cli

Deploy Azure Firewall (EDGE)(bash) infraestrutura

Olá, neste post iremos fazer o deploy do Azure Firewall em uma infraestrutura de Firewal EDGE (como ja feito com Palo Alto e Fortigate)
Nesta topologia teremos Azure Firewall como borda de toda rede Azure (neste exemplo)

Vamos aos objetos criados

ObjetoNameDescrição
Resource Grouprg01-fw-edge-shared-brazilsouthRG
Azure Firewallfw-edgeStandard
Public IPpip-fw-edge-shared-brazilsouth-nat-outxxx.xxx.xxx.xxx
Public IPpip-fw-edge-shared-brazilsouth-nat-rdpxxx.xxx.xxx.xxx
Public IPpip-fw-edge-shared-brazilsouth-nat-sshxxx.xxx.xxx.xxx
Route Tablert-fw-edge-shared-brazilsouthRoute Table
Virtual Networkvnet-fw-edge-shared-brazilsouth10.225.0.0/22

*Não criamos aqui as VMs (Windows/Linux), mas elas estão na SubNet AzureFirewallSubnet-Trust
Nossas Subnets

AzureFirewallSubnet = 10.225.0.0/24
AzureFirewallManagementSubnet = 10.225.1.0/24
AzureFirewallSubnet-Trust = 10.225.2.0/24

Vamos ao nosso script bash

##Declarando variaveis Subscription(obrigatórias)
export Subscription_Name="XXXXX" ###Insira aqui sua subscription Azure

##Declarando variaveis Resource Group(obrigatórias)
export Name_RG_01="rg01"
export Name_RG_02="fw-edge"
export Name_Environment="shared"
export Location_Region="brazilsouth"
export RG_FULL_NAME="${Name_RG_01}"-"${Name_RG_02}"-"${Name_Environment}"-"${Location_Region}"

###Declarando variaveis Firewall (Obrigatório)
export FW_Name01="fw"

##Declarando Variaveis da Vnet (Obrigatório)
export Vnet_Name01="vnet"
export Vnet_FULL_Name="${Vnet_Name01}"-"${Name_RG_02}"-"${Name_Environment}"-"${Location_Region}"
export CIDR="10.225.0.0/22"

##Declarando Variaveis da Subnet (Obrigatório)
export SubnetName="AzureFirewallSubnet"
export Prefix="10.225.0.0/24"
export SubnetName02="AzureFirewallManagementSubnet"
export Prefix02="10.225.1.0/24"
export SubnetName03="AzureFirewallSubnet-Trust"
export Prefix03="10.225.2.0/24"

##Declarando Variaveis SKU/TIER
export SKU="AZFW_VNet"
export TIER="Standard"
export NameIP_01="ifconfig1"
export NameIP_02="nat-ssh"
export NameIP_03="nat-rdp"

##Declarando variaveis de ZONA
export ZONES="1"

##Declarando Variaveis IP Publico
export Public_IP_01="pip"
export Public_IP_02="${Public_IP_01}"-"${Name_RG_02}"-"${Name_Environment}"-"${Location_Region}"-"${Collection_Name03}"
export Public_IP_03="${Public_IP_01}"-"${Name_RG_02}"-"${Name_Environment}"-"${Location_Region}"-"${Collection_Name01}"
export Public_IP_04="${Public_IP_01}"-"${Name_RG_02}"-"${Name_Environment}"-"${Location_Region}"-"${Collection_Name02}"
export SKU_IP="Standard"
export IP_Zone="1"
export AlLocation="Static"
export Tier_IP="Regional"

###Declarando Variaveis de Route Table
export RT_Name01="rt"
export RT_Name02="${RT_Name01}"-"${Name_RG_02}"-"${Name_Environment}"-"${Location_Region}"
export RT_Name03="Default"
export Prefix_Address01="0.0.0.0/0"

###Declarando Variaveis NAT RULE
export Collection_Name01="nat-ssh"
export Collection_Name02="nat-rdp"
export Collection_Name03="nat-out"
export Destination01="10.225.2.4"

###Declarando Variaveis para acesso a internet HTTP/HTTPs
export Colletion_Name_Internet="Acesso_Internet"

##Variaveis TAGs (Não Obrigatório)
export Description="Departamento"
export Value_Description="Redes/Telecom/Segurança/Infraestrutura"
export Cost_Center="Centro de Custo"
export Cost_Center_Value="Redes/Telecom/Segurança/Infraestrutura"
export Support_Description_Description="E-mail Suporte"
export Support_Description_Value="[email protected]"

###Selecionar subscription
az account set --subscription "${Subscription_Name}"

##Criando RG
az group create -n "${RG_FULL_NAME}" -l "${Location_Region}" --tags "${Description}"="${Value_Description}" "${Cost_Center}"="${Cost_Center_Value}" "${Support_Description_Description}"="${Support_Description_Value}"

####Criando Virtual Network (Vnet)
az network vnet create -g "${RG_FULL_NAME}" -n "${Vnet_FULL_Name}" --address-prefix "${CIDR}" -l "${Location_Region}" --tags "${Description}"="${Value_Description}" "${Cost_Center}"="${Cost_Center_Value}" "${Support_Description_Description}"="${Support_Description_Value}"

###Criando Subnet 
az network vnet subnet create -g "${RG_FULL_NAME}" --vnet-name "${Vnet_FULL_Name}" -n "${SubnetName}" --address-prefixes "${Prefix}"
az network vnet subnet create -g "${RG_FULL_NAME}" --vnet-name "${Vnet_FULL_Name}" -n "${SubnetName02}" --address-prefixes "${Prefix02}"
az network vnet subnet create -g "${RG_FULL_NAME}" --vnet-name "${Vnet_FULL_Name}" -n "${SubnetName03}" --address-prefixes "${Prefix03}"

###Criando IP Publico
az network public-ip create -n "${Public_IP_02}" -g "${RG_FULL_NAME}" -l "${Location_Region}" --zone "${IP_Zone}" --allocation-method "${AlLocation}" --sku "${SKU_IP}" --tier "${Tier_IP}" --tags "${Description}"="${Value_Description}" "${Cost_Center}"="${Cost_Center_Value}" "${Support_Description_Description}"="${Support_Description_Value}"
az network public-ip create -n "${Public_IP_03}" -g "${RG_FULL_NAME}" -l "${Location_Region}" --zone "${IP_Zone}" --allocation-method "${AlLocation}" --sku "${SKU_IP}" --tier "${Tier_IP}" --tags "${Description}"="${Value_Description}" "${Cost_Center}"="${Cost_Center_Value}" "${Support_Description_Description}"="${Support_Description_Value}"
az network public-ip create -n "${Public_IP_04}" -g "${RG_FULL_NAME}" -l "${Location_Region}" --zone "${IP_Zone}" --allocation-method "${AlLocation}" --sku "${SKU_IP}" --tier "${Tier_IP}" --tags "${Description}"="${Value_Description}" "${Cost_Center}"="${Cost_Center_Value}" "${Support_Description_Description}"="${Support_Description_Value}"

##Criando Azure Firewall
az network firewall create -g "${RG_FULL_NAME}" -n "${Name_RG_02}" --sku "${SKU}" --tier "${TIER}" -z "1" --threat-intel-mode "Alert"

##Associando IP Publico Azure Firewall
az network firewall ip-config create --firewall-name "${Name_RG_02}" --name "${NameIP_01}" --public-ip-address "${Public_IP_02}" -g "${RG_FULL_NAME}" --vnet-name "${Vnet_FULL_Name}"
az network firewall ip-config create --firewall-name "${Name_RG_02}" --name "${NameIP_02}" --public-ip-address "${Public_IP_03}" -g "${RG_FULL_NAME}"
az network firewall ip-config create --firewall-name "${Name_RG_02}" --name "${NameIP_03}" --public-ip-address "${Public_IP_04}" -g "${RG_FULL_NAME}"

###Declarando Variaveis para utilizar IP privado do Azure Firewall
fwprivaddr01="$(az network firewall ip-config list -g "${RG_FULL_NAME}" -f "${Name_RG_02}" --query "[?name=='ifconfig1'].privateIpAddress" --output tsv)"
fwprivaddr02="$(az network public-ip show -g "${RG_FULL_NAME}" -n "${Public_IP_03}" --query "{address: ipAddress}" --output tsv)"
fwprivaddr03="$(az network public-ip show -g "${RG_FULL_NAME}" -n "${Public_IP_04}" --query "{address: ipAddress}" --output tsv)"

###Crando Route Table
az network route-table create -n "${RT_Name02}" -g "${RG_FULL_NAME}" -l "${Location_Region}" --disable-bgp-route-propagation "true"

###Associando Route Table a Subnet
az network vnet subnet update -n "${SubnetName03}" -g "${RG_FULL_NAME}" --vnet-name "${Vnet_FULL_Name}" --address-prefixes "${Prefix03}" --route-table "${RT_Name02}"

###Criando Static Route
az network route-table route create -g "${RG_FULL_NAME}" --name "${RT_Name03}" --route-table-name "${RT_Name02}" --address-prefix "${Prefix_Address01}" --next-hop-type "VirtualAppliance" --next-hop-ip-address $fwprivaddr01

###Criando regra de NAT para acessar uma VM com IP interno 10.255.2.4
az network firewall nat-rule create --collection-name "${Collection_Name}" \
--dest-addr "$fwprivaddr02" --destination-ports "22" --firewall-name "${Name_RG_02}" \
--name "nat-ssh-vm01" --protocols "tcp" -g "${RG_FULL_NAME}" --translated-port "22" \
--action "Dnat" --description "Acesso a VM01" --priority "200" \
--source-addresses "179.xxx.182.42/32" --translated-address "10.225.2.4"

###Criando regra de NAT para acessar uma VM com IP interno 10.255.2.5
az network firewall nat-rule create --collection-name "${Collection_Name02}" \
--dest-addr "$fwprivaddr03" --destination-ports "22" --firewall-name "${Name_RG_02}" \
--name "nat-rdp-vm02" --protocols "tcp" -g "${RG_FULL_NAME}" --translated-port "3389" \
--action "Dnat" --description "Acesso a VM02" --priority "201" \
--source-addresses "179.xxx.182.42/32" --translated-address "10.225.2.5"

###Criando Regras de acesso para Internet (somente HTTP/HTTPs)
az network firewall network-rule create --collection-name "${Colletion_Name_Internet}" \
--destination-ports "80" "443" --firewall-name "${Name_RG_02}" --name "Acesso a Internet" \
--protocols "tcp" --resource-group "${RG_FULL_NAME}" --action "Allow" \
--description "Acesso a Internet rede 10.225.2.0/24" --dest-addr "0.0.0.0/0" \
--priority "200" --source-addresses "10.225.2.0/24" 

###Fim do script

Vemos a VM Windows

Vemos a VM Linux

Agora vemos o NAT OutBound para acesso a internet

Windows (mesmo IP cadastrado no Firewall)

Linux (mesmo IP cadastrado no Firewall)

Em cima desta topologia podemos criar varias Vnets com peering e fazer do azure firewall nossa BORDA (EDGE), tudo contralado em um só lugar.

