George Wallace's Blog

Introduction to Network Security Groups in Azure

GeorgeWallace — Fri, 08 Apr 2016 14:49:58 GMT

Recently submitting this as an article and wanted to share it on my blog in case it might help anyone. Back in November of 2014 Microsoft announced the availability of Network Security Groups. In my day job I still find many people not knowing about Network Security Groups or not using them. Prior to network security groups all Access Control Rules (ACLs) were defined on the virtual machine itself. Network Security Groups came in providing a way to segment within a Virtual Network and control traffic that comes in and out of Virtual Machines but also subnets. This is critical when talking about multi-tiered applications. You can see the general idea in Figure 1. In this example the end user has access through the internet to the DMZ Subnet. This subnet would contain your front end web applications that the end users connect to. Data into this subnet would be filtered within an NSG, most likely you would allow http, and https traffic into this subnet, but not allow other ports that would not be necessary. From there the systems in the DMZ subnet can talk to the application subnet systems, these are your application servers that host your business processes and logic and the applications that talk directly to the database. Finally, the systems in the Application Subnet can talk to the systems in the data subnet, this would be port 1433 for example to talk to a SQL backend. In this diagram we show that there is blocked traffic between the DMZ subnet and the data subnet, this keeps the different components of the application separated. This also ensures that end users can not directly talk to the systems in the data subnet. Figure 1 NSG Example The rules defined on an NSG are comprised of multiple components: Source IP – This is a single IP or a range subnet of IPs in CIDR notation that the traffic will be allowed or denied from. Source Port – A single port or multiple ports from the source that will be allowed or denied Destination IP - This is a single IP or a range subnet of IPs in CIDR notation that the traffic will be allowed or denied to. Destination Port – A single port or multiple ports to the destination that will be allowed or denied Protocol – The protocol to be allowed or denied (i.e TCP or UDP) Priority – This is the order in which the rule will be applied, similar to Group Policy Objects if you are familiar with those. These components along with traffic direction and access will be defined on all of the rules configured within a Network Security Group. One thing to note with NSG’s is that are tied to a region so if you have resources in multiple regions you must create multiple NSGs. Ok so now that you know a little bit about Network Security Groups, let’s create one! First thing we must do is make sure we have the latest Azure PowerShell cmdlets which can be downloaded from here. https://azure.microsoft.com/en-us/downloads/. At the time of writing this article the version should be 1.0.4. Another item to keep in mind while following these instructions is I have opted to leverage Azure Resource Manager or ARM to deploy my resources, this is the new format that will be used and is taking the place of the older Service Management cmdlets. These cmdlets are denoted with “RM” in the cmdlet. (i.e Add-AzureRMAccount) Once the module has been downloaded it is time to start making some magic. Run the following PowerShell commands in a script or PowerShell ISE. You will replace the Subscription name with your own subscription name. This PowerShell code will launch a login screen and allow you to login. One thing to keep in mind this is specific for Public Azure, if you are using Azure for Government you will have to add the Environment yourself (not covered in this article). # Imports Azure Module Import-Module Azure -Force # Gets the environment for Public Azure $env = Get-AzureRMEnvironment -Name AzureCloud # Prompts for credentials based on that environment Add-AzureRMAccount -Environment $env # Selects the subscription to use. Select-AzureRMSubscription -SubscriptionName "" Now that you are in PowerShell and logged into your subscription we can continue, first thing we should do is create a Resource Group. Give the resource group a name and choose a location, this location as mentioned prior is important as the NSG we create will need to live in the same region. # Creates a Resource Group to put our NSG in. New-AzureRmResourceGroup -Name "ExampleVNETRG" -Location "East US" Now we will create the Virtual Network, to keep your Azure environment clean we will create a new Virtual Network in our new resource group so it can be easily removed once you are done. Define your subnets, in this case my Virtual Network only has two subnets. The second command this piece of code does it create the virtual network with the subnets defined in the Subnet configs. # Creates config for sample Subnet $subnet1 = New-AzureRmVirtualNetworkSubnetConfig -Name "Subnet1" ` -AddressPrefix "192.168.1.0/25" ` $subnet2 = New-AzureRmVirtualNetworkSubnetConfig -Name "Subnet2" ` -AddressPrefix "192.168.1.128/25" ` # Creates Virtual Network in Resource Group with subnet defined prior New-AzureRmVirtualNetwork -Name ExampleVnet ` -ResourceGroupName ExampleVNETRG ` -Location "East US" ` -AddressPrefix "192.168.1.0/24" ` -Subnet $subnet1,$subnet2 Now we have our Virtual Network defined with two different subnets we can start to work on our Network Security Group rules. We will create 2 rules one for http traffic and one for https traffic, rules work for individual ports or port ranges, hence the reason for the two rules. #First rule for http traffic $httprule = New-AzureRmNetworkSecurityRuleConfig ` -Name "FrontEnd_HTTP" ` -Description "HTTP Exception for Web frontends" ` -Protocol Tcp ` -SourcePortRange "80" ` -DestinationPortRange "80" ` -SourceAddressPrefix "*" ` -DestinationAddressPrefix "192.168.1.0/25" ` -Access Allow ` -Direction Inbound ` -Priority 200 # Second rule for https traffic $httpsrule = New-AzureRmNetworkSecurityRuleConfig ` -Name "FrontEnd_HTTPS" ` -Description "HTTPS Exception for Web frontends" ` -Protocol Tcp ` -SourcePortRange "443" ` -DestinationPortRange "443" ` -SourceAddressPrefix "*" ` -DestinationAddressPrefix "192.168.1.0/25" ` -Access Allow ` -Direction Inbound ` -Priority 201 Now that we have the configs created for the 2 rules we can create the NSG with the two security rules defined prior with the code below. # Creates a NSG based on the rules defined prior $nsg = New-AzureRmNetworkSecurityGroup -ResourceGroupName ExampleVNETRG -Location "East US" -Name "NSG-Example" ` -SecurityRules $httprule,$httpsrule Creating the NSG is just one step we also have to apply the NSG to a subnet. The below code grabs the Virtual Network we created earlier and applies the NSG to the Virtual network, specifically Subnet1. # Gets the Virtual network and applies the rules to the subnet created earlier. $vnet = Get-AzureRmVirtualNetwork -ResourceGroupName ExampleVNETRG -Name ExampleVnet Set-AzureRmVirtualNetworkSubnetConfig -VirtualNetwork $vnet -Name "Subnet1" ` -AddressPrefix 192.168.1.0/24 -NetworkSecurityGroup $nsg The changes to the virtual network we created in the previous step just made the changes offline, we not have to update the virtual network with the following command # Updates the Virtual Network in Azure Set-AzureRmVirtualNetwork -VirtualNetwork $vnet And that’s it, now any virtual machine that you put in Subnet1 will get the rules we defined above, you could add more rules and apply them later. Keep in mind if you define endpoints on your virtual machine NSG rules will override them, so for instance if you open up port 80 on an endpoint in a virtual machine, and have an NSG applied to the VM or the Subnet the VM is in and there is no allow rule for 80 traffic will not make it to the virtual machine. Now that we have created the resources, let’s take a quick look at our Resource Group in the new Azure Portal. Here you can see the Resource Group with the NSG. And next if we look into our NSG and look at the inbound rules and can see the rules we created. Once you are done you can easily remove everything we created by running the following command. This is one of the best parts of deploying resources with Resource Manager, is the ease of removing and adding resources. Remove-AzureRmResourceGroup -Name ExampleVNETRG -Force

