Create ACLs on an NNI in Azure Operator Nexus
In Azure Operator Nexus, access control lists (ACLs) for Permit and Deny actions at a network-to-network interconnect (NNI) level help protect Secure Shell (SSH) access on the management virtual private network (VPN). You create ingress and egress ACLs before the creation of NNI resources and then reference those ACLs in the NNI payload. You need to create referenced ingress and egress ACLs before you provision the network fabric.
These are the high-level steps for creating an ACL on an NNI:
- Create NNI ingress and egress ACLs.
- Update the Azure Resource Manager resource reference in a management NNI.
- Create an NNI and provision the network fabric.
Parameter usage guidance
| Parameter | Description | Example or range |
|---|---|---|
defaultAction |
Default action to be taken. If you don't define it, traffic is permitted. | "defaultAction": "Permit" |
resource-group |
Resource group of the network fabric. | nfresourcegroup |
resource-name |
Name of the ACL. | example-ingressACL |
vlanGroups |
List of virtual local area network (VLAN) groups. | |
vlans |
List of VLANs that need to be matched. | |
match-configurations |
Name of the match configuration. | example_acl. Spaces and the ampersand character (&) aren't supported. |
matchConditions |
Conditions required to be matched. | |
ttlValues |
Time to live (TTL). | 0-255 |
dscpMarking |
Differentiated Services Code Point (DSCP) markings that need to be matched. | 0-63 |
portCondition |
Port condition that needs to be matched. | |
portType |
Port type that needs to be matched. | Example: SourcePort. Allowed values: DestinationPort, SourcePort. |
protocolTypes |
Protocols that need to be matched. | [tcp, udp, range[1-2, 1, 2]]. If it's a protocol number, it should be in the range of 1-255. |
vlanMatchCondition |
VLAN match condition that needs to be matched. | |
layer4Protocol |
Layer 4 protocol. | Should be either TCP or UDP. |
ipCondition |
IP condition that needs to be matched. | |
actions |
Action to be taken based on a match condition. | Example: permit. |
configuration-type |
Configuration type, which can be inline or file. At this time, Azure Operator Nexus supports only inline. | Example: inline. |
You should also be aware of these restrictions:
- Inline ports and inline VLANs are a static way of defining the ports or VLANs by using
azcli. portGroupNamesandvlanGroupNamesare dynamic ways of defining ports and VLANs.- Inline ports and
portGroupNamestogether aren't allowed. - Inline VLANs and
vlanGroupNamestogether aren't allowed. ipGroupNamesandipPrefixValuestogether aren't allowed.- Egress ACLs don't support IP options, IP length, fragment, EtherType, DSCP marking, or TTL values.
- Ingress ACLs don't support EtherType options.
Create an ingress ACL
To create an ingress ACL, you can use the following Azure CLI command. This command creates an ingress ACL with the specified configurations and provides the expected result as output. Adjust the parameters as needed for your use case.