Seja Feliz!!!!

Azure Private DNS Zone e Vnet (bash/cli)

Neste post vou demonstrar a utilização do recurso Azure “Zone DNS Private”.
Ele pode ser utilizando para substituir uma VM que seria utilizada como DNS.

Vamos a nossa topologia:

Neste cenário teremos os seguintes objetos:

3x Virtuais Networks
1x Zona DNS Privada

Vamos a nosso script

#!/bin/bash

##Declarando variaveis
export Subscription_Name="XXXXXXXXXXX" ##Insira aqui sua subscription Azure
export RG_Name01="rg"
export RG_Name02="lab"
export RG_Name03="private"
export RG_Name04="dns"
export Location="brazilsouth"
export Environment="shared"
export RG_Name_FULL="${RG_Name01}"-"${RG_Name02}"-"${RG_Name03}"-"${RG_Name04}"-"${Environment}"-"${Location}"

##Variaveis de Objetos
export Zone_01="glbx.corp"
export LinkName01="link"
export LinkName02="zone-dns-private"
export LinkName_FULL="${Vnet_Name_FULL}"

###Declarando Variaveis Tags
export Description="Departamento"
export Value_Description="Redes/Telecom/Segurança/Infraestrutura"
export Cost_Center="Centro de Custo"
export Cost_Center_Value="Redes/Telecom/Segurança/Infraestrutura"
export Support_Description_Description="E-mail Suporte"
export Support_Description_Value="[email protected]"

###Declarando Variaveis de Rede (Vnet1)
export Vnet_Name01="vnet1"
export Vnet_Name_FULL1="${Vnet_Name01}"-"${RG_Name02}"-"${RG_Name03}"-"${RG_Name04}"-"${Environment}"-"${Location}"
export CIDR1="10.128.10.0/24"
export SubName1_01="snet"-"${RG_Name02}"-"${RG_Name03}"-"${RG_Name04}"-"${Environment}"-"${Location}"1
export SubName1_02="snet"-"${RG_Name02}"-"${RG_Name03}"-"${RG_Name04}"-"${Environment}"-"${Location}"2
export SubName1_03="snet"-"${RG_Name02}"-"${RG_Name03}"-"${RG_Name04}"-"${Environment}"-"${Location}"3
export SubName1_04="snet"-"${RG_Name02}"-"${RG_Name03}"-"${RG_Name04}"-"${Environment}"-"${Location}"4
export prefix1_01="10.128.10.0/26"
export prefix1_02="10.128.10.64/26"
export prefix1_03="10.128.10.128/26"
export prefix1_04="10.128.10.192/26"

###Declarando Variaveis de Rede (Vnet2)
export Vnet_Name02="vnet2"
export Vnet_Name_FULL2="${Vnet_Name02}"-"${RG_Name02}"-"${RG_Name03}"-"${RG_Name04}"-"${Environment}"-"${Location}"
export CIDR2="10.128.20.0/24"
export SubName2_01="snet"-"${RG_Name02}"-"${RG_Name03}"-"${RG_Name04}"-"${Environment}"-"${Location}"1
export SubName2_02="snet"-"${RG_Name02}"-"${RG_Name03}"-"${RG_Name04}"-"${Environment}"-"${Location}"2
export SubName2_03="snet"-"${RG_Name02}"-"${RG_Name03}"-"${RG_Name04}"-"${Environment}"-"${Location}"3
export SubName2_04="snet"-"${RG_Name02}"-"${RG_Name03}"-"${RG_Name04}"-"${Environment}"-"${Location}"4
export prefix2_01="10.128.20.0/26"
export prefix2_02="10.128.20.64/26"
export prefix2_03="10.128.20.128/26"
export prefix2_04="10.128.20.192/26"

###Declarando Variaveis de Rede (Vnet3)
export Vnet_Name03="vnet3"
export Vnet_Name_FULL3="${Vnet_Name03}"-"${RG_Name02}"-"${RG_Name03}"-"${RG_Name04}"-"${Environment}"-"${Location}"
export CIDR3="10.128.30.0/24"
export SubName3_01="snet"-"${RG_Name02}"-"${RG_Name03}"-"${RG_Name04}"-"${Environment}"-"${Location}"1
export SubName3_02="snet"-"${RG_Name02}"-"${RG_Name03}"-"${RG_Name04}"-"${Environment}"-"${Location}"2
export SubName3_03="snet"-"${RG_Name02}"-"${RG_Name03}"-"${RG_Name04}"-"${Environment}"-"${Location}"3
export SubName3_04="snet"-"${RG_Name02}"-"${RG_Name03}"-"${RG_Name04}"-"${Environment}"-"${Location}"4
export prefix3_01="10.128.30.0/26"
export prefix3_02="10.128.30.64/26"
export prefix3_03="10.128.30.128/26"
export prefix3_04="10.128.30.192/26"

###Variaveis de Peering
export Peering_01="peering"
export Peering_02="vnet"
export Peering_Name="${Peering_01}"-"${Peering_02}"

###Selecionar subscription
az account set --subscription "${Subscription_Name}"

##Criando RG
az group create -l "${Location}" -n "${RG_Name_FULL}" --tags "${Description}"="${Value_Description}" "${Cost_Center}"="${Cost_Center_Value}" "${Support_Description_Description}"="${Support_Description_Value}"

####Criando Virtual Network (Vnet)
az network vnet create -g "${RG_Name_FULL}" -n "${Vnet_Name_FULL1}" --address-prefix "${CIDR1}" -l "${Location}" --tags "${Description}"="${Value_Description}" "${Cost_Center}"="${Cost_Center_Value}" "${Support_Description_Description}"="${Support_Description_Value}"
az network vnet create -g "${RG_Name_FULL}" -n "${Vnet_Name_FULL2}" --address-prefix "${CIDR2}" -l "${Location}" --tags "${Description}"="${Value_Description}" "${Cost_Center}"="${Cost_Center_Value}" "${Support_Description_Description}"="${Support_Description_Value}"
az network vnet create -g "${RG_Name_FULL}" -n "${Vnet_Name_FULL3}" --address-prefix "${CIDR3}" -l "${Location}" --tags "${Description}"="${Value_Description}" "${Cost_Center}"="${Cost_Center_Value}" "${Support_Description_Description}"="${Support_Description_Value}"

####Criando Subnet
az network vnet subnet create -g "${RG_Name_FULL}" --vnet-name "${Vnet_Name_FULL1}" -n "${SubName1_01}" --address-prefixes "${prefix1_01}"
az network vnet subnet create -g "${RG_Name_FULL}" --vnet-name "${Vnet_Name_FULL1}" -n "${SubName1_02}" --address-prefixes "${prefix1_02}"
az network vnet subnet create -g "${RG_Name_FULL}" --vnet-name "${Vnet_Name_FULL1}" -n "${SubName1_03}" --address-prefixes "${prefix1_03}"
az network vnet subnet create -g "${RG_Name_FULL}" --vnet-name "${Vnet_Name_FULL1}" -n "${SubName1_04}" --address-prefixes "${prefix1_04}"
az network vnet subnet create -g "${RG_Name_FULL}" --vnet-name "${Vnet_Name_FULL2}" -n "${SubName2_01}" --address-prefixes "${prefix2_01}"
az network vnet subnet create -g "${RG_Name_FULL}" --vnet-name "${Vnet_Name_FULL2}" -n "${SubName2_02}" --address-prefixes "${prefix2_02}"
az network vnet subnet create -g "${RG_Name_FULL}" --vnet-name "${Vnet_Name_FULL2}" -n "${SubName2_03}" --address-prefixes "${prefix2_03}"
az network vnet subnet create -g "${RG_Name_FULL}" --vnet-name "${Vnet_Name_FULL2}" -n "${SubName2_04}" --address-prefixes "${prefix2_04}"
az network vnet subnet create -g "${RG_Name_FULL}" --vnet-name "${Vnet_Name_FULL3}" -n "${SubName3_01}" --address-prefixes "${prefix3_01}"
az network vnet subnet create -g "${RG_Name_FULL}" --vnet-name "${Vnet_Name_FULL3}" -n "${SubName3_02}" --address-prefixes "${prefix3_02}"
az network vnet subnet create -g "${RG_Name_FULL}" --vnet-name "${Vnet_Name_FULL3}" -n "${SubName3_03}" --address-prefixes "${prefix3_03}"
az network vnet subnet create -g "${RG_Name_FULL}" --vnet-name "${Vnet_Name_FULL3}" -n "${SubName3_04}" --address-prefixes "${prefix3_04}"