Deploying a Website with Content through Visual Studio with Resource Groups

GeorgeWallace — Sun, 10 May 2015 14:05:08 GMT

UPDATED: This post has been updated to reflect the recent changes.

If you are like me you were glued to the computer watching all of the Build and Ignite sessions, what an exciting couple weeks. One of the great things that came out was the Azure SDK 2.6 for .NET. With this we got..

Azure Resource Manager Tools
Diagnostics improvements for Cloud Services
Azure App Service Tools
HDInsight tools

I am going to focus on Resource Manager Tools. If you have not played with Azure Resource Manager (ARM) you are missing out, it has some great features over the existing Service Management tools. One of these is being able to deploy resource groups, now you may be saying well Resource Groups have been around for a while. While that is the case there is a lot of great new things that were announced. The new v2 versions of VMs, Storage Accounts, Network adapters.. these are all amazing things.

In this blog though I am going to take you through deploying a full functional website leveraging Resource Groups, Visual Studio and WebDeploy.

Before starting visit the download site https://azure.microsoft.com/en-us/downloads/ to download the SDK for your version of Visual Studio.

Create your web content

For the sake of the blog I will step you through creating example content for your site, for this you will need to launch Visual Studio, Create a new ASP.NET Web Application.

For this example lets choose Web API which should be the default and click OK. While you may be tempted to click Host in the cloud, leave that unchecked for now. Visual Studio does a great job of deploying websites to Azure and adding Application Insights, but we are going to do it differently.

Now lets right click the Project name and click Publish, for the publish target click Custom and give it a name and click Ok

For the Publish method we are going to choose a Web Deploy Package, this way we can save the package offline on our system and use that to deploy out our site, choose a Package location and give your site a name, finally click Publish. Now note where you saved that package as we are going to use it a little later.

Create your Resource Group Project

Keeping that existing solution opened we created, create a new Project in the solution by Right Clicking the solution, choose Add then New Project…

Choos Visual C#, Cloud and Azure Resource Group, give your project a name and click OK this will create another project in our solution specifically for our Resource Group.

Now there is already a template for Web App here, but I am going to take you through creating this from a blank template so you get a better understanding of the capabilities. Find Blank Template and click OK.

Expand out the Templates folder and double click DeploymentTemplate.json, and a basically empty json document will open, here it has the major components to a Resource Group Template

Parameters – These will be used to pass data into your Resource Group Template Deployment
Variables – These help will defining variables that can be used to define values you may reuse
Resources – These are the resources that you will be adding to the resource group (NICS, VMs, Websites, etc)
Output – This is for defining any output that you may have.

All of these items are shown as well in the left panel in the JSON Outline window. These will be our graphical representation of our JSON file. Go ahead and click the cube with the plus sign to add a Resource. For the Website we are going to create we need 4 different items.

App Service Plan
Application Insights for Web Apps
Web App
Web Deploy for Web Apps

First Choose the App Service Plan (Server Farm) give it a name and click Add

You will see in the outline by adding that Resource we now have 1 Resource and 4 Parameters.. These parameters come with the App Service Plan Template

If you click on any of the Parameters it will focus the DeploymentTemplate.json file to the item you clicked. As you notice those parameters have their definitions, all are string values, but the SerferFarmSKU and ServerFarmWorkerSize have defined values they can be. This is useful to force people when reusing your template to make sure they put in correct values. For instance the SKU relates to the type of website, in Azure we have Free Shared, Basic and Standard.