az networkfabric acl create
--resource-group "example-rg"
--location "eastus2euap"
--resource-name "example-Ipv4ingressACL"
--configuration-type "Inline"
--default-action "Permit"
--dynamic-match-configurations "[{ipGroups:[{name:'example-ipGroup',ipAddressType:IPv4,ipPrefixes:['10.20.3.1/20']}],vlanGroups:[{name:'example-vlanGroup',vlans:['20-30']}],portGroups:[{name:'example-portGroup',ports:['100-200']}]}]"
--match-configurations "[{matchConfigurationName:'example-match',sequenceNumber:123,ipAddressType:IPv4,matchConditions:[{etherTypes:['0x1'],fragments:['0xff00-0xffff'],ipLengths:['4094-9214'],ttlValues:[23],dscpMarkings:[32],portCondition:{flags:[established],portType:SourcePort,layer4Protocol:TCP,ports:['1-20']},protocolTypes:[TCP],vlanMatchCondition:{vlans:['20-30'],innerVlans:[30]},ipCondition:{type:SourceIP,prefixType:Prefix,ipPrefixValues:['10.20.20.20/12']}}],actions:[{type:Count,counterName:'example-counter'}]}]"
Expected output
{
"properties": {
"lastSyncedTime": "2023-06-17T08:56:23.203Z",
"configurationState": "Succeeded",
"provisioningState": "Accepted",
"administrativeState": "Enabled",
"annotation": "annotation",
"configurationType": "File",
"aclsUrl": "https://ACL-Storage-URL",
"matchConfigurations": [{
"matchConfigurationName": "example-match",
"sequenceNumber": 123,
"ipAddressType": "IPv4",
"matchConditions": [{
"etherTypes": ["0x1"],
"fragments": ["0xff00-0xffff"],
"ipLengths": ["4094-9214"],
"ttlValues": [23],
"dscpMarkings": [32],
"portCondition": {
"flags": ["established"],
"portType": "SourcePort",
"l4Protocol": "TCP",
"ports": ["1-20"],
"portGroupNames": ["example-portGroup"]
},
"protocolTypes": ["TCP"],
"vlanMatchCondition": {
"vlans": ["20-30"],
"innerVlans": [30],
"vlanGroupNames": ["example-vlanGroup"]
},
"ipCondition": {
"type": "SourceIP",
"prefixType": "Prefix",
"ipPrefixValues": ["10.20.20.20/12"],
"ipGroupNames": ["example-ipGroup"]
}
}]
}],
"actions": [{
"type": "Count",
"counterName": "example-counter"
}]
},
"tags": {
"keyID": "KeyValue"
},
"location": "eastUs",
"id": "/subscriptions/xxxxxx/resourceGroups/resourcegroupname/providers/Microsoft.ManagedNetworkFabric/accessControlLists/acl",
"name": "example-Ipv4ingressACL",
"type": "microsoft.managednetworkfabric/accessControlLists",
"systemData": {
"createdBy": "email@address.com",
"createdByType": "User",
"createdAt": "2023-06-09T04:51:41.251Z",
"lastModifiedBy": "UserId",
"lastModifiedByType": "User",
"lastModifiedAt": "2023-06-09T04:51:41.251Z"
}
}
Create an egress ACL
To create an egress ACL, you can use the following Azure CLI command. This command creates an egress ACL with the specified configurations and provides the expected result as output. Adjust the parameters as needed for your use case.
az networkfabric acl create
--resource-group "example-rg"
--location "eastus2euap"
--resource-name "example-Ipv4egressACL"
--configuration-type "File"
--acls-url "https://ACL-Storage-URL"
--default-action "Permit"
--dynamic-match-configurations "[{ipGroups:[{name:'example-ipGroup',ipAddressType:IPv4,ipPrefixes:['10.20.3.1/20']}],vlanGroups:[{name:'example-vlanGroup',vlans:['20-30']}],portGroups:[{name:'example-portGroup',ports:['100-200']}]}]"
Expected output
{
"properties": {
"lastSyncedTime": "2023-06-17T08:56:23.203Z",
"configurationState": "Succeeded",
"provisioningState": "Accepted",
"administrativeState": "Enabled",
"annotation": "annotation",
"configurationType": "File",
"aclsUrl": "https://ACL-Storage-URL",
"dynamicMatchConfigurations": [{
"ipGroups": [{
"name": "example-ipGroup",
"ipAddressType": "IPv4",
"ipPrefixes": ["10.20.3.1/20"]
}],
"vlanGroups": [{
"name": "example-vlanGroup",
"vlans": ["20-30"]
}],
"portGroups": [{
"name": "example-portGroup",
"ports": ["100-200"]
}]
}]
},
"tags": {
"keyID": "KeyValue"
},
"location": "eastUs",
"id": "/subscriptions/xxxxxx/resourceGroups/resourcegroupname/providers/Microsoft.ManagedNetworkFabric/accessControlLists/acl",
"name": "example-Ipv4egressACL",
"type": "microsoft.managednetworkfabric/accessControlLists",
"systemData": {
"createdBy": "email@address.com",
"createdByType": "User",
"createdAt": "2023-06-09T04:51:41.251Z",
"lastModifiedBy": "UserId",
"lastModifiedByType": "User",
"lastModifiedAt": "2023-06-09T04:51:41.251Z"
}
}
Update the Resource Manager reference
This step enables the creation of ACLs (ingress and egress if a reference is provided) during the creation of the NNI resource. After you create the NNI and before you provision the network fabric, you can perform re-put on the NNI.
ingressAclId: Reference ID for the ingress ACL.egressAclId: Reference ID for the egress ACL.
