How to block network traffic with Azure Virtual Network Manager - Azure PowerShell
This article shows you how to create a security rule to block outbound network traffic to port 80 and 443 that you can add to your rule collections. For more information, see Security admin rules.
Prerequisites
Before you start configuring security rules, confirm the following steps:
- You understand each element in a Security admin rule.
- You've created an Azure Virtual Network Manager instance.
- Installed version of
Az.Network
of5.3.0
or higher is required to access the required cmdlets.
Create a SecurityAdmin configuration
Create a new SecurityAdmin configuration with New-AzNetworkManagerSecurityAdminConfiguration.
$config = @{ Name = 'SecurityConfig' ResourceGroupName = 'myAVNMResourceGroup' NetworkManagerName = 'myAVNM' } $securityconfig = New-AzNetworkManagerSecurityAdminConfiguration @config
Store network group to a variable with Get-AzNetworkManagerGroup.
$ng = @{ Name = 'myNetworkGroup' ResourceGroupName = 'myAVNMResourceGroup' NetworkManagerName = 'myAVNM' } $networkgroup = Get-AzNetworkManagerGroup @ng
Create a connectivity group item to add a network group to with New-AzNetworkManagerSecurityGroupItem.
$gi = @{ NetworkGroupId = "$networkgroup.Id" } $groupItem = New-AzNetworkManagerSecurityGroupItem -NetworkGroupId $networkgroup.id
Create a configuration group and add the group item from the previous step.
[System.Collections.Generic.List[Microsoft.Azure.Commands.Network.Models.PSNetworkManagerSecurityGroupItem]]$configGroup = @() $configGroup.Add($groupItem) $configGroup = @($groupItem)
Create a security admin rules collection with New-AzNetworkManagerSecurityAdminRuleCollection.
$collection = @{ Name = 'myRuleCollection' ResourceGroupName = 'myAVNMResourceGroup' NetworkManager = 'myAVNM' ConfigName = 'SecurityConfig' AppliesToGroup = "$configGroup" } $rulecollection = New-AzNetworkManagerSecurityAdminRuleCollection @collection -AppliesToGroup $configGroup
Define the variables for the source and destination address prefixes and ports with New-AzNetworkManagerAddressPrefixItem.
$sourceip = @{ AddressPrefix = 'Internet' AddressPrefixType = 'ServiceTag' } $sourceprefix = New-AzNetworkManagerAddressPrefixItem @sourceip $destinationip = @{ AddressPrefix = '10.0.0.0/24' AddressPrefixType = 'IPPrefix' } $destinationprefix = New-AzNetworkManagerAddressPrefixItem @destinationip [System.Collections.Generic.List[string]]$sourcePortList = @() $sourcePortList.Add("65500”) [System.Collections.Generic.List[string]]$destinationPortList = @() $destinationPortList.Add("80”) $destinationPortList.Add("443”)
Create a security rule with New-AzNetworkManagerSecurityAdminRule.
$rule = @{ Name = 'Block_HTTP_HTTPS' ResourceGroupName = 'myAVNMResourceGroup' NetworkManagerName = 'myAVNM' SecurityAdminConfigurationName = 'SecurityConfig' RuleCollectionName = 'myRuleCollection' Protocol = 'TCP' Access = 'Deny' Priority = '100' Direction = 'Outbound' SourceAddressPrefix = $sourceprefix SourcePortRange = $sourcePortList DestinationAddressPrefix = $destinationprefix DestinationPortRange = $destinationPortList } $securityrule = New-AzNetworkManagerSecurityAdminRule @rule
Commit deployment
Commit the security configuration to target regions with Deploy-AzNetworkManagerCommit.
$regions = @("westus")
$deployment = @{
Name = 'myAVNM'
ResourceGroupName = 'myAVNMResourceGroup'
ConfigurationId = $configIds
TargetLocation = $regions
CommitType = 'SecurityAdmin'
}
Deploy-AzNetworkManagerCommit @deployment
Delete security configuration
If you no longer need the security configuration, make sure the following criteria is true so you can delete the security configuration itself:
- There are no deployments of configurations to any region.
- Delete all security rules in a rule collection associated to the security configuration.
Remove security configuration deployment
Remove the security deployment by deploying a configuration with Deploy-AzNetworkManagerCommit.
[System.Collections.Generic.List[string]]$configIds = @()
[System.Collections.Generic.List[string]]$regions = @()
$regions.Add("westus")
$removedeployment = @{
Name = 'myAVNM'
ResourceGroupName = 'myAVNMResourceGroup'
ConfigurationId = $configIds
TargetLocation = $regions
CommitType = 'SecurityAdmin'
}
Deploy-AzNetworkManagerCommit @removedeployment
Remove security rules
Remove security rules with Remove-AzNetworkManagerSecurityAdminRule.
$removerule = @{
Name = 'Block80'
ResourceGroupName = 'myAVNMResourceGroup'
NetworkManagerName = 'myAVNM'
SecurityAdminConfigurationName = 'SecurityConfig'
}
Remove-AzNetworkManagerSecurityAdminRule @removerule
Remove security rule collections
$removecollection = @{
Name = 'myRuleCollection'
ResourceGroupName = 'myAVNMResourceGroup'
NetworkManagerName = 'myAVNM'
SecurityAdminConfigurationName = 'SecurityConfig'
}
Remove-AzNetworkManagerSecurityAdminRuleCollection @removecollection
Delete configuration
Delete the security configuration with Remove-AzNetworkManagerSecurityAdminConfiguration.
$removeconfig = @{
Name = 'SecurityConfig'
ResourceGroupName = 'myAVNMResourceGroup'
NetworkManagerName = 'myAVNM'
}
Remove-AzNetworkManagerSecurityAdminConfiguration @removeconfig
Next steps
Learn more about Security admin rules.
Palaute
https://aka.ms/ContentUserFeedback.
Tulossa pian: Vuoden 2024 aikana poistamme asteittain GitHub Issuesin käytöstä sisällön palautemekanismina ja korvaamme sen uudella palautejärjestelmällä. Lisätietoja on täällä:Lähetä ja näytä palaute kohteelle