#Criando Peering entre as Vnets

##Peering entre vnet1 e vnet2
az network vnet peering create -g "${RG_Name_FULL}" -n "${Peering_Name}"-"${Vnet_Name_FULL2}" --vnet-name "${Vnet_Name_FULL1}" --remote-vnet "${Vnet_Name_FULL2}" --allow-vnet-access --allow-forwarded-traffic --allow-gateway-transit --allow-vnet-access
az network vnet peering create -g "${RG_Name_FULL}" -n "${Peering_Name}"-"${Vnet_Name_FULL1}" --vnet-name "${Vnet_Name_FULL2}" --remote-vnet "${Vnet_Name_FULL1}" --allow-vnet-access --allow-forwarded-traffic --allow-gateway-transit --allow-vnet-access

##Peering entre vnet1 e vnet3
az network vnet peering create -g "${RG_Name_FULL}" -n "${Peering_Name}"-"${Vnet_Name_FULL3}" --vnet-name "${Vnet_Name_FULL1}" --remote-vnet "${Vnet_Name_FULL3}" --allow-vnet-access --allow-forwarded-traffic --allow-gateway-transit --allow-vnet-access
az network vnet peering create -g "${RG_Name_FULL}" -n "${Peering_Name}"-"${Vnet_Name_FULL1}" --vnet-name "${Vnet_Name_FULL3}" --remote-vnet "${Vnet_Name_FULL1}" --allow-vnet-access --allow-forwarded-traffic --allow-gateway-transit --allow-vnet-access

##Peering entre vnet2 e vnet3
az network vnet peering create -g "${RG_Name_FULL}" -n "${Peering_Name}"-"${Vnet_Name_FULL3}" --vnet-name "${Vnet_Name_FULL3}" --remote-vnet "${Vnet_Name_FULL2}" --allow-vnet-access --allow-forwarded-traffic --allow-gateway-transit --allow-vnet-access
az network vnet peering create -g "${RG_Name_FULL}" -n "${Peering_Name}"-"${Vnet_Name_FULL2}" --vnet-name "${Vnet_Name_FULL2}" --remote-vnet "${Vnet_Name_FULL3}" --allow-vnet-access --allow-forwarded-traffic --allow-gateway-transit --allow-vnet-access

###Criando Zone DNS Privada
az network private-dns zone create -g "${RG_Name_FULL}" -n "${Zone_01}" --tags "${Description}"="${Value_Description}" "${Cost_Center}"="${Cost_Center_Value}" "${Support_Description_Description}"="${Support_Description_Value}"

###criando entradas "." apontando para nossos ADs (Active Directory)
az network private-dns record-set a add-record -g "${RG_Name_FULL}" -z "${Zone_01}" -n "@" -a 10.128.10.4
az network private-dns record-set a add-record -g "${RG_Name_FULL}" -z "${Zone_01}" -n "@" -a 10.128.20.4
az network private-dns record-set a add-record -g "${RG_Name_FULL}" -z "${Zone_01}" -n "@" -a 10.128.30.4
az network private-dns record-set a add-record -g "${RG_Name_FULL}" -z "${Zone_01}" -n "VMAD01" -a 10.128.10.4
az network private-dns record-set a add-record -g "${RG_Name_FULL}" -z "${Zone_01}" -n "VMAD02" -a 10.128.20.4
az network private-dns record-set a add-record -g "${RG_Name_FULL}" -z "${Zone_01}" -n "VMAD03" -a 10.128.30.4

###Variavels para pegar ID da Vnet para vincular com Zone Private DNS Azure
SUBNET_ID001=$(az network vnet show -n "${Vnet_Name_FULL1}" -g "${RG_Name_FULL}" --query id --output tsv)
SUBNET_ID002=$(az network vnet show -n "${Vnet_Name_FULL2}" -g "${RG_Name_FULL}" --query id --output tsv)
SUBNET_ID003=$(az network vnet show -n "${Vnet_Name_FULL3}" -g "${RG_Name_FULL}" --query id --output tsv)

###Criando link de zona dns privada com vnet
az network private-dns link vnet create -g "${RG_Name_FULL}" -n "${LinkName_FULL}"-"${Vnet_Name_FULL1}" -z "${Zone_01}" -v $SUBNET_ID001 -e False
az network private-dns link vnet create -g "${RG_Name_FULL}" -n "${LinkName_FULL}"-"${Vnet_Name_FULL2}" -z "${Zone_01}" -v $SUBNET_ID002 -e False
az network private-dns link vnet create -g "${RG_Name_FULL}" -n "${LinkName_FULL}"-"${Vnet_Name_FULL3}" -z "${Zone_01}" -v $SUBNET_ID003 -e False

###Criando entradas em zona dns privada
az network private-dns record-set a add-record -g "${RG_Name_FULL}" -z "${Zone_01}" -n "intranet" -a 10.128.10.10
az network private-dns record-set a add-record -g "${RG_Name_FULL}" -z "${Zone_01}" -n "site6" -a 10.128.20.10
az network private-dns record-set a add-record -g "${RG_Name_FULL}" -z "${Zone_01}" -n "portalrh" -a 10.128.30.10

Vamos a expliação

Zona de DNS Privada

Neste objeto nos teremos a seguinte zona privada “glbx.corp” nosso fqdn do nosso dominio

Virtual Networks (Não alteramos o DNS da Vnet)

Neste teremos 3x Virtuais Network em nosso ambientes
vnet1-lab-private-dns-shared-brazilsouth = 10.128.10.0/24
vnet2-lab-private-dns-shared-brazilsouth = 10.128.20.0/24
vnet3-lab-private-dns-shared-brazilsouth = 10.128.30.0/24

Dentro de nossa zona “glbx.corp” teremos as seguintes entradas

@ 10.128.10.4 (AD)
@ 10.128.20.4 (AD)
@ 10.128.30.4 (AD)

NomeTipoTTLValor
@A30010.128.10.4
@A30010.128.20.4
@A30010.128.30.4
intranetA360010.128.10.10
portalrhA360010.128.20.10
site6A360010.128.30.10

Teremos “Peering” entre as “Vnet” (Não utilizei um firewall para ficar mais facil a explicação), o peering server para as vnets se falarem (desta forma, teram que fazer a segurança vai NSG).

Em cada Vnet temos algumas Virtuais Machines (não esta no desenho)
VMAD01 10.128.10.4
VMAD02 10.128.20.4
VMAD03 10.128.30.4
VMINTRANET 10.128.10.10
VMRH01 10.128.20.10
VMSITE6 10.128.30.10

Pronto, com nosso ambiente criada nossas VMs/Endpoint conseguem resolver nomes utilizando o DNS do Azure com nossa Zona de DNS Privada, veja como ficou:

Veja que resolve nosso dominio para os servidores certos

Veja que resolve as entradas criadas


***Para que na sua infraestrutura funcione a utlização de “Azure DNS Private” você não pode esquecer de criar os Links da Zona Privada com sua Vnet.

Links de referencias

https://docs.microsoft.com/en-us/azure/dns/private-dns-overview

DEPLOY Fortigate HA AZURE CLI (BASH) TEMPLATE ARM

Neste post iremos fazer o deploy de Fortigate (Version 7) em HA (Active/Passive) “Load Balance (ELB/ILB)”, utilizando um template modificado fornecido pela prória fortigate (adequado as preferencias para este artigo de exemplo).
Nesta topologia/arquitetura de rede colocamos o Fortigate EDGE para ser a rota default de todas as nossas vnets que estão no azure, com isso toda entrada ou saida de dados passa obrigatóriamente pelo Fortigate EDGE, essa arquitetura não esta certa nem errada, tudo vai depender do compliance de cada empresa, time de segurança, time de rede e claro do orçamento de cada um. Lembra muito o artigo que escrevi sobre Palo Alto

No final vou deixar os arquivos para download e algumas explicações sobre os arquivos .json

Uma breve explicação.

Vamos aos objetos criados no azure

Resource Group
rg-fw-edge-shared-brazilsouth

NAMETYPELOCATION
fwedge01_OsDisk_1_8e3e21f33b774e919ba304a2ec8a3b62DiskBrazil South
fwedge01_disk2_5e1d09faa5fa446eb56329f30ce3ff51DiskBrazil South
fwedge02_OsDisk_1_cbedf98d06474b009df9c9c13b972f55DiskBrazil South
fwedge02_disk2_c8449694114e4b849123c6f93103624fDiskBrazil South
elb-fwedge-01Load balancerBrazil South
ilb-fwedge-01Load balancerBrazil South
int-fwedge01-eth0Network interfaceBrazil South
int-fwedge01-eth1Network interfaceBrazil South
int-fwedge01-eth2Network interfaceBrazil South
int-fwedge01-eth3Network interfaceBrazil South
int-fwedge02-eth0Network interfaceBrazil South
int-fwedge02-eth1Network interfaceBrazil South
int-fwedge02-eth2Network interfaceBrazil South
int-fwedge02-eth3Network interfaceBrazil South
nsg-fwedge-sharedbrazilsouthNetwork security groupBrazil South
pip-fwedge-mgmt-aPublic IP addressBrazil South
pip-fwedge-mgmt-bPublic IP addressBrazil South
pip-lb-external-fwedge-01Public IP addressBrazil South
rt-fw-edge-shared-brazilsouthRoute tableBrazil South
fwedge01Virtual machineBrazil South
fwedge02Virtual machineBrazil South
vnet-fwedge-shared-brazilsouthVirtual networkBrazil South

Discos

Temos dois discos em cada Fortigate VM:
DiskOS 2GB SSD Premium
DiskDATA 30GB SSD Premium

Teremos uma VNET “vnet-fwedge-shared-brazilsouth” com as seguintes subnets (snets)