To get the Resource Manager resource ID, go to the resource group of the subscription that you're using.
The following command updates the Resource Manager reference for the NNI resource by associating it with the provided ingress and egress ACLs. Adjust the parameters as needed for your use case.
az networkfabric nni create
--resource-group "example-rg"
--fabric "example-fabric"
--resource-name "example-nniwithACL"
--nni-type "CE"
--is-management-type "True"
--use-option-b "True"
--layer2-configuration "{interfaces:['/subscriptions/xxxxx-xxxx-xxxx-xxxx-xxxxx/resourceGroups/example-rg/providers/Microsoft.ManagedNetworkFabric/networkDevices/example-networkDevice/networkInterfaces/example-interface'],mtu:1500}"
--option-b-layer3-configuration "{peerASN:28,vlanId:501,primaryIpv4Prefix:'10.18.0.124/30',secondaryIpv4Prefix:'10.18.0.128/30',primaryIpv6Prefix:'10:2:0:124::400/127',secondaryIpv6Prefix:'10:2:0:124::402/127'}"
--ingress-acl-id "/subscriptions/xxxxx-xxxx-xxxx-xxxx-xxxxx/resourceGroups/example-rg/providers/Microsoft.ManagedNetworkFabric/accesscontrollists/example-Ipv4ingressACL"
--egress-acl-id "/subscriptions/xxxxx-xxxx-xxxx-xxxx-xxxxx/resourceGroups/example-rg/providers/Microsoft.ManagedNetworkFabric/accesscontrollists/example-Ipv4egressACL"
Show ACL details
To display the details of a specified ACL, use the following command:
az networkfabric acl show --resource-group "example-rg" --resource-name "example-acl"
List ACLs
To list all ACLs within a specified resource group, use the following command:
az networkfabric acl list --resource-group "ResourceGroupName"
Create ACLs on the ISD external network
Use the following information to create ingress and egress ACLs for the isolation domain (ISD) external network. Then, update the Resource Manager resource reference for the external network.
Create an egress ACL for the ISD external network
To create an egress ACL for the specified ISD external network with the provided configuration, use the following command. Adjust the parameters as needed for your use case.
az networkfabric acl create
--resource-group "example-rg"
--location "eastus2euap"
--resource-name "example-Ipv4egressACL"
--annotation "annotation"
--configuration-type "Inline"
--default-action "Deny"
--match-configurations "[{matchConfigurationName:'L3ISD_EXT_OPTA_EGRESS_ACL_IPV4_CE_PE',sequenceNumber:1110,ipAddressType:IPv4,matchConditions:[{ipCondition:{type:SourceIP,prefixType:Prefix,ipPrefixValues:['10.18.0.124/30','10.18.0.128/30','10.18.30.16/30','10.18.30.20/30']}},{ipCondition:{type:DestinationIP,prefixType:Prefix,ipPrefixValues:['10.18.0.124/30','10.18.0.128/30','10.18.30.16/30','10.18.30.20/30']}}],actions:[{type:Count}]}]"
Expected output
Upon successful execution, the command returns information about the created ACL in the following format. This output includes details about the configuration and state.