There is nothing left to do now for the App Service Plan so lets move on to the Web App. Click the Cube with a plus in the JSON Outline window and choose a Web App this time, give it a name, now you will notice since your file already has a Service Plan it will be automatically selected. This is great as it will build out your dependencies for you in the JSON Template file. Once you are done go ahead and click Add

So now if we wanted to deploy it now we could and have a basic website. But remember we created that Web Deploy Package earlier. Lets get that Web Deploy Package as well. Click the cube with the plus sign and choose Web Deploy for Web Apps. Give it a name and just as before the dependencies, in this case a Web App was already selected. Now just click Add

By now if you look in the JSON Outline we have some more items for the Web App and the Web Deploy for Web Apps. Take note that the Web Deploy for Web Apps is nested under the WebApp, it is a child in the hierarchy.

Now we need to get that Web Deploy Package we created earlier where it needs to be. First we need to quickly Build what we have so far. On the Menu click Built and then Build Solution.

Once the build is done we will right click the Project and choose Open Folder in File Explorer, when the folder opens navigate to bin\Debug\Artifacts\

Navigate to where you saved your Web Deploy Package and paste it in this folder. This file needs to be in the folder as when you deploy the deployment script will look in this folder for any artifacts and can deploy them to a storage account to be referenced later by the script later.

Now we will go ahead and add Application Insights to the Web App, again click the cube with the plus signs, this time choose Application Insights for Web Apps. Give it a Name and as noted before since we only have one App Service Plan and one Web App they are already preselected. Then click Add to add it to our resource group

For the sake of this blog post we wont modify the JSON but as you can see it added a few predefined settings for AppInsights, CPU, Queues, Server Errors, etc to be monitored.

Now we are just about ready to deploy. In the Solution Explorer, right click your project, choose deploy and New Deployment…

When the window pops up if not already signed in click the Sign In button

Once you are signed in, choose your subscription, you could add this to an existing Resource Group but we will add it to a new one for the sake of the blog post. Pull down the drop down on Resource Group and choose

Give the Resource Group a name and choose a location, we will use this location later as well.

Choose a Storage account for your Artifacts, in this case our Web Deploy package, this can not be created on the fly it must be an existing one in your subscription. When you are ready click Deploy.

When you click deploy you will get an Edit Parameters window. In here we need to fill in the parameters. These could be updated in your azuredeploy.parameters.json file, but since we just have a few options we will fill it out by hand. As you can see the SKU and Worker Size we saw earlier are drop down boxes, that is because we allowed it to have a few different values. Since we put our Web Deploy package in the main folder, put in your Project name, this folder will be created by default, if you were to make a sub folder you could enter it as \. Fill out the fields and click Save

When you are done you will see output similar to below.