NameCIDR
snet-fwedge-shared-brazilsouth-External10.126.0.0/27
snet-fwedge-shared-brazilsouth-Internal10.126.0.32/27
snet-fwedge-shared-brazilsouth-HASync10.126.0.64/27
snet-fwedge-shared-brazilsouth-Management10.126.0.96/27
snet-fwedge-shared-brazilsouth-Protected10.126.0.128/27
snet-fwedge-shared-brazilsouth-LoadBalance10.126.0.160/27

Temos 4 interfaces de rede para cada VM

Interface NameVM AttachSnet NameIP IntCIDR
int-fwedge01-eth0fwedge01snet-fwedge-shared-brazilsouth-External10.126.0.510.126.0.0/27
int-fwedge01-eth1fwedge01snet-fwedge-shared-brazilsouth-Internal10.126.0.3710.126.0.32/27
int-fwedge01-eth2fwedge01snet-fwedge-shared-brazilsouth-HASync10.126.0.6910.126.0.64/27
int-fwedge01-eth3fwedge01snet-fwedge-shared-brazilsouth-Management10.126.0.10110.126.0.96/27
int-fwedge02-eth0fwedge02snet-fwedge-shared-brazilsouth-External10.126.0.610.126.0.0/27
int-fwedge02-eth0fwedge02snet-fwedge-shared-brazilsouth-Internal10.126.0.3810.126.0.32/27
int-fwedge02-eth0fwedge02snet-fwedge-shared-brazilsouth-HASync10.126.0.7010.126.0.64/27
int-fwedge02-eth0fwedge02snet-fwedge-shared-brazilsouth-Management10.126.0.10210.126.0.96/27

Temos dois Load Balances

1x Internal Load Balance (ilb-fwedge-01) IP: 10.126.0.190
1x External Load Balance (elb-fwedge-01) IP: XXX.XXX.XXX.XXX

Temos 1 NSG (Network Security Group) (snet-fwedge-shared-brazilsouth-03 “Management”)

1x “nsg-fwedge-shared-brazilsouth-mgmt” com as seguintes regras

Allow-MGMT-HTTPS/SSH
Source: XXX.XXX.XXX.XXX/XX (IP ou IPs de origem que podem se conectar na interface MGMT)
Destination: 10.126.0.96/24 (Rede de gerencia MGMT)

Temos 3 IPs Publicos

pip-fwedge-mgmt-a (Management Fortigate A)
pip-fwedge-mgmt-b (Management Fortigate B)
pip-lb-external-fwedge-01 (IP Publico External Load Balance)

Temos 2 Virtual Machines

fwedge01 (Standard_F8s – 8vCPUs, 16 GB Memory)
fwedge02 (Standard_F8s – 8vCPUs, 16 GB Memory)

Temos um arquivo de Route Table “rt-fw-edge-shared-brazilsouth”, nele temos as seguintes rotas:

NameCIDRNext Hop typeNext Hop IP address
DefaultRoute0.0.0.0/0VirtualAppliance10.126.0.190

Agora vamos ao nosso script

#!/bin/bash
##Declarando variaveis

##Declarando Variaveis (Obrigatório)
export Subscription_Name="XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" ##inserir sua Subscription Azure
export RG_Name02="rg-fw-edge-shared-brazilsouth"
export Location_Region="brazilsouth"

###Script
###Selecionar subscription
az account set --subscription "${Subscription_Name}"

##Criando RG
az group create -n "${RG_Name02}" -l "${Location_Region}"

##Deploy Fortigate Template
az deployment group create -g "${RG_Name02}" --template-file template.json --parameters @parametersFile.json

##Desligando VMs
az vm stop -g "${RG_Name02}" -n "fwedge01"
az vm stop -g "${RG_Name02}" -n "fwedge02"

##Deallocate
az vm deallocate -g "${RG_Name02}" -n "fwedge01"
az vm deallocate -g "${RG_Name02}" -n "fwedge02"

###Criando Storage Accout (Para boot diag)
az storage account create -g "${RG_Name02}" -n "stgdiagfwedgefgt01" -l "${Location_Region}" --sku "Standard_LRS"

##Criando Snet Internal Load Balance (Subnet para load balance interno)
az network vnet subnet create -g "${RG_Name02}" --vnet-name "vnet-fwedge-shared-brazilsouth" -n "snet-fwedge-shared-brazilsouth-LoadBalance" --address-prefixes "10.126.0.160/27"

##alterando IP Internal Load Balance
az network lb frontend-ip update -g "${RG_Name02}" --lb-name "ilb-fwedge-01" -n "frontend-fwedge-internal-01" --vnet-name "vnet-fwedge-shared-brazilsouth" --subnet "snet-fwedge-shared-brazilsouth-LoadBalance" --private-ip-address "10.126.0.190"

###Habilitando Boot dioag VM01/02
az vm boot-diagnostics enable -n "fwedge01" -g "${RG_Name02}" --storage "stgdiagfwedgefgt01" 
az vm boot-diagnostics enable -n "fwedge02" -g "${RG_Name02}" --storage "stgdiagfwedgefgt01" 

##Fixando IP eht0 (VM01/02)
az network nic ip-config update -g "${RG_Name02}" --nic-name "int-fwedge01-eth0" -n "ipconfig1" --private-ip-address "10.126.0.5"
az network nic ip-config update -g "${RG_Name02}" --nic-name "int-fwedge02-eth0" -n "ipconfig1" --private-ip-address "10.126.0.6"

###Fixando IP eth1 (VM01/02)
az network nic ip-config update -g "${RG_Name02}" --nic-name "int-fwedge01-eth1" -n "ipconfig1" --private-ip-address "10.126.0.37"
az network nic ip-config update -g "${RG_Name02}" --nic-name "int-fwedge02-eth1" -n "ipconfig1" --private-ip-address "10.126.0.38"

###Fixando IP eth2 (VM01/02)
az network nic ip-config update -g "${RG_Name02}" --nic-name "int-fwedge01-eth2" -n "ipconfig1" --private-ip-address "10.126.0.69"
az network nic ip-config update -g "${RG_Name02}" --nic-name "int-fwedge02-eth2" -n "ipconfig1" --private-ip-address "10.126.0.70"

###Fixando IP eth3 (VM01/02)
az network nic ip-config update -g "${RG_Name02}" --nic-name "int-fwedge01-eth3" -n "ipconfig1" --private-ip-address "10.126.0.101"
az network nic ip-config update -g "${RG_Name02}" --nic-name "int-fwedge02-eth3" -n "ipconfig1" --private-ip-address "10.126.0.102"

###Anexando NSG MGMT a snet mgmt 
az network vnet subnet update -g "${RG_Name02}" -n "snet-fwedge-shared-brazilsouth-Management" --vnet-name "vnet-fwedge-shared-brazilsouth" --network-security-group "nsg-fwedge-shared-brazilsouth-mgmt"

###Deletando regras existentes (criadas pelo templete, pode-se alterar diretamente no template tb)
az network nsg rule delete -g "${RG_Name02}" --nsg-name "nsg-fwedge-shared-brazilsouth-mgmt" -n "AllowAllInbound"
az network nsg rule delete -g "${RG_Name02}" --nsg-name "nsg-fwedge-shared-brazilsouth-mgmt" -n "AllowAllOutbound"

##Criando regras NSG MGMT HTTPS
az network nsg rule create -g "${RG_Name02}" --nsg-name "nsg-fwedge-shared-brazilsouth-mgmt" -n "Allow-MGMT-HTTPS" --priority "100" \
--source-address-prefixes "179.215.182.42/32" --source-port-ranges "*" \
--destination-address-prefixes "10.126.0.96/27" --destination-port-ranges "443" --access "Allow" \
--protocol "TCP" --description "Acesso liberado a snet management"

##Alterando regras NSG MGMT SSH
az network nsg rule create -g "${RG_Name02}" --nsg-name "nsg-fwedge-shared-brazilsouth-mgmt" -n "Allow-MGMT-SSH" --priority "101" \
--source-address-prefixes "179.215.182.42/32" --source-port-ranges "*" \
--destination-address-prefixes "10.126.0.96/27" --destination-port-ranges "22" --access "Allow" \
--protocol "TCP" --description "Acesso liberado a snet management"

###Anexando Subnet Internal a Route Table
az network vnet subnet update -g "${RG_Name02}" -n "snet-fwedge-shared-brazilsouth-Internal" --vnet-name "vnet-fwedge-shared-brazilsouth" --route-table "rt-fw-edge-shared-brazilsouth-internal" 

###Inciando as VM01/02
az vm start -g "${RG_Name02}" -n "fwedge01"
az vm start -g "${RG_Name02}" -n "fwedge02"

Agora tudo pronto, vamos acessar nosso FGT, iremos acesso pelo IP Publico “pip-fwedge-mgmt-a”

Entre com usuário e senha que contas no template

Vamos as configurações iniciais

Clique em “Begin”
Clique em “ok”
Clique e “ok”

Temos nosso Dashbord inicial

Vamos verificar nosso HA Sync

Vamos em System / HA

Tudo certo

Vamos agora em “Network” “Static Routes”

Por padrão teremos essas rotas (Isso pode ser editado/alterado no template)

Vamos fazer algumas modificações e deixar desta forma

Basicamente, iremos remover a rota “168.63.129.16/32” “10.126.0.1” “port1”

Ficará desta forma

Toda e qualquer nova rede que for criar e for feito peering com a rede do Firewall-EDGE 10.126.0.0/24 teremos que criar a “Static Route”

Vamos a um exemplo, em nosso ambiente azure temos a Vnet “10.188.0.0/24”, iremos fazer um peering com ela e add route static no FGT.

