Edit

Create a virtual network for multi-tier applications using an Azure CLI script sample

  • Article
  • 6 minutes to read

This script sample creates a virtual network with front-end and back-end subnets. Traffic to the front-end subnet is limited to HTTP and SSH, while traffic to the back-end subnet is limited to MySQL, port 3306. After running the script, you have two virtual machines, one in each subnet, that you can deploy web server and MySQL software to.

If you don't have an Azure subscription, create an Azure free account before you begin.

Prerequisites

Sample script

Launch Azure Cloud Shell

The Azure Cloud Shell is a free interactive shell that you can use to run the steps in this article. It has common Azure tools preinstalled and configured to use with your account.

To open the Cloud Shell, just select Try it from the upper right corner of a code block. You can also launch Cloud Shell in a separate browser tab by going to https://shell.azure.com.

When Cloud Shell opens, verify that Bash is selected for your environment. Subsequent sessions will use Azure CLI in a Bash environment, Select Copy to copy the blocks of code, paste it into the Cloud Shell, and press Enter to run it.

Sign in to Azure

Cloud Shell is automatically authenticated under the initial account signed-in with. Use the following script to sign in using a different subscription, replacing <Subscription ID> with your Azure Subscription ID. If you don't have an Azure subscription, create an Azure free account before you begin.

subscription="<subscriptionId>" # add subscription here

az account set -s $subscription # ...or use 'az login'

For more information, see set active subscription or log in interactively

Run the script

# Create vNet for multi-tier application

# Variable block
let "randomIdentifier=$RANDOM*$RANDOM"
location="East US"
resourceGroup="msdocs-virtual-network-rg-$randomIdentifier"
tag="virtual-network-multi-tier-application"
vNet="msdocs-vNet-$randomIdentifier"
addressPrefixVNet="10.0.0.0/16"
subnetFrontEnd="msdocs-frontend-subnet-$randomIdentifier"
subnetPrefixFrontEnd="10.0.1.0/24"
nsgFrontEnd="msdocs-nsg-frontend-$randomIdentifier"
subnetBackEnd="msdocs-backend-subnet-$randomIdentifier"
subnetPrefixBackEnd="10.0.2.0/24"
nsgBackEnd="msdocs-nsg-backend-$randomIdentifier"
publicIpWeb="msdocs-public-ip-web-$randomIdentifier"
publicIpSql="msdocs-public-ip-sql-$randomIdentifier"
nicWeb="msdocs-nic-web-$randomIdentifier"
nicSql="msdocs-nic-sql-$randomIdentifier"
image="UbuntuLTS"
login="azureuser"
vmWeb="msdocs-vm-web$randomIdentifier"
vmSql="msdocs-vm-sql$randomIdentifier"
sku="BASIC"

echo "Using resource group $resourceGroup with login: $login"

# Create a resource group
echo "Creating $resourceGroup in $location..."
az group create --name $resourceGroup --location "$location" --tags $tag

# Create a virtual network and a front-end subnet.
echo "Creating $vNet and $subnetFrontEnd"
az network vnet create --resource-group $resourceGroup --name $vNet --address-prefix $addressPrefixVNet  --location "$location" --subnet-name $subnetFrontEnd --subnet-prefix $subnetPrefixFrontEnd

# Create a backend subnet.
echo "Creating $subnetBackEnd"
az network vnet subnet create --address-prefix $subnetPrefixBackEnd --name $subnetBackEnd --resource-group $resourceGroup --vnet-name $vNet

# Create a network security group (NSG) for the front-end subnet.
echo "Creating $nsgFrontEnd for $subnetFrontEnd"
az network nsg create --resource-group $resourceGroup --name $nsgFrontEnd --location "$location"

# Create NSG rules to allow HTTP & HTTPS traffic inbound.
echo "Creating $nsgFrontEnd rules in $nsgFrontEnd to allow HTTP and HTTPS inbound traffic"
az network nsg rule create --resource-group $resourceGroup --nsg-name $nsgFrontEnd --name Allow-HTTP-All --access Allow --protocol Tcp --direction Inbound --priority 100 --source-address-prefix Internet --source-port-range "*" --destination-address-prefix "*" --destination-port-range 80
az network nsg rule create --resource-group $resourceGroup --nsg-name $nsgFrontEnd --name Allow-HTTPS-All --access Allow --protocol Tcp --direction Inbound --priority 200 --source-address-prefix Internet --source-port-range "*" --destination-address-prefix "*" --destination-port-range 443

# Create an NSG rule to allow SSH traffic in from the Internet to the front-end subnet.
echo "Creating NSG rule in $nsgFrontEnd to allow inbound SSH traffic"
az network nsg rule create --resource-group $resourceGroup --nsg-name $nsgFrontEnd --name Allow-SSH-All --access Allow --protocol Tcp --direction Inbound --priority 300 --source-address-prefix Internet --source-port-range "*" --destination-address-prefix "*" --destination-port-range 22