20:39:02 - Build started.
20:39:02 – Project "MyAwesomeWebsiteResourceGroup.deployproj" (StageArtifacts target(s)):
20:39:02 - Project "MyAwesomeWebsiteResourceGroup.deployproj" (ContentFilesProjectOutputGroup target(s)):
20:39:02 - Done building project "MyAwesomeWebsiteResourceGroup.deployproj".
20:39:02 - Done building project "MyAwesomeWebsiteResourceGroup.deployproj".
20:39:02 - Build succeeded.
20:39:02 - The following parameter values will be used for this deployment:
20:39:02 -     MyAwesomeWebsiteServerFarmName: MyAwesomeWebsite
20:39:02 -     MyAwesomeWebsiteServerFarmSKU: Free
20:39:02 -     MyAwesomeWebsiteServerFarmWorkerSize: 0
20:39:02 -     _artifactsLocation:
20:39:02 -     _artifactsLocationSasToken:
20:39:02 -     MyAwesomeWebsiteWebDeployPackageFolder: MyAwesomeWebsiteResourceGroup
20:39:02 -     MyAwesomeWebsiteWebDeployPackageFileName: MyAwesomeWebSite.zip
20:39:02 - Launching deployment PowerShell script with the following command:
20:39:02 - 'c:\users\username\documents\visual studio 2015\projects\myawesomewebsiteresourcegroup\myawesomewebsiteresourcegroup\Scripts\Deploy-AzureResourceGroup.ps1' -StorageAccountName 'azril302gvbf' -ResourceGroupName 'azril302nbv' -ResourceGroupLocation 'eastus' -TemplateFile 'c:\users\username\documents\visual studio 2015\projects\myawesomewebsiteresourcegroup\myawesomewebsiteresourcegroup\templates\azuredeploy.json' -TemplateParametersFile 'c:\users\username\documents\visual studio 2015\projects\myawesomewebsiteresourcegroup\myawesomewebsiteresourcegroup\templates\azuredeploy.parameters.json' -ArtifactStagingDirectory '..\bin\Debug\staging' -UploadArtifacts -StorageAccountResourceGroupName 'azril302nbv'
20:39:09 -
20:39:09 -
20:39:09 - Environment           : AzureCloud
20:39:09 - Account               : username@live.com
20:39:09 - TenantId              : xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
20:39:09 - SubscriptionId        : xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
20:39:09 - CurrentStorageAccount :
20:39:09 -
20:39:54 -
20:39:54 - Transfer summary:
20:39:54 - -----------------
20:39:54 - Total files transferred: 10
20:39:54 - Transfer successfully:   10
20:39:54 - Transfer failed:         0
20:39:54 - Elapsed time:            00.00:00:41
20:39:54 - https://azril302gvbf.blob.core.windows.net/azril302nbv-stageartifacts
20:39:55 - [VERBOSE] 8:39:55 PM - Created resource group 'azril302nbv' in location 'eastus'
20:39:56 -
20:39:56 - ResourceGroupName : azril302nbv
20:39:56 - Location          : eastus
20:39:56 - Resources         : {bob0, bob2, CPUHigh MyAwesomeWebsite, CPUHigh
20:39:56 -                     qq2w43141245125...}
20:39:56 - ResourcesTable    :
20:39:56 -                     Name                                           Type
20:39:56 -                                                  Location
20:39:56 -                     =============================================
20:39:56 -                     ======================================= ==============
20:39:56 -                     bob0
20:39:56 -                     Microsoft.Compute/virtualMachines        eastus
20:39:56 -                     bob2
20:39:56 -                     Microsoft.Compute/virtualMachines        eastus
20:39:56 -                     CPUHigh MyAwesomeWebsite
20:39:56 -                     Microsoft.Insights/alertrules            eastus
20:39:56 -                     CPUHigh qq2w43141245125
20:39:56 -                     microsoft.insights/alertrules            eastus
20:39:56 -                     ForbiddenRequests georgenugettestdave
20:39:56 -                     microsoft.insights/alertrules            eastus
20:39:56 -                     ForbiddenRequests MyAwesomeWebSiteAppInsights
20:39:56 -                     Microsoft.Insights/alertrules            eastus
20:39:56 -                     LongHttpQueue MyAwesomeWebsite
20:39:56 -                     Microsoft.Insights/alertrules            eastus
20:39:56 -                     LongHttpQueue qq2w43141245125
20:39:56 -                     microsoft.insights/alertrules            eastus
20:39:56 -                     ServerErrors georgenugettestdave
20:39:56 -                     microsoft.insights/alertrules            eastus
20:39:56 -                     ServerErrors MyAwesomeWebSiteAppInsights
20:39:56 -                     Microsoft.Insights/alertrules            eastus
20:39:56 -                     MyAwesomeWebsite-azril302nbv
20:39:56 -                     Microsoft.Insights/autoscalesettings     eastus
20:39:56 -                     qq2w43141245125-azril302nbv
20:39:56 -                     microsoft.insights/autoscalesettings     eastus
20:39:56 -                     georgenugettestdave
20:39:56 -                     microsoft.insights/components            centralus
20:39:56 -                     MyAwesomeWebSiteAppInsights
20:39:56 -                     Microsoft.Insights/components            centralus
20:39:56 -                     nic0
20:39:56 -                     Microsoft.Network/networkInterfaces      eastus
20:39:56 -                     nic2
20:39:56 -                     Microsoft.Network/networkInterfaces      eastus
20:39:56 -                     asdasd
20:39:56 -                     Microsoft.Network/networkSecurityGroups northcentralus
20:39:56 -                     publicIP0
20:39:56 -                     Microsoft.Network/publicIPAddresses      eastus
20:39:56 -                     publicIP2
20:39:56 -                     Microsoft.Network/publicIPAddresses      eastus
20:39:56 -                     1qa2sanetwork
20:39:56 -                     Microsoft.Network/virtualNetworks        eastus
20:39:56 -                     azril302gvbf
20:39:56 -                     Microsoft.Storage/storageAccounts        eastus
20:39:56 -                     MyAwesomeWebsite
20:39:56 -                     Microsoft.Web/serverFarms                eastus
20:39:56 -                     qq2w43141245125
20:39:56 -                     Microsoft.Web/serverFarms                eastus
20:39:56 -                     georgenugettestdave
20:39:56 -                     Microsoft.Web/sites                      eastus
20:39:56 -                     MyAwesomeWebsitepjeak2lppue2k
20:39:56 -                     Microsoft.Web/sites                      eastus
20:39:56 -
20:39:56 - ProvisioningState : Succeeded
20:39:56 - Tags              : {}
20:39:56 - TagsTable         :
20:39:56 - ResourceId        : /subscriptions/590d019c-bc64-4ce4-a118-002c35d4086b/resourc
20:39:56 -                     eGroups/azril302nbv
20:39:56 -
20:40:01 - [VERBOSE] 8:40:01 PM - Create template deployment 'azuredeploy-0323-0239'.
20:40:04 - [VERBOSE] 8:40:04 PM - Resource Microsoft.Web/serverfarms 'MyAwesomeWebsite' provisioning status is succeeded
20:40:09 - [VERBOSE] 8:40:09 PM - Resource Microsoft.Insights/alertrules 'CPUHigh MyAwesomeWebsite' provisioning status is succeeded
20:40:09 - [VERBOSE] 8:40:09 PM - Resource Microsoft.Insights/alertrules 'LongHttpQueue MyAwesomeWebsite' provisioning status is succeeded
20:40:09 - [VERBOSE] 8:40:09 PM - Resource Microsoft.Insights/autoscalesettings 'MyAwesomeWebsite-azril302nbv' provisioning status is succeeded
20:40:55 - [VERBOSE] 8:40:55 PM - Resource Microsoft.Web/sites 'MyAwesomeWebsitepjeak2lppue2k' provisioning status is succeeded
20:41:02 - [VERBOSE] 8:41:02 PM - Resource Microsoft.Insights/alertrules 'ForbiddenRequests MyAwesomeWebSiteAppInsights' provisioning status is succeeded
20:41:05 - [VERBOSE] 8:41:05 PM - Resource Microsoft.Insights/alertrules 'ServerErrors MyAwesomeWebSiteAppInsights' provisioning status is succeeded
20:41:05 - [VERBOSE] 8:41:05 PM - Resource Microsoft.Web/sites/extensions 'MyAwesomeWebsitepjeak2lppue2k/MSDeploy' provisioning status is running
20:41:05 - [VERBOSE] 8:41:05 PM - Resource Microsoft.Insights/components 'MyAwesomeWebSiteAppInsights' provisioning status is succeeded
20:41:11 - [VERBOSE] 8:41:11 PM - Resource Microsoft.Web/sites/extensions 'MyAwesomeWebsitepjeak2lppue2k/MSDeploy' provisioning status is succeeded
20:41:15 -
20:41:15 - DeploymentName     : azuredeploy-0323-0239
20:41:15 - CorrelationId      : 9bd2d07e-56b5-4c67-8d05-6849a35f366e
20:41:15 - ResourceGroupName : azril302nbv
20:41:15 - ProvisioningState : Succeeded
20:41:15 - Timestamp          : 3/23/2016 2:41:10 AM
20:41:15 - Mode               : Incremental
20:41:15 - TemplateLink       :
20:41:15 - TemplateLinkString :
20:41:15 - Parameters         : {[myAwesomeWebsiteServerFarmName, Microsoft.Azure.Commands
20:41:15 -                      .Resources.Models.DeploymentVariable],
20:41:15 -                      [myAwesomeWebsiteServerFarmSKU, Microsoft.Azure.Commands.R
20:41:15 -                      esources.Models.DeploymentVariable],
20:41:15 -                      [myAwesomeWebsiteServerFarmWorkerSize, Microsoft.Azure.Com
20:41:15 -                      mands.Resources.Models.DeploymentVariable],
20:41:15 -                      [_artifactsLocation, Microsoft.Azure.Commands.Resources.Mo
20:41:15 -                      dels.DeploymentVariable]...}
20:41:15 - ParametersString   :
20:41:15 -                      Name             Type                       Value
20:41:15 -                      =============== ========================= ==========
20:41:15 -                      myAwesomeWebsiteServerFarmName String
20:41:15 -                       MyAwesomeWebsite
20:41:15 -                      myAwesomeWebsiteServerFarmSKU String
20:41:15 -                      Free
20:41:15 -                      myAwesomeWebsiteServerFarmWorkerSize String
20:41:15 -                             0
20:41:15 -                      _artifactsLocation String                     https://azr
20:41:15 -                      il302gvbf.blob.core.windows.net/azril302nbv-stageartifacts
20:41:15 -                      _artifactsLocationSasToken SecureString
20:41:15 -
20:41:15 -                      myAwesomeWebsiteWebDeployPackageFolder String
20:41:15 -                               MyAwesomeWebsiteResourceGroup
20:41:15 -                      myAwesomeWebsiteWebDeployPackageFileName String
20:41:15 -                                 MyAwesomeWebSite.zip
20:41:15 -
20:41:15 - Outputs            : {}
20:41:15 - OutputsString      :
20:41:15 -
20:41:16 -
20:41:16 -
20:41:16 -
20:41:16 - Successfully deployed template 'c:\users\username\documents\visual studio 2015\projects\myawesomewebsiteresourcegroup\myawesomewebsiteresourcegroup\templates\azuredeploy.json' to resource group 'azril302nbv'.