Sempre usaremos a port2, pois ela é nossa “LAN-Trust”, o gw 10.126.0.33 é o gw do azure (já expliquei em outros posts como funciona a rede no azure, que ele guarda para si os 3 primeiros IP de cada subnet)
Agora nossa Static Route ficará desta forma

Vamos agora criar um regra de acesso a internet
“Policy & Objects” “Firewall Policy”

Create New

Clique em “ok”

Agora nos temos uma regra que vem da nossa interface “LAN-Trust” para a nossa interface “WAN-UnTrust”

Agora vamos add essa vnet/subnet ao nosso Route Table

Assim ficou nosso arquivo

**(Esta vnet tem que possui peering com nossa rede do firewall edge)

Vamos ao teste

Criamos a seguinte vm “vm-lan-trust-01”
subnet 10.188.0.0/26
IP: 10.188.0.4

Estamos dentro da nossa VM Trust

vamos fazer um teste de curl para http//ifconfig.me e monitor em nosso firewall

Como podem ver em nossa VM Trust, trouxe o IP da interface WAN-UnTrust e todo trafego passou pelo nossa firewall

Agora um outro cenário, temos parceiros/clientes que precisam acessar nossas aplicações ou um ambiente de “Transfer” (Connect Direct IBM, SFTP, FTPS, SMB) para isso acontecer de forma segura podemos estabelecer Tuneis IPSec com nossas Parceiros/Clientes e desta forma liberar o acesso de forma segura.
Outra cenario seria a publicação de uma aplicação interna e expo-la para internet, temos varias possibilidade de forma segura em nossa ambiente.

Agora algumas explicações referente aos .json

Linha 5/6: usuário de acesso ao firewall
Linha 8/9: senha
Linha 12: prefixo do firewall
Linha 15: versão do licenciamento, neste exemplo seria PayAsGo (Pague pelo uso, se vc possui BYOL, altere para o valor que consta no template)
Linha 18: ultima versão do firmware
Linha 21: Size VM
Linha 36: nome do IP Publico do External LB
Linha 39: RG
Linha 42: IP Publico MGMT FGT A
Linha 45: RG
Linha 48: IP Publico MGMT FGT B
Linha 51: RG

Continuando

Linha 57: nome da vnet (o proprio template cria a vnet)
Linha 60: RG
Linha 63: CIDR da Vnet
Linha 66: Nome da Vnet External
Linha 69: CIDR da Subnet External

As outras são auto explicativas

***Nunca esquecer de add Static Route em nosso firewall, sempre add as subnet no arquivo Route Table, sempre fazer peering para novas Vnets.

Link para download

Seja Feliz!!!!!!!!!!!!!!!!!

Criando Web Site com alta disponibilidade Azure CLI (Bash)

Neste artigo iremos criar Web Site em alta disponibilidade, composto por duas VM Windows Server 2019 com IIS habilitado e um load balance, não iremos abordar aqui segurança como Application Gateway, WAF, API MAN, etc. Este artigo visa somente a criação via scritp de toda a infraestrutura (também não iremos abordar o deploy de qualquer aplicação neste artigo).

#!/bin/bash

##Declarando Variaveis (Obrigatório)

export Subscription_Name=”Santana-Corp”
export RG_Name=”WEBSERVER-PRD-EAST”
export Location=”eastus”
export Object_Name=”WEBSERVER”

##Storage Accout

export Storage=”stgdiag${Object_Name,,}”
export SKU_Storage=”Standard_LRS” ##Exemplo Standard_LRS##

##Grupo de Disponibiliade Availability Set

export Name_AV_SET=”AV-SET”-“${Object_Name}”

##Network Security Group NSG

export NSG_Name=”NSG”-“${Object_Name}”
export Fault_Domain=”3″
export Update_Domain=”20″
export Rule01=”HTTP”
export Rule02=”HTTPS”

##Vnet Existente (Variaveis para utilizar Vnet Existente)

export RG_Vnet=”Resource Group da Vnet existente”
export Subnet_Name=”Subnet da Vnet existente”
export Vnet_Name=”Vnet existente”

##Variaveis de Rede (Obrigatório)

export NIC_Name1=”NIC”-“${Object_Name}”1
export NIC_Name2=”NIC”-“${Object_Name}”2
export Accelerated=”False”
export PublicIP=”PUBLIC-IP”-“${Object_Name}”
export PublicIP_Method=”Static”
export ELB_Name=”ELB”-“${Object_Name}”
export SKU=”Basic”
export Frontend_Name=”FE”-“${Object_Name}”
export BackendPool_Name=”BEP”-“${Object_Name}”
export ProbeName01=”Probe-http”
export ProbeName02=”Probe-https”
export Protocol01=”tcp”
export Port01=”80″
export Port02=”443″

##Variavel para criacao da VM (Obrigatório)

export Image_SO=”Win2019Datacenter”
export VM_Name1=”VM”-“${Object_Name}”1
export VM_Name2=”VM”-“${Object_Name}”2
export User_Name=”azroot”
export PWD=”#[email protected]#”
export Size=”Standard_D2S_v3″
export SKU_STG=”Standard_LRS” ## Disco ##
export DiskName_01=”DISK”-“${Object_Name}”01
export DiskName_02=”DISK”-“${Object_Name}”02
export SizeDisk_01=”256″
export SizeDisk_02=”512″
export Disk_Data01=”DISK-DATA”-“${Object_Name}”1
export Disk_Data02=”DISK-DATA”-“${Object_Name}”2

##Variaveis TAGs (Não Obrigatório)

export Costacenter=”Centro de Custos”
export Value_Costcenter=”111245″
export Environment=”Environment”
export Environment_Value=”Produção”
export Depto=”Departamento”
export Depto_Value=”Recursos Humanos”

###Execução do Script

###Selecionar subscription

az account set –subscription “${Subscription_Name}”

###Criando Resource Group

az group create -n “${RG_Name}” -l “${Location}” –tags “${Costacenter}”=”${Value_Costcenter}” “${Environment}”=”${Environment_Value}” “${Depto}”=”${Depto_Value}”

###Criando Storage Accout

az storage account create -g “${RG_Name}” -n “${Storage}” -l “${Location}” –sku “${SKU_Storage}” –tags “${Costacenter}”=”${Value_Costcenter}” “${Environment}”=”${Environment_Value}” “${Depto}”=”${Depto_Value}”

###Criano IP Publico

az network public-ip create -g “${RG_Name}” -n “${PublicIP}” -l “${Location}” –allocation-method “${PublicIP_Method}” –tags “${Costacenter}”=”${Value_Costcenter}” “${Environment}”=”${Environment_Value}” “${Depto}”=”${Depto_Value}”

###Criando Network Security Group NSG

az network nsg create -g “${RG_Name}” -n “${NSG_Name}” -l “${Location}” –tags “${Costacenter}”=”${Value_Costcenter}” “${Environment}”=”${Environment_Value}” “${Depto}”=”${Depto_Value}”

###Criar regras NSG

az network nsg rule create -g “${RG_Name}” –nsg-name “${NSG_Name}” -n “${Rule01}” –protocol tcp –priority 100 –source-address-prefixes 0.0.0.0/0 –destination-port-range 80 –access allow
az network nsg rule create -g “${RG_Name}” –nsg-name “${NSG_Name}” -n “${Rule02}” –protocol tcp –priority 101 –source-address-prefixes 0.0.0.0/0 –destination-port-range 443 –access allow

###Criar Grupo de Disponibilidade

az vm availability-set create -g “${RG_Name}” -n “${Name_AV_SET}” –platform-fault-domain-count “${Fault_Domain}” –platform-update-domain-count “${Update_Domain}” -l “${Location}” –tags “${Costacenter}”=”${Value_Costcenter}” “${Environment}”=”${Environment_Value}” “${Depto}”=”${Depto_Value}”

###Declarando varivel para utilizar Vnet existente (Obrigatório)

SUBNET_ID001=$(az network vnet subnet show –name “${Subnet_Name}” –vnet-name “${Vnet_Name}” -g “${RG_Vnet}” –query id –output tsv)
SUBNET_ID002=$(az network vnet subnet show –name “${Subnet_Name}” –vnet-name “${Vnet_Name}” -g “${RG_Vnet}” –query id –output tsv)
export IPConfig_Name=”ipconfig1″

###Criando NIC (Interface de rede)

az network nic create –name “${NIC_Name1}” -g “${RG_Name}” –subnet $SUBNET_ID001 –accelerated-networking “${Accelerated}” –network-security-group “${NSG_Name}” –tags “${Costacenter}”=”${Value_Costcenter}” “${Environment}”=”${Environment_Value}” “${Depto}”=”${Depto_Value}”
az network nic create –name “${NIC_Name2}” -g “${RG_Name}” –subnet $SUBNET_ID002 –accelerated-networking “${Accelerated}” –network-security-group “${NSG_Name}” –tags “${Costacenter}”=”${Value_Costcenter}” “${Environment}”=”${Environment_Value}” “${Depto}”=”${Depto_Value}”

###Declaranado Variaveis para Fixar IP

NIC_ID001=$(az network nic show –name “${NIC_Name1}” -g “${RG_Name}” –query id –output tsv)
NIC_ID002=$(az network nic show –name “${NIC_Name2}” -g “${RG_Name}” –query id –output tsv)

###Declarando varivel para utilizar IP Fixo existente (Obrigatório)

IP_ID001=$(az network nic ip-config show -g “${RG_Name}” -n “${IPConfig_Name}” –nic-name “${NIC_Name1}” –query privateIpAddress –output tsv)
IP_ID002=$(az network nic ip-config show -g “${RG_Name}” -n “${IPConfig_Name}” –nic-name “${NIC_Name2}” –query privateIpAddress –output tsv)

###Fixando IP na interface de rede#Fixando IP

az network nic ip-config update -g “${RG_Name}” –nic-name “${NIC_Name1}” -n “${IPConfig_Name}” –private-ip-address $IP_ID001
az network nic ip-config update -g “${RG_Name}” –nic-name “${NIC_Name2}” -n “${IPConfig_Name}” –private-ip-address $IP_ID002

