快速入门:使用 Azure 防火墙管理器保护你的虚拟中心 - Bicep
本快速入门介绍了使用 Azure 防火墙管理器保护虚拟中心安全。 部署的防火墙具有允许连接到 www.microsoft.com
的应用程序规则。 部署了两个 Windows Server 2019 虚拟机以测试防火墙。 一个跳转服务器用于连接到工作负载服务器。 从工作负载服务器,只能连接到 www.microsoft.com
。
Bicep 是一种特定于域的语言 (DSL),使用声明性语法来部署 Azure 资源。 它提供简明的语法、可靠的类型安全性以及对代码重用的支持。 Bicep 会针对你的 Azure 基础结构即代码解决方案提供最佳创作体验。
有关 Azure 防火墙管理器的详细信息,请参阅什么是 Azure 防火墙管理器?。
先决条件
- 具有活动订阅的 Azure 帐户。 创建试用版订阅。
查阅 Bicep 文件
此 Bicep 文件使用 Azure 防火墙管理器创建安全虚拟中心,以及支持该场景所需的资源。
本快速入门中使用的 Bicep 文件来自 Azure 快速入门模板。
@description('Admin username for the servers')
param adminUsername string
@description('Password for the admin account on the servers')
@secure()
param adminPassword string
@description('Location for all resources.')
param location string = resourceGroup().location
@description('Size of the virtual machine.')
param vmSize string = 'Standard_D2_v3'
resource virtualWan 'Microsoft.Network/virtualWans@2021-08-01' = {
name: 'VWan-01'
location: location
properties: {
disableVpnEncryption: false
allowBranchToBranchTraffic: true
type: 'Standard'
}
}
resource virtualHub 'Microsoft.Network/virtualHubs@2021-08-01' = {
name: 'Hub-01'
location: location
properties: {
addressPrefix: '10.1.0.0/16'
virtualWan: {
id: virtualWan.id
}
}
}
resource hubVNetconnection 'Microsoft.Network/virtualHubs/hubVirtualNetworkConnections@2021-08-01' = {
parent: virtualHub
name: 'hub-spoke'
dependsOn: [
firewall
]
properties: {
remoteVirtualNetwork: {
id: virtualNetwork.id
}
allowHubToRemoteVnetTransit: true
allowRemoteVnetToUseHubVnetGateways: false
enableInternetSecurity: true
routingConfiguration: {
associatedRouteTable: {
id: hubRouteTable.id
}
propagatedRouteTables: {
labels: [
'VNet'
]
ids: [
{
id: hubRouteTable.id
}
]
}
}
}
}
resource policy 'Microsoft.Network/firewallPolicies@2021-08-01' = {
name: 'Policy-01'
location: location
properties: {
threatIntelMode: 'Alert'
}
}
resource ruleCollectionGroup 'Microsoft.Network/firewallPolicies/ruleCollectionGroups@2021-08-01' = {
parent: policy
name: 'DefaultApplicationRuleCollectionGroup'
properties: {
priority: 300
ruleCollections: [
{
ruleCollectionType: 'FirewallPolicyFilterRuleCollection'
name: 'RC-01'
priority: 100
action: {
type: 'Allow'
}
rules: [
{
ruleType: 'ApplicationRule'
name: 'Allow-msft'
sourceAddresses: [
'*'
]
protocols: [
{
port: 80
protocolType: 'Http'
}
{
port: 443
protocolType: 'Https'
}
]
targetFqdns: [
'*.microsoft.com'
]
}
]
}
]
}
}
resource firewall 'Microsoft.Network/azureFirewalls@2021-08-01' = {
name: 'AzfwTest'
location: location
properties: {
sku: {
name: 'AZFW_Hub'
tier: 'Standard'
}
hubIPAddresses: {
publicIPs: {
count: 1
}
}
virtualHub: {
id: virtualHub.id
}
firewallPolicy: {
id: policy.id
}
}
}
resource virtualNetwork 'Microsoft.Network/virtualNetworks@2021-08-01' = {
name: 'Spoke-01'
location: location
properties: {
addressSpace: {
addressPrefixes: [
'10.0.0.0/16'
]
}
enableDdosProtection: false