When it is done give it a few minutes for the web deploy to finish and then navigate to your website… you will see the .net example we deployed is now there.

MyAwesomeWebsiteResourceGroup.zip

Service Manager Launch Pad – Efficiency Management Pack for Service Desks

GeorgeWallace — Mon, 05 Jan 2015 15:16:09 GMT

Many Service Manager Customers experience challenges when Customers call their Service Desks, they are not sure whether the Customer needs a Service Request or Incident to be created. The scenario from a Service Desk representative perspective is that you first click on Create Incident, then you capture the Caller’s information and enter information in the Title and description, and at this point you realize that they want a new Service and you should have created a Service Request. You would have to cancel the Incident and create a Service Request, thus resulting in time lost and asking the Customer the same information over again. The current functionality in Service Manager does not enable an efficient or quick way to change an Incident into a Service Request without a duplicate record.

This scenario happens all the time and I created the Launch Pad Management Pack Bundle that allows you to collect some critical data, title, description, user, prior to opening an incident or service request. This timesaving Management Pack is a great “FREE” add in for Helpdesks and Support staff as this is usually the case when handling inbound calls from Customers (do they have an Incident – something that is broken, or are they asking for more IT – a Service Request)

The Launch Pad application adds a task called “Open Launch Pad” for Service Requests and Incidents. The Launch Pad interface enables you to pick a user, enter in the title and the description and as you gather this necessary information you can use the radio button to either create an Incident or a Service Request. This solution allows you to choose pre-defined templates and then create the incident or service request record. When you hit submit it will launch the incident or service request in a new window.

This solution is free and it currently supports templates only and not Request Offerings for Service Requests. The solution has also been localized to Italian, Dutch, Turkish, Spanish, Portuguese, German, Hungarian, Chinese (Simplified and Traditional), Danish and French.