###Criando Virtual Machine Windows Server 2019

az vm create –name “${VM_Name1}” -g “${RG_Name}” -l “${Location}” –availability-set “${Name_AV_SET}” –boot-diagnostics-storage “${Storage}” –os-disk-name “${DiskName_01}” –os-disk-size-gb “${SizeDisk_01}” –image “${Image_SO}” –nics $NIC_ID001 –admin-username “${User_Name}” –admin-password “${PWD}” –size “${Size}” –storage-sku “${SKU_STG}”
az vm create –name “${VM_Name2}” -g “${RG_Name}” -l “${Location}” –availability-set “${Name_AV_SET}” –boot-diagnostics-storage “${Storage}” –os-disk-name “${DiskName_02}” –os-disk-size-gb “${SizeDisk_01}” –image “${Image_SO}” –nics $NIC_ID002 –admin-username “${User_Name}” –admin-password “${PWD}” –size “${Size}” –storage-sku “${SKU_STG}”

###Criando disco de dados

az disk create -g “${RG_Name}” -n “${Disk_Data01}” –size-gb “${SizeDisk_02}”
az disk create -g “${RG_Name}” -n “${Disk_Data02}” –size-gb “${SizeDisk_02}”

###Anexando Disco a VM existente

az vm disk attach -g “${RG_Name}” –vm-name “${VM_Name1}” –name “${Disk_Data01}”
az vm disk attach -g “${RG_Name}” –vm-name “${VM_Name2}” –name “${Disk_Data02}”

###Habilitando IIS Windows Server

az vm extension set –publisher Microsoft.Compute –version 1.8 –name CustomScriptExtension –vm-name “${VM_Name1}” -g “${RG_Name}” –settings ‘{“commandToExecute”:”powershell.exe Install-WindowsFeature -Name Web-Server”}’
az vm extension set –publisher Microsoft.Compute –version 1.8 –name CustomScriptExtension –vm-name “${VM_Name2}” -g “${RG_Name}” –settings ‘{“commandToExecute”:”powershell.exe Install-WindowsFeature -Name Web-Server”}’

###Criando Load Balance

az network lb create -g “${RG_Name}” -n “${ELB_Name}” –sku “${SKU}” –public-ip-address “${PublicIP}” –frontend-ip-name “${Frontend_Name}” –backend-pool-name “${BackendPool_Name}”

###Create health probe on port 80/443

az network lb probe create -g “${RG_Name}” –lb-name “${ELB_Name}” -n “${ProbeName01}” –protocol “${Protocol01}” –port “${Port01}”
az network lb probe create -g “${RG_Name}” –lb-name “${ELB_Name}” -n “${ProbeName02}” –protocol “${Protocol01}” –port “${Port02}”

###Create load balancer rule for port 80/443

az network lb rule create -g “${RG_Name}” –lb-name “${ELB_Name}” -n “${Rule01}” –protocol “${Protocol01}” –frontend-port “${Port01}” –backend-port “${Port01}” –frontend-ip-name “${Frontend_Name}” –backend-pool-name “${BackendPool_Name}” –probe-name “${ProbeName01}”
az network lb rule create -g “${RG_Name}” –lb-name “${ELB_Name}” -n “${Rule02}” –protocol “${Protocol01}” –frontend-port “${Port02}” –backend-port “${Port02}” –frontend-ip-name “${Frontend_Name}” –backend-pool-name “${BackendPool_Name}” –probe-name “${ProbeName02}”

###Adicionando Inteface REDE ao pool de backend Load Balance

az network nic ip-config address-pool add -g “${RG_Name}” –nic-name “${NIC_Name1}” -n “${IPConfig_Name}” –lb-name “${ELB_Name}” –address-pool “${BackendPool_Name}”
az network nic ip-config address-pool add -g “${RG_Name}” –nic-name “${NIC_Name2}” -n “${IPConfig_Name}” –lb-name “${ELB_Name}” –address-pool “${BackendPool_Name}”

###fim do scrip.

Criando Virtual Machine CentOS Azure CLI (bash) com acesso via chave publica/privada

Neste artigo iremos criar uma Maquina Virtual com CentOS Linux utilizando uma Vnet existente e fixando IP (rede interna), criaremos também um NSG para esta VM, um storage account para diagnostico de boot e conjunto de disponibilidade e com acesso via chave publica/privada sem a necessidade de utilizar senha.

#!/bin/bash

##Declarando variáveis

##Declarando variáveis (Obrigatório)

export Subscription_Name=”Azure Subscription”
export RG_Name=”Nome do Resource Group”
export Location=”Azure Region”
export Object_Name=”Nome do Objeto”

##Storage Accout

export Storage=”Nome do Storage Account” ##Exemplo storagevmdiag##
export SKU_Storage=”SKU do Storage Account” ##Exemplo Standard_LRS##

##Conjunto de Disponibiliade Availability Set

export Name_AV_SET=”AV-SET”-“Nome do Conjunto de Disponibilidade”
export Fault_Domain=”3″
export Update_Domain=”20″

##Network Security Group NSG

export NSG_Name=”Nome do NSG” ##Exemplo NSG-VM-Frontend##

##Vnet Existente (Variáveis para utilizar Vnet Existente)

export RG_Vnet=”Nome do Resurce Goup onde encontra-se a Vnet existente”
export Subnet_Name=”Nome da subnet existente”
export Vnet_Name=”Nome da Vnet existente”

##Variáveis de Rede (Obrigatório)

export NIC_Name=”Nome da interface de rede”
export Accelerated=”False ou true”

##Variavel para criacao da VM (Obrigatório)

export Image_SO=”CentOS”
export VM_Name=”Nome do servidor”
export User_Name=”azroot”
export key_PUB=”Local da chave publica” ##Exemplo /script/key/chave_publica.pub## caminho absoluto
export Size=”Tier da VM”
export SKU_STG=”Sku do Disco” ## Disco ## Exemplo Standard_LRS###

##Variaveis TAGs (Não Obrigatório)

export Costacenter=”Centro de Custos”
export Value_Costcenter=”Numero do centos de custo”
export Environment=”Environment”
export Environment_Value=”Ambiente” ##’Desenvolvimento’-‘Homologação’-‘Produção’##
export Depto=”Departamento” ##Squad-Team-Time##
export Depto_Value=”Nome do Departamento” ##infra-cartões-telecom

###Execução do Script

###Selecionar subscription

az account set –subscription “${Subscription_Name}”

###Criando Resource Group

az group create -n “${RG_Name}” -l “${Location}” –tags “${Costacenter}”=”${Value_Costcenter}” “${Environment}”=”${Environment_Value}” “${Depto}”=”${Depto_Value}”

###Criando Storage Accout

az storage account create -g “${RG_Name}” -n “${Storage}” -l “${Location}” –sku “${SKU_Storage}” –tags “${Costacenter}”=”${Value_Costcenter}” “${Environment}”=”${Environment_Value}” “${Depto}”=”${Depto_Value}”

###Criando Network Security Group NSG

az network nsg create -g “${RG_Name}” -n “${NSG_Name}” -l “${Location}” –tags “${Costacenter}”=”${Value_Costcenter}” “${Environment}”=”${Environment_Value}” “${Depto}”=”${Depto_Value}”

###Criar Grupo de Disponibilidade

az vm availability-set create -g “${RG_Name}” -n “${Name_AV_SET}” –platform-fault-domain-count “${Fault_Domain}” –platform-update-domain-count “${Update_Domain}” -l “${Location}” –tags “${Costacenter}”=”${Value_Costcenter}” “${Environment}”=”${Environment_Value}” “${Depto}”=”${Depto_Value}”

###Declarando variável para utilizar Vnet existente (Obrigatório)

SUBNET_ID001=$(az network vnet subnet show –name “${Subnet_Name}” –vnet-name “${Vnet_Name}” -g “${RG_Vnet}” –query id –output tsv)
export IPConfig_Name=”ipconfig1″

###Criando NIC (Interface de rede)

az network nic create –name “${NIC_Name}” -g “${RG_Name}” –subnet $SUBNET_ID001 –accelerated-networking “${Accelerated}” –network-security-group “${NSG_Name}” –tags “${Costacenter}”=”${Value_Costcenter}” “${Environment}”=”${Environment_Value}” “${Depto}”=”${Depto_Value}”

###Declaranado Variaveis para Fixar IP

NIC_ID001=$(az network nic show –name “${NIC_Name}” -g “${RG_Name}” –query id –output tsv)

###Declarando varivel para utilizar IP Fixo existente (Obrigatório)

IP_ID001=$(az network nic ip-config show -g “${RG_Name}” -n “${IPConfig_Name}” –nic-name “${NIC_Name}” –query privateIpAddress –output tsv)

###Fixando IP na interface de rede#Fixando IP

az network nic ip-config update -g “${RG_Name}” –nic-name “${NIC_Name}” -n “${IPConfig_Name}” –private-ip-address $IP_ID001

###Criando Virtual Machine CentOS

az vm create –name “${VM_Name}” -g “${RG_Name}” -l “${Location}” –availability-set “${Name_AV_SET}” –boot-diagnostics-storage “${Storage}” –image “${Image_SO}” –nics $NIC_ID001 –admin-username “${User_Name}” –ssh-key-values “${key_PUB}” –size “${Size}” –storage-sku “${SKU_STG}”

Links de referencia

https://docs.microsoft.com/en-us/cli/azure/vm/image?view=azure-cli-latest
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/cli-ps-findimage
https://docs.microsoft.com/pt-br/cli/azure/
https://docs.microsoft.com/en-us/cli/azure/vm?view=azure-cli-latest#az_vm_create
https://docs.microsoft.com/en-us/rest/api/compute/virtual-machines/create-or-update#osprofile
https://docs.microsoft.com/pt-br/azure/virtual-machines/availability-set-overview
https://docs.microsoft.com/pt-br/azure/virtual-network/network-security-groups-overview

Link para geração da chave
https://charlessantana.com.br/2021/10/20/criando-chave-publica-e-private-com-puttygen/

Criando Virtual Machine (CentOS – Linux) Azure CLI (Bash)

Neste artigo iremos criar uma Maquina Virtual com CentOS Linux utilizando uma Vnet existente e fixando IP (rede interna), criaremos também um NSG para esta VM, um storage account para diagnostico de boot e conjunto de disponibilidade.