# Associate the front-end NSG to the front-end subnet.
echo "Associate $nsgFrontEnd to $subnetFrontEnd"
az network vnet subnet update --vnet-name $vNet --name $subnetFrontEnd --resource-group $resourceGroup --network-security-group $nsgFrontEnd

# Create a network security group for the backend subnet.
echo "Creating $nsgBackEnd for $subnetBackEnd"
az network nsg create --resource-group $resourceGroup --name $nsgBackEnd --location "$location"

# Create an NSG rule to allow MySQL traffic from the front-end subnet to the backend subnet.
echo "Creating NSG rule in $nsgBackEnd to allow MySQL traffic from $subnetFrontEnd to $subnetBackEnd"
az network nsg rule create --resource-group $resourceGroup --nsg-name $nsgBackEnd --name Allow-MySql-FrontEnd --access Allow --protocol Tcp --direction Inbound --priority 100 --source-address-prefix $subnetPrefixFrontEnd --source-port-range "*" --destination-address-prefix "*" --destination-port-range 3306

# Create an NSG rule to allow SSH traffic from the Internet to the backend subnet.
echo "Creating NSG rule in $nsgBackEnd to allow SSH traffic from the Internet to $subnetBackEnd"
az network nsg rule create --resource-group $resourceGroup --nsg-name $nsgBackEnd --name Allow-SSH-All --access Allow --protocol Tcp --direction Inbound --priority 200 --source-address-prefix Internet --source-port-range "*" --destination-address-prefix "*" --destination-port-range 22

# Create an NSG rule to block all outbound traffic from the backend subnet to the Internet (NOTE: If you run the MySQL installation below this rule will be disabled and then re-enabled).
echo "Creating NSG rule in $nsgBackEnd to block all outbound traffic from $subnetBackEnd"
az network nsg rule create --resource-group $resourceGroup --nsg-name $nsgBackEnd --name Deny-Internet-All --access Deny --protocol Tcp --direction Outbound --priority 300 --source-address-prefix "*" --source-port-range "*" --destination-address-prefix "*" --destination-port-range "*"

# Associate the backend NSG to the backend subnet.
echo "Associate $nsgBackEnd to $subnetBackEnd"
az network vnet subnet update --vnet-name $vNet --name $subnetBackEnd --resource-group $resourceGroup --network-security-group $nsgBackEnd

# Create a public IP address for the web server VM.
echo "Creating $publicIpWeb for $vmWeb"
az network public-ip create --resource-group $resourceGroup --name $publicIpWeb

# Create a NIC for the web server VM.
echo "Creating $nicWeb for $vmWeb"
az network nic create --resource-group $resourceGroup --name $nicWeb --vnet-name $vNet --subnet $subnetFrontEnd --network-security-group $nsgFrontEnd --public-ip-address $publicIpWeb

# Create a Web Server VM in the front-end subnet.
echo "Creating $vmWeb in $subnetFrontEnd"
az vm create --resource-group $resourceGroup --name $vmWeb --nics $nicWeb --image $image --admin-username $login --generate-ssh-keys  --public-ip-sku $sku

# Create a public IP address for the MySQL VM.
echo "Creating $publicIpSql for $vmSql"
az network public-ip create --resource-group $resourceGroup --name $publicIpSql

# Create a NIC for the MySQL VM.
echo "Creating $nicSql for $vmSql"
az network nic create --resource-group $resourceGroup --name $nicSql --vnet-name $vNet --subnet $subnetBackEnd --network-security-group $nsgBackEnd --public-ip-address $publicIpSql

# Create a MySQL VM in the backend subnet.
echo "Creating $vmSql in $subnetBackEnd"
az vm create --resource-group $resourceGroup --name $vmSql --nics $nicSql --image $image --admin-username $login --generate-ssh-keys  --public-ip-sku $sku

Clean up deployment

Use the following command to remove the resource group and all resources associated with it using the az group delete command - unless you have an ongoing need for these resources. Some of these resources may take a while to create, as well as to delete.

az group delete --name $resourceGroup

Sample reference

This script uses the following commands to create a resource group, virtual network, and network security groups. Each command in the following table links to command-specific documentation:

Command Notes
az group create Creates a resource group in which all resources are stored.
az network vnet create Creates an Azure virtual network and front-end subnet.
az network subnet create Creates a back-end subnet.
az network public-ip create Creates a public IP address to access the VM from the internet.
az network nic create Creates virtual network interfaces and attaches them to the virtual network's front-end and back-end subnets.
az network nsg create Creates network security groups (NSG) that are associated to the front-end and back-end subnets.
az network nsg rule create Creates NSG rules that allow or block specific ports to specific subnets.
az vm create Creates virtual machines and attaches a NIC to each VM. This command also specifies the virtual machine image to use and administrative credentials.
az group delete Deletes a resource group and all resources it contains.

Next steps

For more information on the Azure CLI, see Azure CLI documentation.

Additional virtual network CLI script samples can be found in Virtual network CLI samples.