. The address prefixes must fall within the VNet's address space:

$myPHSMSubnetConfig = New-AzVirtualNetworkSubnetConfig -Name "myPHSMSubnet" -AddressPrefix "10.0.0.0/24" -Delegation $myDelegation

Note

The New-AzVirtualNetworkSubnetConfig cmdlet will generate a warning, which you can safely ignore.

Add the new subnet, along with the 'fastpathenabled="True"' tag, to the $vnet variable:

$vnet.Subnets.Add($myPHSMSubnetConfig)
$vnet.Tag = @{fastpathenabled="True"}                      

Lastly, update your virtual machine with the Azure PowerShell Set-AzVirtualNetwork cmdlet, passing to it the $vnet variable:

Set-AzVirtualNetwork -VirtualNetwork $vnet

To verify that the subnet was added correctly, use the Azure PowerShell Get-AzVirtualNetwork cmdlet:

Get-AzVirtualNetwork -Name "myVNet" -ResourceGroupName "myResourceGroup"

Make note of the subnet's ID, as it is needed for the next step. The ID of the subnet ends with the name of the subnet:

"Id": "/subscriptions/<subscriptionID>/resourceGroups/myResourceGroup/providers/Microsoft.Network/virtualNetworks/myVNet/subnets/myPHSMSubnet",

Create a payment HSM

Now that the subnet is added to your existing virtual network, you can create a payment HSM by following the steps in Create a payment HSM. You need the resource group; name and address space of the virtual network; and name, address space, and ID of the subnet.

Next steps

• Read an Overview of Payment HSM
• Find out how to get started with Azure Payment HSM
• See the Azure Payment HSM frequently asked questions