{
"administrativeState": "Disabled",
"annotation": "annotation",
"configurationState": "Succeeded",
"configurationType": "Inline",
"defaultAction": "Deny",
"id": "/subscriptions/xxxxx-xxxx-xxxx-xxxx-xxxxx/resourceGroups/example-rg/providers/Microsoft.ManagedNetworkFabric/accessControlLists/example-Ipv4egressACL",
"location": "eastus2euap",
"matchConfigurations": [
{
"actions": [
{
"type": "Count"
}
],
"ipAddressType": "IPv4",
"matchConditions": [
{
"ipCondition": {
"ipPrefixValues": [
"10.18.0.124/30",
"10.18.0.128/30",
"10.18.30.16/30",
"10.18.30.20/30"
],
"prefixType": "Prefix",
"type": "SourceIP"
}
},
{
"ipCondition": {
"ipPrefixValues": [
"10.18.0.124/30",
"10.18.0.128/30",
"10.18.30.16/30",
"10.18.30.20/30"
],
"prefixType": "Prefix",
"type": "DestinationIP"
}
}
],
"matchConfigurationName": "L3ISD_EXT_OPTA_EGRESS_ACL_IPV4_CE_PE",
"sequenceNumber": 1110
}
],
"name": "example-Ipv4egressACL",
"provisioningState": "Succeeded",
"resourceGroup": "example-rg",
"systemData": {
"createdAt": "2023-09-11T10:20:20.2617941Z",
"createdBy": "email@address.com",
"createdByType": "User",
"lastModifiedAt": "2023-09-11T10:20:20.2617941Z",
"lastModifiedBy": "email@address.com",
"lastModifiedByType": "User"
},
"type": "microsoft.managednetworkfabric/accesscontrollists"
}
Create an ingress ACL for the ISD external network
To create an ingress ACL for the specified ISD external network with the provided configuration, use the following command. Adjust the parameters as needed for your use case.
az networkfabric acl create
--resource-group "example-rg"
--location "eastus2euap"
--resource-name "example-Ipv4ingressACL"
--annotation "annotation"
--configuration-type "Inline"
--default-action "Deny"
--match-configurations "[{matchConfigurationName:'L3ISD_EXT_OPTA_INGRESS_ACL_IPV4_CE_PE',sequenceNumber:1110,ipAddressType:IPv4,matchConditions:[{ipCondition:{type:SourceIP,prefixType:Prefix,ipPrefixValues:['10.18.0.124/30','10.18.0.128/30','10.18.30.16/30','10.18.30.20/30']}},{ipCondition:{type:DestinationIP,prefixType:Prefix,ipPrefixValues:['10.18.0.124/30','10.18.0.128/30','10.18.30.16/30','10.18.30.20/30']}}],actions:[{type:Count}]}]"
Expected output
Upon successful execution, the command returns information about the created ACL in the following format. This output includes details about the configuration and state.
{
"administrativeState": "Disabled",
"annotation": "annotation",
"configurationState": "Succeeded",
"configurationType": "Inline",
"defaultAction": "Deny",
"id": "/subscriptions/xxxxx-xxxx-xxxx-xxxx-xxxxx/resourceGroups/example-rg/providers/Microsoft.ManagedNetworkFabric/accessControlLists/example-Ipv4ingressACL",
"location": "eastus2euap",
"matchConfigurations": [
{
"actions": [
{
"type": "Count"
}
],
"ipAddressType": "IPv4",
"matchConditions": [
{
"ipCondition": {
"ipPrefixValues": [
"10.18.0.124/30",
"10.18.0.128/30",
"10.18.30.16/30",
"10.18.30.20/30"
],
"prefixType": "Prefix",
"type": "SourceIP"
}
},
{
"ipCondition": {
"ipPrefixValues": [
"10.18.0.124/30",
"10.18.0.128/30",
"10.18.30.16/30",
"10.18.30.20/30"
],
"prefixType": "Prefix",
"type": "DestinationIP"
}
}
],
"matchConfigurationName": "L3ISD_EXT_OPTA_INGRESS_ACL_IPV4_CE_PE",
"sequenceNumber": 1110
}
],
"name": "example-Ipv4ingressACL",
"provisioningState": "Succeeded",
"resourceGroup": "example-rg",
"systemData": {
"createdAt": "2023-09-11T10:20:20.2617941Z",
"createdBy": "email@address.com",
"createdByType": "User",
"lastModifiedAt": "2023-09-11T10:27:27.2317467Z",
"lastModifiedBy": "email@address.com",
"lastModifiedByType": "User"
},
"type": "microsoft.managednetworkfabric/accesscontrollists"
}
Feedback
Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see: https://aka.ms/ContentUserFeedback.
Submit and view feedback for