How to block network traffic with Azure Virtual Network Manager - Azure PowerShell

This article shows you how to create a security rule to block outbound network traffic to port 80 and 443 that you can add to your rule collections. For more information, see Security admin rules.

Prerequisites

Before you start configuring security rules, confirm the following steps:

• You understand each element in a Security admin rule.
• You've created an Azure Virtual Network Manager instance.
• Installed version of Az.Network of 5.3.0 or higher is required to access the required cmdlets.

Create a SecurityAdmin configuration

1. Create a new SecurityAdmin configuration with New-AzNetworkManagerSecurityAdminConfiguration.

   $config = @{
       Name = 'SecurityConfig'
       ResourceGroupName = 'myAVNMResourceGroup'
       NetworkManagerName = 'myAVNM'
   }
   $securityconfig = New-AzNetworkManagerSecurityAdminConfiguration @config
   
   

2. Store network group to a variable with Get-AzNetworkManagerGroup.

   $ng = @{
       Name = 'myNetworkGroup'
       ResourceGroupName = 'myAVNMResourceGroup'
       NetworkManagerName = 'myAVNM'
   }
   $networkgroup = Get-AzNetworkManagerGroup @ng   
   

3. Create a connectivity group item to add a network group to with New-AzNetworkManagerSecurityGroupItem.

   $gi = @{
       NetworkGroupId = "$networkgroup.Id"
   }
   
   $groupItem = New-AzNetworkManagerSecurityGroupItem -NetworkGroupId $networkgroup.id
   

4. Create a configuration group and add the group item from the previous step.

   [System.Collections.Generic.List[Microsoft.Azure.Commands.Network.Models.PSNetworkManagerSecurityGroupItem]]$configGroup = @()  
   $configGroup.Add($groupItem) 
   
   $configGroup = @($groupItem)
   

5. Create a security admin rules collection with New-AzNetworkManagerSecurityAdminRuleCollection.

   $collection = @{
       Name = 'myRuleCollection'
       ResourceGroupName = 'myAVNMResourceGroup'
       NetworkManager = 'myAVNM'
       ConfigName = 'SecurityConfig'
       AppliesToGroup = "$configGroup"
   }
   $rulecollection = New-AzNetworkManagerSecurityAdminRuleCollection @collection -AppliesToGroup $configGroup
   

6. Define the variables for the source and destination address prefixes and ports with New-AzNetworkManagerAddressPrefixItem.

   $sourceip = @{
       AddressPrefix = 'Internet'
       AddressPrefixType = 'ServiceTag'
   }
   $sourceprefix = New-AzNetworkManagerAddressPrefixItem @sourceip
   
   $destinationip = @{
       AddressPrefix = '10.0.0.0/24'
       AddressPrefixType = 'IPPrefix'
   }
   $destinationprefix = New-AzNetworkManagerAddressPrefixItem @destinationip
   
   [System.Collections.Generic.List[string]]$sourcePortList = @() 
   $sourcePortList.Add("65500”) 
   
   [System.Collections.Generic.List[string]]$destinationPortList = @() 
   $destinationPortList.Add("80”)
   $destinationPortList.Add("443”)
   

7. Create a security rule with New-AzNetworkManagerSecurityAdminRule.

   $rule = @{
       Name = 'Block_HTTP_HTTPS'
       ResourceGroupName = 'myAVNMResourceGroup'
       NetworkManagerName = 'myAVNM'
       SecurityAdminConfigurationName = 'SecurityConfig'
       RuleCollectionName = 'myRuleCollection'
       Protocol = 'TCP'
       Access = 'Deny'
       Priority = '100'
       Direction = 'Outbound'
       SourceAddressPrefix = $sourceprefix
       SourcePortRange = $sourcePortList
       DestinationAddressPrefix = $destinationprefix
       DestinationPortRange = $destinationPortList
   }
   $securityrule = New-AzNetworkManagerSecurityAdminRule @rule
   

Commit deployment

Commit the security configuration to target regions with Deploy-AzNetworkManagerCommit.

$regions = @("westus")
$deployment = @{
    Name = 'myAVNM'
    ResourceGroupName = 'myAVNMResourceGroup'
    ConfigurationId = $configIds
    TargetLocation = $regions
    CommitType = 'SecurityAdmin'
}
Deploy-AzNetworkManagerCommit @deployment 

Delete security configuration

If you no longer need the security configuration, make sure the following criteria is true so you can delete the security configuration itself:

• There are no deployments of configurations to any region.
• Delete all security rules in a rule collection associated to the security configuration.

Remove security configuration deployment

Remove the security deployment by deploying a configuration with Deploy-AzNetworkManagerCommit.

[System.Collections.Generic.List[string]]$configIds = @()
[System.Collections.Generic.List[string]]$regions = @()   
$regions.Add("westus")     
$removedeployment = @{
    Name = 'myAVNM'
    ResourceGroupName = 'myAVNMResourceGroup'
    ConfigurationId = $configIds
    TargetLocation = $regions
    CommitType = 'SecurityAdmin'
}
Deploy-AzNetworkManagerCommit @removedeployment

Remove security rules

Remove security rules with Remove-AzNetworkManagerSecurityAdminRule.

$removerule = @{
    Name = 'Block80'
    ResourceGroupName = 'myAVNMResourceGroup'
    NetworkManagerName = 'myAVNM'
    SecurityAdminConfigurationName = 'SecurityConfig'
}
Remove-AzNetworkManagerSecurityAdminRule @removerule

Remove security rule collections

$removecollection = @{
    Name = 'myRuleCollection'
    ResourceGroupName = 'myAVNMResourceGroup'
    NetworkManagerName = 'myAVNM'
    SecurityAdminConfigurationName = 'SecurityConfig'
}
Remove-AzNetworkManagerSecurityAdminRuleCollection @removecollection

Delete configuration

Delete the security configuration with Remove-AzNetworkManagerSecurityAdminConfiguration.

$removeconfig = @{
    Name = 'SecurityConfig'
    ResourceGroupName = 'myAVNMResourceGroup'
    NetworkManagerName = 'myAVNM'
}
Remove-AzNetworkManagerSecurityAdminConfiguration @removeconfig

Next steps

Learn more about Security admin rules.