enableVmProtection: false
}
}
resource subnet_Workload_SN 'Microsoft.Network/virtualNetworks/subnets@2021-08-01' = {
parent: virtualNetwork
name: 'Workload-SN'
properties: {
addressPrefix: '10.0.1.0/24'
privateEndpointNetworkPolicies: 'Enabled'
privateLinkServiceNetworkPolicies: 'Enabled'
}
}
resource subnet_Jump_SN 'Microsoft.Network/virtualNetworks/subnets@2021-08-01' = {
parent: virtualNetwork
name: 'Jump-SN'
dependsOn: [
subnet_Workload_SN
]
properties: {
addressPrefix: '10.0.2.0/24'
routeTable: {
id: routeTable.id
}
privateEndpointNetworkPolicies: 'Enabled'
privateLinkServiceNetworkPolicies: 'Enabled'
}
}
resource Jump_Srv 'Microsoft.Compute/virtualMachines@2022-03-01' = {
name: 'Jump-Srv'
location: location
properties: {
hardwareProfile: {
vmSize: vmSize
}
storageProfile: {
imageReference: {
publisher: 'MicrosoftWindowsServer'
offer: 'WindowsServer'
sku: '2019-Datacenter'
version: 'latest'
}
osDisk: {
osType: 'Windows'
createOption: 'FromImage'
caching: 'ReadWrite'
managedDisk: {
storageAccountType: 'StandardSSD_LRS'
}
diskSizeGB: 127
}
}
osProfile: {
computerName: 'Jump-Srv'
adminUsername: adminUsername
adminPassword: adminPassword
windowsConfiguration: {
provisionVMAgent: true
enableAutomaticUpdates: true
}
allowExtensionOperations: true
}
networkProfile: {
networkInterfaces: [
{
id: netInterface_jump_srv.id
}
]
}
}
}
resource Workload_Srv 'Microsoft.Compute/virtualMachines@2022-03-01' = {
name: 'Workload-Srv'
location: location
properties: {
hardwareProfile: {
vmSize: vmSize
}
storageProfile: {
imageReference: {
publisher: 'MicrosoftWindowsServer'
offer: 'WindowsServer'
sku: '2019-Datacenter'
version: 'latest'
}
osDisk: {
osType: 'Windows'
createOption: 'FromImage'
caching: 'ReadWrite'
managedDisk: {
storageAccountType: 'StandardSSD_LRS'
}
diskSizeGB: 127
}
}
osProfile: {
computerName: 'Workload-Srv'
adminUsername: adminUsername
adminPassword: adminPassword
windowsConfiguration: {
provisionVMAgent: true
enableAutomaticUpdates: true
}
allowExtensionOperations: true
}
networkProfile: {
networkInterfaces: [
{
id: netInterface_workload_srv.id
}
]
}
}
}
resource netInterface_workload_srv 'Microsoft.Network/networkInterfaces@2021-08-01' = {
name: 'netInterface-workload-srv'
location: location
properties: {
ipConfigurations: [
{
name: 'ipconfig1'
properties: {
privateIPAllocationMethod: 'Dynamic'
subnet: {
id: subnet_Workload_SN.id
}
primary: true
privateIPAddressVersion: 'IPv4'
}
}
]
enableAcceleratedNetworking: false
enableIPForwarding: false
networkSecurityGroup: {
id: nsg_workload_srv.id
}
}
}
resource netInterface_jump_srv 'Microsoft.Network/networkInterfaces@2021-08-01' = {
name: 'netInterface-jump-srv'
location: location
properties: {
ipConfigurations: [
{
name: 'ipconfig1'
properties: {
privateIPAllocationMethod: 'Dynamic'
publicIPAddress: {
id: publicIP_jump_srv.id
}
subnet: {
id: subnet_Jump_SN.id
}
primary: true
privateIPAddressVersion: 'IPv4'