I would like to thank my colleagues below for providing the localization of this management pack bundle.

Thierry Thomas
Viktor Benkovics
Milton Nucci
Markus Klein
Bahadir Onalan
Sander Brokke
Donato Pasqualicchio
Jonathan Liu
Thomas Ellermann

And a huge thanks to Kathleen Wilson for helping orchestrate much of this.

The Management Pack Bundle can be found at the TechNet Gallery https://gallery.technet.microsoft.com/LaunchPad-for-System-1877fe27

Service Request Reports for System Center Service Manager 2012

GeorgeWallace — Tue, 18 Nov 2014 11:40:24 GMT

So where are the Service Request reports???? If you use Service Manager for Service Requests, you are scratching your head why you can’t see any reports for Service Requests in the Console. I am a huge fan of leveraging BI and the Service Manager Cubes for my reporting but many people still want out of the box reports, in the console for Service Requests. Leveraging SSRS reporting, I built common requested reports from my Customers and leveraged the Incident reports to do it.

I ported over the Incident Reports to the Service Request reports and loaded it up into a Management Pack bundle so you can import them into your environment and get some Service Request Reports showing up quickly. These will make sure that you close the gap for console reports for Service Requests and give you a little more time to develop deeper OLAP cube reports for Service Requests.

There are 3 reports

List of Service Requests – Lists all the Service Requests for the Report Criteria

Service Request Details – Details on a Specific Service Request

Service Request KPI Trend – Provides trending data to backlogged Service Requests

These 3 reports, match up to 3 of the 5 Incident reports that currently exist. There was no reason to port over the Analyst Report as Service Requests are meant to have activities and they close out the Service Request once complete, therefore the Activity Management reports that are OOB can provide the Analyst tracking. The Incident Resolution Report was not ported over as well for the same reason, but if you need it, this is an easy fix and leave a comment below and I will add it in a future release.

The Management Pack is completely localized so would be easy to implement other languages, if you feel like you can assist in translating the info to another language and want to help out with a language pack please reach out to me as well.

List of Service Requests Report

Service Request Details

Service Request KPI

The reports can be found on the TechNet gallery at https://gallery.technet.microsoft.com/System-Center-Service-8aa67c49

Using SelectSingleNode in PowerShell with XML Namespace (Azure VNetConfig)

GeorgeWallace — Thu, 13 Nov 2014 08:17:45 GMT

So, been doing a lot of work in Azure lately and having to solve problems I have not had to deal with before. As you know the Network Configuration for Azure if not done through the portal is done through an XML file. Below is an example of an XML file exported from Azure with the command get-azurevnetconfig –ExportToFile c:\test\network.xml



  
    
    
      
        
          192.168.1.0/24
        
        
          
            192.168.1.0/24

So let’s say you want to update the AddressPrefix for the Virtual Network Site test. So you load the xml file into a variable. [xml] $azurenetconfig = get-content -path "$PWD\network.xml"

With PowerShell and XML you should be able to run the following command and get data back. But you get no data back… why is that?

$network.SelectSingleNode("//VirtualNetworkSite[@name='test']")

By reading MSDN https://msdn.microsoft.com/en-us/library/h0hw012b(v=vs.110).aspx you can see that when dealing with XML that has a namespace you must specify the namespace.

So for this command to work we must define the namespace, that is done in the commands below.

$ns = New-Object System.Xml.XmlNamespaceManager($network.NameTable)
$ns.AddNamespace("ns", $network.DocumentElement.NamespaceURI)

Now we need to run the same SelectSingleNode method but with the namespace defined.

$network.SelectSingleNode("//ns:VirtualNetworkSite[@name='test']", $ns)

Now you can see we actually get data back. Hope this helps someone that might be struggling with this or leveraging any XML with a namespace

Shutting down a Azure VM with Azure Automation

GeorgeWallace — Wed, 05 Nov 2014 12:32:37 GMT

Recently I was asked how to shut down an Azure VM with Azure Automation, it can be a slightly daunting task, due to the fact that you have to use credentials whether or not its a certificate or PSCredentials.. So figured I would write up a post to show how to do this with PSCredentials.

Creating the account

In order to use PSCredentials instead of a certificate, we need an account to use. Lets start by creating an account.

Log into the Azure Management Portal and click on Settings.

Take note of the Directory listed for your subscription, this is important because you could have multiple Azure Active Directories configured.

Next click on Active Directory on the side bar.

Click the Arrow next to the Name of the Azure Active Directory you saw in the Settings tab earlier.

Click on Users and then click Add User at the bottom of the page.

Follow the wizard by choosing “New user in your organization” as a type of user, give the user a username, click the right arrow

Now define the profile components for the account, fill out the appropriate information (First Name, Last Name, Display Name) for the Role choose User

Finally on the last page click Create

On the next page you will be presented with a temporary password for the user. At this point go to https://azure.microsoft.com and log into the Management Portal with the user created, you will be prompted to change the password.

Next go back to the Azure Management Portal with your administrator credentials and click Settings –> Administrators and click Add

Type in the email address of the account you created, choose the subscription they should be part of and click the Check box. The Automation Account needs administrator rights to run.

Configuring Automation

Now we are ready to configure the automation, it is assumed that you have already created an Azure Automation account for the following steps. Click the Automation tab on the left of the Management Portal and click the arrow next to your Automation Account

Click Assets and click Add Setting at the bottom

For the Setting choose Add Credential

For the Credential Type choose Windows PowerShell Credential and give the credential a name, click the right arrow.

