First, use the Azure CLI az network vnet create command to create the virtual network for the host:
az network vnet create -g "myResourceGroup" -n "myVNet" --address-prefixes "10.0.0.0/16" --tags "fastpathenabled=True" --subnet-name "myPHSMSubnet" --subnet-prefix "10.0.0.0/24"
Afterward, use the Azure CLI az network vnet subnet update command to update the subnet and give it a delegation of "Microsoft.HardwareSecurityModules/dedicatedHSMs":
az network vnet subnet update -g "myResourceGroup" --vnet-name "myVNet" -n "myPHSMSubnet" --delegations "Microsoft.HardwareSecurityModules/dedicatedHSMs"
To verify that the VNet and subnet were created correctly, use the Azure CLI az network vnet subnet show command:
az network vnet subnet show -g "myResourceGroup" --vnet-name "myVNet" -n myPHSMSubnet
Make note of the host's subnet ID, which is used when creating the payment HSM. The ID of the subnet ends with the name of the subnet:
"id": "/subscriptions/<subscriptionID>/resourceGroups/myResourceGroup/providers/Microsoft.Network/virtualNetworks/myVNet/subnets/myPHSMSubnet",
Now create another virtual network and subnet for the management port:
az network vnet create -g "myResourceGroup" -n "myManagementVNet" --address-prefixes "10.1.0.0/16" --tags "fastpathenabled=True" --subnet-name "myManagementSubnet" --subnet-prefix "10.1.0.0/24"
Again, use the Azure CLI az network vnet subnet update command to update the subnet and give it a delegation of "Microsoft.HardwareSecurityModules/dedicatedHSMs":
az network vnet subnet update -g "myResourceGroup" --vnet-name "myManagementVNet" -n "myManagementSubnet" --delegations "Microsoft.HardwareSecurityModules/dedicatedHSMs"
To verify that the management VNet and subnet were created correctly, use the Azure CLI az network vnet subnet show command:
az network vnet subnet show -g "myResourceGroup" --vnet-name "myManagementVNet" -n "myManagementSubnet"
You also need the management's subnet ID when creating the payment HSM.
First, set some variables for use in creating the host VNet / subnet:
$VNetAddressPrefix = @("10.0.0.0/16")
$SubnetAddressPrefix = "10.0.0.0/24"
$tags = @{fastpathenabled="true"}
Use the Azure PowerShell New-AzDelegation cmdlet to create a service delegation to be added to your host subnet, and save the output to the $myDelegation
variable:
$myDelegation = New-AzDelegation -Name "myHSMDelegation" -ServiceName "Microsoft.HardwareSecurityModules/dedicatedHSMs"
Use the Azure PowerShell New-AzVirtualNetworkSubnetConfig cmdlet to create a virtual network subnet configuration, and save the output to the $myPHSMSubnet
variable:
$myPHSMSubnetConfig = New-AzVirtualNetworkSubnetConfig -Name "myPHSMSubnet" -AddressPrefix $SubnetAddressPrefix -Delegation $myDelegation
Note
The New-AzVirtualNetworkSubnetConfig cmdlet will generate a warning, which you can safely ignore.
To create an Azure Virtual Network, use the Azure PowerShell New-AzVirtualNetwork cmdlet:
New-AzVirtualNetwork -Name "myVNet" -ResourceGroupName "myResourceGroup" -Location "EastUS" -Tag $tags -AddressPrefix $VNetAddressPrefix -Subnet $myPHSMSubnetConfig
To verify that the VNet was created correctly, use the Azure PowerShell Get-AzVirtualNetwork cmdlet:
Get-AzVirtualNetwork -Name "myVNet" -ResourceGroupName "myResourceGroup"
Make note of the subnet's ID, which is used in the next step. The ID of the subnet ends with the name of the subnet:
"Id": "/subscriptions/<subscriptionID>/resourceGroups/myResourceGroup/providers/Microsoft.Network/virtualNetworks/myVNet/subnets/myPHSMSubnet",
Now create another virtual network and subnet for the management port. First, set new variables:
$ManagementVNetAddressPrefix = @("10.1.0.0/16")
$ManagementSubnetAddressPrefix = "10.1.0.0/24"
$myManagementSubnetConfig = New-AzVirtualNetworkSubnetConfig -Name "myManagementSubnet" -AddressPrefix $ManagementSubnetAddressPrefix -Delegation $myDelegation
Use the Azure PowerShell New-AzVirtualNetwork cmdlet to create the management virtual network and subnet:
New-AzVirtualNetwork -Name "myManagementVNet" -ResourceGroupName "myResourceGroup" -Location "EastUS" -Tag $tags -AddressPrefix $ManagementVNetAddressPrefix -Subnet $myManagementSubnetConfig
To verify that the VNet was created correctly, use the Azure PowerShell Get-AzVirtualNetwork cmdlet:
Get-AzVirtualNetwork -Name "myManagementVNet" -ResourceGroupName "myResourceGroup"
You also need the management's subnet ID when creating the payment HSM.