Vamos ao script

#!/bin/bash
#|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
#|||Script Charles Aureliano Santana|||
#|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||

##Declarando variaveis
export Subscription_Name=”Azure Subscription”
export RG_Name=”Nome do Resource Group”
export Location=”Azure Region”
export Object_Name=”Nome do Objeto”

##Storage Accout
export Storage=”Nome do Storage Account” ##Exemplo storagevmdiag##
export SKU_Storage=”SKU do Storage Account” ##Exemplo Standard_LRS##

##Conjunto de Disponibiliade Availability Set
export Name_AV_SET=”AV-SET”-“Nome do Conjunto de Disponibilidade”
export Fault_Domain=”3″
export Update_Domain=”20″

##Network Security Group NSG
export NSG_Name=”Nome do NSG” ##Exemplo NSG-VM-Frontend##

###Vnet Existente (Variaveis para utilizar Vnet Existente)
export RG_Vnet=”Nome do Resurce Goup onde encontra-se a Vnet existente”
export Subnet_Name=”Nome da subnet existente”
export Vnet_Name=”Nome da Vnet existente”

##Variaveis de Rede (Obrigatório)
export NIC_Name=”Nome da interface de rede”
export Accelerated=”False ou true”

##Variavel para criacao da VM (Obrigatório)
export Image_SO=”SKU Image Azure” ##Exemplo ‘CentOS’
export VM_Name=”Nome do Servidor” “”15 caracteres
export User_Name=”Usuário do SO”
export PWD=”Senha do usuário do SO”
export Size=”Standard_D2S_v3″ ## Tier da VM
export SKU_STG=”Standard_LRS” ## Disco ##

##Variaveis TAGs (Não Obrigatório)
export Costacenter=”Centro de Custos”
export Value_Costcenter=”Numero do centos de custo”
export Environment=”Environment”
export Environment_Value=”Ambiente” ##’Desenvolvimento’-‘Homologação’-‘Produção’##
export Depto=”Departamento” ##Squad-Team-Time##
export Depto_Value=”Nome do Departamento” ##infra-cartões-telecom

##Execução do Script
###Selecionar subscription
az account set –subscription “${Subscription_Name}”

###Criando Resource Group
az group create -n “${RG_Name}” -l “${Location}” –tags “${Costacenter}”=”${Value_Costcenter}” “${Environment}”=”${Environment_Value}” “${Depto}”=”${Depto_Value}”

###Criando Storage Accout
az storage account create -g “${RG_Name}” -n “${Storage}” -l “${Location}” –sku “${SKU_Storage}” –tags “${Costacenter}”=”${Value_Costcenter}” “${Environment}”=”${Environment_Value}” “${Depto}”=”${Depto_Value}”

###Criando Network Security Group NSG
az network nsg create -g “${RG_Name}” -n “${NSG_Name}” -l “${Location}” –tags “${Costacenter}”=”${Value_Costcenter}” “${Environment}”=”${Environment_Value}” “${Depto}”=”${Depto_Value}”

###Criar Grupo de Disponibilidade
az vm availability-set create -g “${RG_Name}” -n “${Name_AV_SET}” –platform-fault-domain-count “${Fault_Domain}” –platform-update-domain-count “${Update_Domain}” -l “${Location}” –tags “${Costacenter}”=”${Value_Costcenter}” “${Environment}”=”${Environment_Value}” “${Depto}”=”${Depto_Value}”

###Declarando varivel para utilizar Vnet existente (Obrigatório)
SUBNET_ID001=$(az network vnet subnet show –name “${Subnet_Name}” –vnet-name “${Vnet_Name}” -g “${RG_Vnet}” –query id –output tsv)
export IPConfig_Name=”ipconfig1″

###Criando NIC (Interface de rede)
az network nic create –name “${NIC_Name}” -g “${RG_Name}” –subnet $SUBNET_ID001 –accelerated-networking “${Accelerated}” –network-security-group “${NSG_Name}” –tags “${Costacenter}”=”${Value_Costcenter}” “${Environment}”=”${Environment_Value}” “${Depto}”=”${Depto_Value}”

###Declaranado Variaveis para Fixar IP
NIC_ID001=$(az network nic show –name “${NIC_Name}” -g “${RG_Name}” –query id –output tsv)

###Declarando varivel para utilizar IP Fixo existente (Obrigatório)
IP_ID001=$(az network nic ip-config show -g “${RG_Name}” -n “${IPConfig_Name}” –nic-name “${NIC_Name}” –query privateIpAddress –output tsv)

###Fixando IP na interface de rede#Fixando IP
az network nic ip-config update -g “${RG_Name}” –nic-name “${NIC_Name}” -n “${IPConfig_Name}” –private-ip-address $IP_ID001

###Criando Virtual Machine CentOS Linux
az vm create –name “${VM_Name}” -g “${RG_Name}” -l “${Location}” –availability-set “${Name_AV_SET}” –boot-diagnostics-storage “${Storage}” –image “${Image_SO}” –nics $NIC_ID001 –admin-username “${User_Name}” –admin-password “${PWD}” –size “${Size}” –storage-sku “${SKU_STG}”

Links de referencia

https://docs.microsoft.com/en-us/cli/azure/vm/image?view=azure-cli-latest
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/cli-ps-findimage
https://docs.microsoft.com/pt-br/cli/azure/
https://docs.microsoft.com/en-us/cli/azure/vm?view=azure-cli-latest#az_vm_create
https://docs.microsoft.com/en-us/rest/api/compute/virtual-machines/create-or-update#osprofile
https://docs.microsoft.com/pt-br/azure/virtual-machines/availability-set-overview
https://docs.microsoft.com/pt-br/azure/virtual-network/network-security-groups-overvie






Criando Virtual Machine Azure (Windows Server) CLI (bash)

Neste artigo iremos criar uma Maquina Virtual com Windows utilizando uma Vnet existente e fixando IP (rede interna), criaremos também um NSG para esta VM, um storage account para diagnostico de boot e conjunto de disponibilidade.

Vamos ao script

#!/bin/bash

##Declarando variaveis
export Subscription_Name=”Subscription Azure”
export RG_Name=”Nome do Resource Group”
export Location=”Azure Region”
export Object_Name=”Nome do Objeto”

##Storage Accout

##Conjunto de Disponibiliade Availability Set
export Name_AV_SET=”Nome do Grupo de Disponibilidade”

##Network Security Group NSG
export NSG_Name=”Nome do NSG##Exemplo NSG-VM-Frontend##
export Fault_Domain=”3″
export Update_Domain=”20″

##Vnet Existente (Variaveis para utilizar Vnet Existente)
export RG_Vnet=”Resource Grupo Vnet existente”
export Subnet_Name=”subnet-existente”
export Vnet_Name=”Vnet existente”

##Variaveis de Rede (Obrigatório)
export NIC_Name=”NIC”-“${Object_Name}”
export Accelerated=”False”

##Variavel para criacao da VM (Obrigatório)
export Image_SO=”Win2019Datacenter”
export VM_Name=”SRVWEBSERVER01″
export User_Name=”azroot”
export PWD=”@edRc%2010T$3U”
export Size=”Standard_D2S_v3″
export SKU_STG=”Standard_LRS” ## Disco ##

##Variaveis TAGs (Não Obrigatório)
export Costacenter=”Centro de Custos”
export Value_Costcenter=”111245″
export Environment=”Environment”
export Environment_Value=”Produção”
export Depto=”Departamento”
export Depto_Value=”Recursos Humanos”

###Execução do Script

###Selecionar subscription
az account set –subscription “${Subscription_Name}”

###Criando Resource Group
az group create -n “${RG_Name}” -l “${Location}” –tags “${Costacenter}”=”${Value_Costcenter}” “${Environment}”=”${Environment_Value}” “${Depto}”=”${Depto_Value}”

###Criando Storage Accout
az storage account create -g “${RG_Name}” -n “${Storage}” -l “${Location}” –sku “${SKU_Storage}” –tags “${Costacenter}”=”${Value_Costcenter}” “${Environment}”=”${Environment_Value}” “${Depto}”=”${Depto_Value}”

###Criando Network Security Group NSG
az network nsg create -g “${RG_Name}” -n “${NSG_Name}” -l “${Location}” –tags “${Costacenter}”=”${Value_Costcenter}” “${Environment}”=”${Environment_Value}” “${Depto}”=”${Depto_Value}”

###Criar Grupo de Disponibilidade
az vm availability-set create -g “${RG_Name}” -n “${Name_AV_SET}” –platform-fault-domain-count “${Fault_Domain}” –platform-update-domain-count “${Update_Domain}” -l “${Location}” –tags “${Costacenter}”=”${Value_Costcenter}” “${Environment}”=”${Environment_Value}” “${Depto}”=”${Depto_Value}”

###Declarando varivel para utilizar Vnet existente (Obrigatório)
SUBNET_ID001=$(az network vnet subnet show –name “${Subnet_Name}” –vnet-name “${Vnet_Name}” -g “${RG_Vnet}” –query id –output tsv)
export IPConfig_Name=”ipconfig1″

