Skip to content

Commit 17846db

Browse files
prmerger-automator[bot]prmerger-automator[bot]
authored
Merge pull request #312210 from asudbring/tsk555753-sfi-bastion
SFI security updates for configure-routing-preference-virtual-machine
2 parents 7ee0dc1 + 61f09f7 commit 17846db

1 file changed

Lines changed: 68 additions & 14 deletions

File tree

‎articles/virtual-network/ip-services/configure-routing-preference-virtual-machine.md‎

Lines changed: 68 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
title: 'Tutorial: Configure routing preference for a virtual machine'
33
description: Learn how to create a virtual machine with a public IP address with routing preference choice using the Azure portal.
4-
ms.date: 12/11/2024
4+
ms.date: 02/24/2026
55
ms.author: mbender
66
author: mbender-ms
77
ms.service: azure-virtual-network
@@ -43,25 +43,45 @@ If you choose to install and use PowerShell locally, this article requires the A
4343

4444
---
4545

46-
## Create virtual machine with a public IP address
47-
4846
# [Azure portal](#tab/azure-portal)
4947

50-
In this section, you create a virtual machine and public IP address in the Azure portal. During the public IP address configuration, you select **Internet** for routing preference.
48+
## Create a resource group
5149

5250
1. Sign in to the [Azure portal](https://portal.azure.com).
5351

54-
2. In the portal search box, enter **Virtual machine**. In the search results, select **Virtual machines**.
52+
2. In the portal search box, enter **Resource groups**. In the search results, select **Resource groups**.
53+
54+
3. Select **+ Create**.
55+
56+
4. In the **Basics** tab of **Create a resource group**, enter, or select the following information.
57+
58+
| Setting | Value |
59+
| ------- | ----- |
60+
| **Project details** | |
61+
| Subscription | Select your subscription. |
62+
| Resource group | Enter **TutorVMRoutePref-rg**. |
63+
| **Resource details** | |
64+
| Region | Select **(US) West US 2**. |
65+
66+
5. Select **Review + create**.
67+
68+
6. Select **Create**.
69+
70+
## Create virtual machine with a public IP address
71+
72+
In this section, you create a virtual machine and public IP address in the Azure portal. During the public IP address configuration, you select **Internet** for routing preference.
73+
74+
1. In the portal search box, enter **Virtual machine**. In the search results, select **Virtual machines**.
5575

56-
3. In **Virtual machines**, select **+ Create**, then **+ Virtual machine**.
76+
2. In **Virtual machines**, select **+ Create**, then **+ Virtual machine**.
5777

58-
4. In the **Basics** tab of **Create a virtual machine**, enter, or select the following information.
78+
3. In the **Basics** tab of **Create a virtual machine**, enter, or select the following information.
5979

6080
| Setting | Value |
6181
| ------- | ----- |
6282
| **Project details** | |
6383
| Subscription | Select your subscription. |
64-
| Resource group | Select **Create new**.</br> Enter **TutorVMRoutePref-rg**. Select **OK**. |
84+
| Resource group | Select **TutorVMRoutePref-rg**. |
6585
| **Instance details** | |
6686
| Virtual machine name | Enter **myVM**. |
6787
| Region | Select **(US) West US 2**. |
@@ -77,12 +97,14 @@ In this section, you create a virtual machine and public IP address in the Azure
7797
| Password | Enter a password. |
7898
| Confirm password | Reenter password. |
7999
| **Inbound port rules** |
80-
| Public inbound ports | Select **Allow selected ports**. |
81-
| Select inbound ports | Leave the default of **RDP (3389)**.</br> _**Opening port 3389 from the internet is not recommended for production workloads**_. |
100+
| Public inbound ports | Select **None**. |
101+
102+
> [!NOTE]
103+
> All public inbound ports are closed for this virtual machine. To manage your virtual machines, deploy Azure Bastion. For more information, see [Quickstart: Deploy Azure Bastion from the Azure portal](../../bastion/quickstart-host-portal.md).
82104
83-
5. Select **Next: Disks** then **Next: Networking**, or select the **Networking** tab.
105+
4. Select **Next: Disks** then **Next: Networking**, or select the **Networking** tab.
84106