Now put in the username and password for the account we created earlier, and click the Checkbox

Now from the bottom left corner of the screen click the Plus sign , choose Automation, Runbook, and Quick Create. Give the runbook a good name and description and click Create

Next click the Arrow next to the newly created runbook to go to the runbook details.

Click Author and now we are ready to create the runbook.

Paste the following code into the designer, where the Name for Get-AutomationPSCredential is the Name of your credentials you created earlier. You can always click (Insert, Setting) at the bottom of the window and choose Get Windows PowerShell Credential and is will show you all the credentials you have. This will also paste in the command to get the credentials.

workflow shutdown-vm
{
    $Cred = Get-AutomationPSCredential -Name 'Azure Auto'
    Add-AzureAccount -Credential $Cred
    
InlineScript 
    {

    Select-AzureSubscription -SubscriptionName "Visual Studio Ultimate with MSDN"
           
    $VMS = Get-AzureVM 

    foreach($VM in $VMS)
        {    
        $VMName = $VM.Name 
        Stop-AzureVM -ServiceName $VM.ServiceName -Name $VM.Name -Force
        Write-Output "Shutting down VM :  $VMName "
        }
    }
}

Now it is time to test, if you have VMs just click the Test button

Finally once you test, you should get output similar to below.

Hope this helps someone out there.

New-AzureStorageAccount : Specified argument was out of the range of valid values. Parameter name: parameters.Name

GeorgeWallace — Tue, 04 Nov 2014 09:08:57 GMT

Recently I have been working on automating deploying an IaaS infrastructure on Azure.. Part of this required me creating my storage accounts. The automation would allow users to add or remove storage accounts in a list and create them all in one bunch. I am doing this through a XAML form. What I found is people would enter in capitol letters. If you are not familiar with creating storage accounts, when you create them in the portal you can only specify lowercase letters and numbers, this is the same with the New-AzureStorageAccount cmdlet.

To get around this, in your script you can use Regex Replace and .ToLower to convert the value to lowercase and numbers and letters only. Where below $sa is an object that I store my values like StorageAccountName, Label, Description and AffinityGroup.

$StorageAccountName = [Regex]::Replace($sa.Name.ToLower(), '[^(a-z0-9)]', '')

Creating a Database Programmatically with SMO and XML

GeorgeWallace — Thu, 23 Oct 2014 10:39:00 GMT

I was working on a project with some colleagues about patching systems via Orchestrator. This brought up the topic of managing state, and to do this one of the best ways is by leveraging a database to record state. Ultimately we needed to create this database in each new environment and I decided to script it, I wanted it to be extensible no matter what I needed to do. To do this I ended up leveraging an XML file to provide me the information I need and leveraging SQL SMO to do the hard work. I figured I would share it with the world in case it can assist someone else. Special thanks goes to Mitch Klann for assistance with the script.

In my next post I will show how you can also use an xml file to populate the database with values while using SMO.

The XML File

The XML file contains all the elements you need to script a database. Below is the XML file. Within the Database element there is a section to define the SQLInstance, in this case I am just using a default instance, if you are using an named instance it should be in server\instance format. The next Name tag is the Name of the database to create. After that you have the Tables element and within it each table. Each Table has a Name and then respective columns within it. The column elements have their name, which would be the column name, an Identity Element, which would be used if you want that column to be an identity (By default it will set the Seed to 1 and increment to 1 but you could customize if you want. Next is the DataType, this is the type of data that will be in there, you can put whatever datatypes that SQL Supports in there. Next is Nullable, this allows you to determine whether the column can be empty or not when entering a record. And lastly is the PK tag, this is a Boolean that allows you to set a column to the Primary Key.




db01
ExamplePOC

ServerTBL

ServerID
True
Int
False
True


ServerFQDN
False
NVarChar(100)
False
False





ExtraTBL

ExtraID
True
Int
False
True


ExtraName
False
NVarChar(500)
False
False


ServerID
False
Int
False
False

Next we have the PowerShell script that creates the Database. Since the script uses SMO it must be ran from a server that has SMO Installed (SQL Servers have this by default). If you want it to run remotely the easiest way would be to use a PSSession and pass the XML data into your session.

$xml = [xml] ( get-content C:\scripts\DBCreate.xml)
cls
#Load SQL SMO Assembly
[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.SqlServer.SMO')  | out-null

 #define preliminary variables
$sql = $xml.DBCreate.Database.SQLInstance
$dbfound = $false
$ns = 'Microsoft.SqlServer.Management.Smo'
$s = new-object ("$ns.Server") $sql
$DBName = $xml.DBCreate.Database.Name
$dbs = $s.Databases | where {-not $_.IsSystemObject}

#loop through current databases and look to see if DBCreatePOC DB already exists
foreach($db in $dbs)
{
#write-host $db.Name
if($db.Name -eq $DBName)
{
Write-Host "DB Found"
$dbfound = $true
}
}

#If DB doesnt exist create the db
if($dbfound -eq $False)
{
Write-Host "Creating DB"
$database = New-Object -TypeName ("$ns.Database")($s, $DBName)
$database.Create()