###Criando NIC (Interface de rede)
az network nic create –name “${NIC_Name}” -g “${RG_Name}” –subnet $SUBNET_ID001 –accelerated-networking “${Accelerated}” –network-security-group “${NSG_Name}” –tags “${Costacenter}”=”${Value_Costcenter}” “${Environment}”=”${Environment_Value}” “${Depto}”=”${Depto_Value}”

###Declaranado Variaveis para Fixar IP
NIC_ID001=$(az network nic show –name “${NIC_Name}” -g “${RG_Name}” –query id –output tsv)

###Declarando varivel para utilizar IP Fixo existente (Obrigatório)
IP_ID001=$(az network nic ip-config show -g “${RG_Name}” -n “${IPConfig_Name}” –nic-name “${NIC_Name}” –query privateIpAddress –output tsv)

###Fixando IP na interface de rede
###Fixando IP
az network nic ip-config update -g “${RG_Name}” –nic-name “${NIC_Name}” -n “${IPConfig_Name}” –private-ip-address $IP_ID001

###Criando Virtual Machine Windows Server 2019
az vm create –name “${VM_Name}” -g “${RG_Name}” -l “${Location}” –availability-set “${Name_AV_SET}” –boot-diagnostics-storage “${Storage}” –image “${Image_SO}” –nics $NIC_ID001 –admin-username “${User_Name}” –admin-password “${PWD}” –size “${Size}” –storage-sku “${SKU_STG}”

Links de referencia

https://docs.microsoft.com/pt-br/cli/azure/

https://docs.microsoft.com/pt-br/azure/virtual-machines/availability-set-overview

https://docs.microsoft.com/pt-br/azure/virtual-network/network-security-groups-overview

Adicionando Vnet a infraestrutura existente com Peering e propagação BGP, via CLI (Bash) Azure

Como vimos em nossa seria de artigos de criação de vnet, peering, bgp e VPN IPSec com BGP, vamos criar mais uma vnet em nossa infraestrutura já existente. Veja nossos artigos nas sequencia:

Criando Vnet com Tags via CLI (Bash) Azure
Criando Virtual Network Gateway (VPN com BGP) Azure via CLI (Bash)
Criando Virtual Network com Peering via CLI (Bash) Azure
Criando Peering Virtual Network (Azure) via CLI (Bash) com Gateway de propagação.
Criando Local Network Gateway com BGP – VPN IPSec Fortigate.

Vamos ao script

#!/bin/bash
#Declarando variaveis
##Selecionar subscription

export Subscription_01=’Santana-Corp’

##região
export Location=brazilsouth

##Environmont
export Environment_01=’backend-Prodution’

##Resouce Group
export RG_Name01=”${Environment_01}”-Network

##Vnet Name
export Vnet_01=vnet-“${Environment_01}”

##Nome do Objeto
export NameObject_01=”${Vnet_01}”

##Projeto
export Projecto_01=’Backend’
export ID_Object=’678654789′

##Centro de Custo
export Costcenter_Team=’Team Backend’
export Costcenter_Number=’78954′

##Suporte Acionamento
export Support_Team=’[email protected]
export Support_Number=’+55 11 3000-XXXX’

##CIDR Network (Prefixo da Rede)
export CIDR_01=’172.29.226.0/24′

##Nome subnet
export Subnet_01=sub01-“${NameObject_01}”
export Subnet_02=sub02-“${NameObject_01}”
export Subnet_03=sub03-“${NameObject_01}”
export Subnet_04=sub04-“${NameObject_01}”

##CIDR Subnet
export prefix_01=’172.29.226.0/26′
export prefix_02=’172.29.226.64/26′
export prefix_03=’172.29.226.128/26′
export prefix_04=’172.29.226.192/26′

##Tags
export Tag01_Key=”${Environment_01}”
export Tag02_Key=”${Projecto_01}”
export Tag03_Key=”${ID_Object}”
export Tag04_Key=”${Costcenter_Team}”
export Tag05_Key=”${Costcenter_Number}”
export Tag06_Key=”${Support_Team}”
export Tag07_Key=”${Support_Number}”
export Name_Value_01=’Environment’
export Name_Value_02=’Projeto’
export Name_Value_03=’ID Projeto’
export Name_Value_04=’Centro de Custo Team’
export Name_Value_05=’Centro de Custo Number’
export Name_Value_06=’Time de Suporte’
export Name_Value_07=’Telefone do Suporte’

#Seleciona Subscription
az account set –subscription “$Subscription_01”

#Criando Resource Groups
az group create –name “${RG_Name01}” –location $Location –tags “${Name_Value_01}”=”${Tag01_Key}” “${Name_Value_02}”=”${Tag02_Key}” “${Name_Value_03}”=”${Tag03_Key}” “${Name_Value_04}”=”${Tag04_Key}” “${Name_Value_05}”=”${Tag05_Key}” “${Name_Value_06}”=”${Tag06_Key}” “${Name_Value_07}”=”${Tag07_Key}”

#Criando Virtual Network (Vnet)
az network vnet create -g “${RG_Name01}” -n “${NameObject_01}” –address-prefix $CIDR_01 –location $Location –tags “${Name_Value_01}”=”${Tag01_Key}” “${Name_Value_02}”=”${Tag02_Key}” “${Name_Value_03}”=”${Tag03_Key}” “${Name_Value_04}”=”${Tag04_Key}” “${Name_Value_05}”=”${Tag05_Key}” “${Name_Value_06}”=”${Tag06_Key}” “${Name_Value_07}”=”${Tag07_Key}” 

#Criando Subnet
az network vnet subnet create -g “${RG_Name01}” –vnet-name “${NameObject_01}” -n $Subnet_01 –address-prefixes $prefix_01
az network vnet subnet create -g “${RG_Name01}” –vnet-name “${NameObject_01}” -n $Subnet_02 –address-prefixes $prefix_02
az network vnet subnet create -g “${RG_Name01}” –vnet-name “${NameObject_01}” -n $Subnet_03 –address-prefixes $prefix_03
az network vnet subnet create -g “${RG_Name01}” –vnet-name “${NameObject_01}” -n $Subnet_04 –address-prefixes $prefix_04

##Variaveis para criação do Peering

#Subscriptions
export Subscription_01=’Santana-COrp’

#Resouce Group
export RG_Name01=”Shared-Prodution-Network”export RG_Name02=”backend-Prodution-Network”

#Name Object
export NameObject_01=”${Vnet_01}”-“${Subscription_01}”-“${Environment_01}”

#Peering
export Vnet_Name_01=”vnet-Shared-Prodution”
export Vnet_Name_02=”vnet-backend-Prodution”
export Peering_01=”Peering-vnet-Shared-Prodution2″
export Peering_02=”Peering-backend-Prodution-Network”

#export Vnet_Remote=$(az network vnet show –resource-group Shared-Prodution-Network -n vnet-Shared-Prodution –query id –output tsv)

#Vnet Remote
export Vnet_Remote_01=”/subscriptions/XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX/resourceGroups/backend-Prodution-Network/providers/Microsoft.Network/virtualNetworks/vnet-backend-Prodution”
export Vnet_Remote_02=”/subscriptions/xxxxxxxxxxxxxxxxxxxxxxxxx/resourceGroups/Shared-Prodution-Network/providers/Microsoft.Network/virtualNetworks/vnet-Shared-Prodution”

#Selecionar subscription
az account set –subscription “${Subscription_01}”

#Criando Peering
## Vnet Shared Prodution

az network vnet peering create -g “${RG_Name01}” -n “${Peering_01}” –vnet-name “${Vnet_Name_01}” –remote-vnet “${Vnet_Remote_01}” –allow-vnet-access –allow-forwarded-traffic –allow-gateway-transit –allow-vnet-access

## Vnet Backend Prodution
az network vnet peering create -g “${RG_Name02}” -n “${Peering_02}” –vnet-name “${Vnet_Name_02}” –remote-vnet “${Vnet_Remote_02}” –allow-vnet-access –allow-forwarded-traffic –allow-vnet-access –use-remote-gateways

Veja o resultado

Em nosso fortigate

Com isso concluimos nossa seria de Vnet com peering e propagação BGP, a cada vnet nova criada com peering (utilizando as configuração aqui exibidas) não é necessário fazer mais nada em nosso fortigate ou Gateway de VPN, um lembrete muito importante as redes não podem se sobscrever (Over lapping).

Criando entradas Azure DNS via CLI (bash)

Muitas vezes precisamos criar varios entradas em nosso DNS, utilizando o portal do Azure é bem simples, agora imagina ter que repitir a mesma ação por 20 vezes por exemplo para poder criar 20 entras diferentes? Com isso criei este post para ajudar no dia a dia da administração do Azure DNS, isso será feito via CLI, veja como instalar o azure cli aqui.

Primeiramente iremos nos conectar (usarei neste exemplo ubuntu linux como subsystem windows 10)

#Conectar no Azure
az login (enter)

#Selecionando a subscription (supondo que tenha mais de uma)
az account set –subscription “Santana Corp”

az network dns record-set a add-record –resource-group dns \
–zone-name charlessantana.com –record-set-name hello \
–ttl 300 –ipv4-address 192.0.78.24

Resultado

Agora vamos verificar se funcionou, com um simples nslookup

nslookup hello.charlessantana.com


Agora vamos criar uma entrada do tipo CNAME

az network dns record-set cname set-record –resource-group dns \
–zone-name charlessantana.com –record-set-name ww2 –cname ‘www.charlessantana.com.br

Script simples em bash

#!/bin/bash

#Seleciona Subscription

az account set –subscription “Santana Corp”

#Criando entrada DNS do Tipo A

az network dns record-set a add-record –resource-group dns \
–zone-name charlessantana.com –record-set-name hello –ttl 300 –ipv4-address 192.0.78.24

#Criando entrada DNS do Tipo CNAME

az network dns record-set cname set-record –resource-group dns \
–zone-name charlessantana.com –record-set-name ww2 –cname ‘www.charlessantana.com.br’