85-
6. In the networking tab, enter or select the following information.
107+
5. In the networking tab, enter or select the following information.
86108

87109
| Setting | Value |
88110
| ------- | ----- |
@@ -91,9 +113,9 @@ In this section, you create a virtual machine and public IP address in the Azure
91113
| Subnet | Leave the default of **(new) default (10.1.0.0/24)**. |
92114
| Public IP | Select **Create new**.</br> In **Name**, enter **myPublicIP**.</br> In **Routing preference**, select **Internet**.</br> In **Availability zone**, select **Zone 1**.</br> Select **OK**. |
93115

94-
7. Select **Review + create**.
116+
6. Select **Review + create**.
95117

96-
8. Select **Create**.
118+
7. Select **Create**.
97119

98120
# [Azure CLI](#tab/azure-cli)
99121

@@ -109,6 +131,19 @@ Create a resource group with [az group create](/cli/azure/group#az-group-create)
109131
--location westus2
110132
```
111133

134+
## Create a network security group
135+
136+
Create a network security group with [az network nsg create](/cli/azure/network/nsg#az-network-nsg-create). The default rules in the network security group deny all inbound access from the internet.
137+
138+
```azurecli-interactive
139+
az network nsg create \
140+
--resource-group TutorVMRoutePref-rg \
141+
--name myNSG
142+
```
143+
144+
> [!NOTE]
145+
> All public inbound ports are closed for this virtual machine. To manage your virtual machines, deploy Azure Bastion. For more information, see [Quickstart: Deploy Azure Bastion from the Azure portal](/azure/bastion/quickstart-host-portal).
146+
112147
## Create a public IP address
113148

114149
Use [az network public-ip create](/cli/azure/network/public-ip#az-network-public-ip-create) to create a standard zone-redundant public IPv4 address named **myPublicIP** in **TutorVMRoutePref-rg**. The **Tag** of **Internet** is applied to the public IP address as a parameter in the CLI command enabling the **Internet** routing preference.
@@ -132,6 +167,7 @@ az vm create \
132167
--name myVM \
133168
--resource-group TutorVMRoutePref-rg \
134169
--public-ip-address myPublicIP \
170+
--nsg myNSG \
135171
--size Standard_D2a_v4 \
136172
--image MicrosoftWindowsServer:WindowsServer:2019-Datacenter:latest \
137173
--admin-username azureuser
@@ -152,6 +188,23 @@ New-AzResourceGroup -Name 'TutorVMRoutePref-rg' -Location 'westus2'
152188
153189
```
154190

191+
## Create a network security group
192+
193+
Create a network security group with [New-AzNetworkSecurityGroup](/powershell/module/az.network/new-aznetworksecuritygroup). The default rules in the network security group deny all inbound access from the internet.
194+
195+
```azurepowershell-interactive
196+
## Create network security group. ##
197+
$nsg = @{
198+
Name = 'myNSG'
199+
ResourceGroupName = 'TutorVMRoutePref-rg'
200+
Location = 'westus2'
201+
}
202+
New-AzNetworkSecurityGroup @nsg
203+
```
204+
205+
> [!NOTE]
206+
> All public inbound ports are closed for this virtual machine. To manage your virtual machines, deploy Azure Bastion. For more information, see [Quickstart: Deploy Azure Bastion from the Azure portal](/azure/bastion/quickstart-host-portal).
207+
155208
## Create a public IP address
156209

157210
Use [New-AzPublicIpAddress](/powershell/module/az.network/new-azpublicipaddress) to create a standard zone-redundant public IPv4 address named **myPublicIP** in **TutorVMRoutePref-rg**. The **Tag** of **Internet** is applied to the public IP address as a parameter in the PowerShell command enabling the **Internet** routing preference.
@@ -189,6 +242,7 @@ $vm = @{
189242
Location = 'West US 2'
190243
Name = 'myVM'
191244
PublicIpAddressName = 'myPublicIP'
245+
SecurityGroupName = 'myNSG'
192246
}
193247
New-AzVM @vm
194248
```

0 commit comments

Comments
 (0)