$db= New-Object ("$ns.Database")
$db= $s.Databases.Item($DBName)
#Create the table in the dbo schema
$tables = $xml.DBCreate.Database.Tables.Table
#Loop trough tables and create
foreach($table in $tables)
{
$tablename = $table.Name
 $tb = new-object ("$ns.Table")($db, $tablename)
 #Statement to create ServerTBL Table
 $columns = $table.Columns.Column
 foreach($column in $columns)
 {
 $datatype = $column.DataType
 $datatype = invoke-expression "[Microsoft.SqlServer.Management.Smo.Datatype]::$datatype"
 $columnname = $column.Name

 $tempcol = new-object ("$ns.Column")($tb, $columnname, $datatype)

 if($column.Identity -eq "True")
 {
 $tempcol.Identity = $true
  $tempcol.IdentitySeed = 1
 $tempcol.IdentityIncrement = 1
 }

  $tb.Columns.Add($tempcol)
  if($column.Nullable -eq "True")
{
  $tempcol.Nullable = $true
  }
if($column.PK -eq "True")
{
$PK = "PK_" + $columnname
 $idxpk = new-object ("$ns.Index") ($tb, $PK)
 $idxpk.IndexKeyType = "DriPrimaryKey"
 $idxpk.IsClustered = $true
 $idxpkcol = new-object ("$ns.IndexedColumn") ($idxpk, $columnname)
 $idxpk.IndexedColumns.Add($idxpkcol)
 $tb.Indexes.Add($idxpk)

}
 }
  $tb.Create()
 }
 }

Ultimately when you run the script the DB will be created, here is a screenshot from Microsoft SQL Management Studio showing the DB after creation.

The files shown in this blog post can be found at the TechNet Gallery

Pulling all Enumerations and Child Nodes with PowerShell SCSM 2012 R2

GeorgeWallace — Tue, 08 Jul 2014 13:42:00 GMT

I have been working with a colleague of mine Chris Jones on some reporting components for Service Manager and we wanted to pull all of the Enumerations within Service Manager and display them out. We decided to use SMLets to do this to make it easier. This is the beginning of a data dictionary which will ultimately be saved to Excel or another office product format, but for now I wanted to share the standard PowerShell.

Below is the sample script.

Function Get-ChildEnumeration
{
Param(
$Enumeration

        )
       $var = $var + "`t"
       $comma = $comma + ","
        $parentenum = Get-SCSMEnumeration -Id $Enumeration

$Query = $parentenum | Get-SCSMChildEnumeration -Depth OneLevel

if($prevcount -ne $query.count)
{

foreach($item in $Query)
{

     Write-Host $var $item.DisplayName
          $csv = $comma + $item.DisplayName
           add-content -path "c:\temp\stuff.csv" -Value $csv
$prevcount = $query.count
      Get-ChildEnumeration -Enumeration $item.id
     }
     }

}

$var ="`t"

function Get-RootEnumeration
{
foreach($root in (Get-SCSMEnumeration | ? {$_.Parent -eq $null} | ? {$_.DisplayName -ne $null}))
{
Write-Host $root.DisplayName
$csv = $root.DisplayName + $comma
add-content -path "c:\temp\SCSMEnumerations.csv" -Value $csv
Get-ChildEnumeration -Enumeration $root.id
}

}

Get-RootEnumeration

Afterwards the script output will look similar to the screenshot below.  Hope this helps others out there looking for something similar.

Adding the Description field to Service Manager 2012 Cubes

GeorgeWallace — Fri, 15 Nov 2013 11:22:35 GMT

I want to first caveat this post that modifying the cube via PowerShell could break something and it not supported, this should be used in a lab environment.

The Cubes in Service Manager are a great part of the product it makes for very robust reporting and calculating KPI’s a snap. A common ask I have seen is how to add the description field to the cubes.

Let me start with this, the primary reason for Analytic cubes is just that to do analysis, finding trends, tracking Key Performance Indicators and such. For this reason Description doesn’t fit well as most descriptions will be unique and to be used in analysis would make it tough, but there are reasons to have it, comparing descriptions of say all tickets that were assigned to a group, or descriptions from tickets in the same category.

Below is a simple script to get the Description field added to Service Requests. It can be used for others as well, you just need to update the Dimension and the Cube. The script first enables the Description field on the Dimension and then enables the Description Field on the Dimension in the applicable Cube. Both the normal Dimension and the Dimension in the Cube have to be updated for the Description to display.

[Reflection.Assembly]::LoadWithPartialName("Microsoft.AnalysisServices")
$servername=New-Object Microsoft.AnalysisServices.Server
$servername.connect("sqlservername")

$DWASDataBase = $servername.Databases | ? {$_.Name -eq 'DWASDataBase'}

$ServiceRequestDim = $DWASDataBase.Dimensions | ? {$_.Name -eq 'ServiceRequestDim'}
$Description = $ServiceRequestDim.Attributes | ? {$_.Name -eq 'Description'}
$Description.AttributeHierarchyEnabled = 'True'
$ServiceRequestDim.Update()

$SRCube = $DWASDataBase.Cubes | ? {$_.Name -eq 'SystemCenterServiceCatalogCube'}
$CubeServiceRequestDim = $SRCube.Dimensions | ? {$_.Name -eq 'ServiceRequestDim'}
$Description = $CubeServiceRequestDim.Attributes | ? {$_.AttributeID -eq 'Description'}
$Description.AttributeHierarchyEnabled = 'True'
$SRCube.Update()

Once the script has ran, you will need to reprocess the cube the description data will now be visible in excel or other BI tools (PowerPivot/Performance Point).