QuickStart: Create and configure Azure DDoS Network Protection using Azure PowerShell

Get started with Azure DDoS Network Protection by using Azure PowerShell.

A DDoS protection plan defines a set of virtual networks that have DDoS Network Protection enabled, across subscriptions. You can configure one DDoS protection plan for your organization and link virtual networks from multiple subscriptions to the same plan.

In this QuickStart, you'll create a DDoS protection plan and link it to a virtual network.

Prerequisites

• An Azure account with an active subscription. Create a trial subscription.
• Azure PowerShell installed locally or Azure local Shell

Create a DDoS Protection plan

In Azure, you allocate related resources to a resource group. You can either use an existing resource group or create a new one.

To create a resource group, use New-AzResourceGroup. In this example, we'll name our resource group MyResourceGroup and use the China East location:

New-AzResourceGroup -Name MyResourceGroup -Location "China East"

Now create a DDoS protection plan named MyDdosProtectionPlan:

New-AzDdosProtectionPlan -ResourceGroupName MyResourceGroup -Name MyDdosProtectionPlan -Location "China East"

Enable DDoS for a virtual network

Enable DDoS for a new virtual network

You can enable DDoS protection when creating a virtual network. In this example, we'll name our virtual network MyVnet:

#Gets the DDoS protection plan ID
$ddosProtectionPlanID = Get-AzDdosProtectionPlan -ResourceGroupName MyResourceGroup -Name MyDdosProtectionPlan

#Creates the virtual network
New-AzVirtualNetwork -Name MyVnet -ResourceGroupName MyResourceGroup -Location "China East" -AddressPrefix 10.0.0.0/16 -DdosProtectionPlan $ddosProtectionPlanID.Id -EnableDdosProtection  

Enable DDoS for an existing virtual network

You can associate an existing virtual network when creating a DDoS protection plan:

#Gets the DDoS protection plan ID
$ddosProtectionPlanID = Get-AzDdosProtectionPlan -ResourceGroupName MyResourceGroup -Name MyDdosProtectionPlan

# Gets the most updated version of the virtual network
$vnet = Get-AzVirtualNetwork -Name MyVnet -ResourceGroupName MyResourceGroup
$vnet.DdosProtectionPlan = New-Object Microsoft.Azure.Commands.Network.Models.PSResourceId

# Update the properties and enable DDoS protection
$vnet.DdosProtectionPlan.Id = $ddosProtectionPlanID.Id
$vnet.EnableDdosProtection = $true
$vnet | Set-AzVirtualNetwork

Disable DDoS for a virtual network

To disable DDoS protection for a virtual network:

# Gets the most updated version of the virtual network
$vnet = Get-AzVirtualNetwork -Name MyVnet -ResourceGroupName MyResourceGroup
$vnet.DdosProtectionPlan = $null
$vnet.EnableDdosProtection = $false
$vnet | Set-AzVirtualNetwork

Validate and test

Check the details of your DDoS protection plan and verify that the command returns the correct details of your DDoS protection plan.

Get-AzDdosProtectionPlan -ResourceGroupName MyResourceGroup -Name MyDdosProtectionPlan

Check the details of your virtual network and verify the DDoS protection plan is enabled.

Get-AzVirtualNetwork -Name MyVnet -ResourceGroupName MyResourceGroup

Clean up resources

You can keep your resources for the next tutorial. If no longer needed, delete the MyResourceGroup resource group. When you delete the resource group, you also delete the DDoS protection plan and all its related resources.

Remove-AzResourceGroup -Name MyResourceGroup

Next steps

To learn how to view and configure telemetry for your DDoS protection plan, continue to the tutorials.