}
}
]
enableAcceleratedNetworking: false
enableIPForwarding: false
networkSecurityGroup: {
id: nsg_jump_srv.id
}
}
}
resource nsg_jump_srv 'Microsoft.Network/networkSecurityGroups@2021-08-01' = {
name: 'nsg-jump-srv'
location: location
properties: {
securityRules: [
{
name: 'RDP'
properties: {
protocol: 'Tcp'
sourcePortRange: '*'
destinationPortRange: '3389'
sourceAddressPrefix: '*'
destinationAddressPrefix: '*'
access: 'Allow'
priority: 300
direction: 'Inbound'
}
}
]
}
}
resource nsg_workload_srv 'Microsoft.Network/networkSecurityGroups@2021-08-01' = {
name: 'nsg-workload-srv'
location: location
properties: {}
}
resource publicIP_jump_srv 'Microsoft.Network/publicIPAddresses@2021-08-01' = {
name: 'publicIP-jump-srv'
location: location
sku: {
name: 'Standard'
}
properties: {
publicIPAddressVersion: 'IPv4'
publicIPAllocationMethod: 'Static'
idleTimeoutInMinutes: 4
}
}
resource routeTable 'Microsoft.Network/routeTables@2021-08-01' = {
name: 'RT-01'
location: location
properties: {
disableBgpRoutePropagation: false
routes: [
{
name: 'jump-to-inet'
properties: {
addressPrefix: '0.0.0.0/0'
nextHopType: 'Internet'
}
}
]
}
}
resource hubRouteTable 'Microsoft.Network/virtualHubs/hubRouteTables@2021-08-01' = {
parent: virtualHub
name: 'RT_VNet'
properties: {
routes: [
{
name: 'Workload-SNToFirewall'
destinationType: 'CIDR'
destinations: [
'10.0.1.0/24'
]
nextHopType: 'ResourceId'
nextHop: firewall.id
}
{
name: 'InternetToFirewall'
destinationType: 'CIDR'
destinations: [
'0.0.0.0/0'
]
nextHopType: 'ResourceId'
nextHop: firewall.id
}
]
labels: [
'VNet'
]
}
}
该 Bicep 文件中定义了多个 Azure 资源:
- Microsoft.Network/virtualWans
- Microsoft.Network/virtualHubs
- Microsoft.Network/firewallPolicies
- Microsoft.Network/azureFirewalls
- Microsoft.Network/virtualNetworks
- Microsoft.Compute/virtualMachines
- Microsoft.Storage/storageAccounts
- Microsoft.Network/networkInterfaces
- Microsoft.Network/networkSecurityGroups
- Microsoft.Network/publicIPAddresses
- Microsoft.Network/routeTables
部署 Bicep 文件
将该 Bicep 文件在本地计算机上另存为
main.bicep
。使用 Azure CLI 或 Azure PowerShell 来部署该 Bicep 文件。
az group create --name exampleRG --location chinaeast az deployment group create --resource-group exampleRG --template-file main.bicep --parameters adminUsername=<admin-user>
注意
将 <admin-user> 替换为服务器的管理员登录用户名。 系统会提示输入 adminPassword。
部署完成后,应会看到一条指出部署成功的消息。
验证部署
使用 Azure CLI 或 Azure PowerShell 来查看部署的资源。
az resource list --resource-group exampleRG
现在,测试防火墙以确认它可按预期工作。
在 Azure 门户中,查看“Workload-Srv”虚拟机的网络设置并记下专用 IP 地址。
将远程桌面连接到“Jump-Srv”虚拟机,然后登录。 在这里,打开与“Workload-Srv”专用 IP 地址建立的远程桌面连接。
打开 Internet Explorer 并浏览到
www.microsoft.com
。出现 Internet Explorer 安全警报时,请选择“确定”>“关闭”。
应会看到 Azure 主页。
浏览到
www.baidu.com
。防火墙应会阻止你访问。
现在,你已验证防火墙规则是否正常工作,可以浏览允许 FQDN 的内容,但不能浏览到任何其他位置。
清理资源
如果不再需要通过防火墙创建的资源,请使用 Azure 门户、Azure CLI 或 Azure PowerShell 删除资源组。 这会删除该防火墙和所有相关资源。
az group delete --name exampleRG