Skip to content

Commit 8a98926

Browse files
JamesJBarnettJamesJBarnett
authored
Merge pull request #312212 from asudbring/tsk555755-sfi-bastion
SFI security updates for create-vm-dual-stack-ipv6-portal
2 parents 5779fa1 + 83de587 commit 8a98926

1 file changed

Lines changed: 191 additions & 51 deletions

File tree

‎articles/virtual-network/ip-services/create-vm-dual-stack-ipv6-portal.md‎

Lines changed: 191 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ ms.author: mbender
77
ms.service: azure-virtual-network
88
ms.subservice: ip-services
99
ms.topic: how-to
10-
ms.date: 07/24/2024
10+
ms.date: 02/24/2026
1111
ms.custom: template-how-to
1212
# Customer intent: As a cloud engineer, I want to create a virtual machine with a dual-stack network in Azure using the portal, CLI, or PowerShell, so that I can ensure both IPv4 and IPv6 connectivity for my applications.
1313
---
@@ -47,8 +47,26 @@ If you choose to install and use PowerShell locally, this article requires the A
4747

4848
In this section, you create a resource group and dual-stack virtual network for the virtual machine in the Azure portal.
4949

50+
### Create a resource group
51+
5052
1. Sign-in to the [Azure portal](https://portal.azure.com).
5153

54+
1. In the portal, search for and select **Resource groups**.
55+
56+
1. Select **+ Create**.
57+
58+
1. On the **Basics** tab, enter or select the following values:
59+
60+
| Setting | Value |
61+
| ------- | ----- |
62+
| **Subscription** | Select your subscription. |
63+
| **Resource group** | Enter *myResourceGroup*. |
64+
| **Region** | Select **(US) East US 2**. |
65+
66+
1. Select **Review + create**, and then select **Create**.
67+
68+
### Create a virtual network
69+
5270
1. In the search box at the top of the portal, enter **Virtual network**. Select **Virtual networks** in the search results.
5371

5472
1. Select **+ Create**.
@@ -59,7 +77,7 @@ In this section, you create a resource group and dual-stack virtual network for
5977
| ------- | ----- |
6078
| **Project details** | |
6179
| Subscription | Select your subscription. |
62-
| Resource group | Select **Create new**. </br> In **Name**, enter **myResourceGroup**. </br> Select **OK**. |
80+
| Resource group | Select **myResourceGroup**. |
6381
| **Instance details** | |
6482
| Name | Enter **myVNet**. |
6583
| Region | Select **East US 2**. |
@@ -317,6 +335,9 @@ In this section, you create the virtual machine and its supporting resources.
317335

318336
9. The private key downloads to your local computer. Copy the private key to a directory on your computer. In the following example, it's **~/.ssh**.
319337

338+
> [!NOTE]
339+
> The network security group created with the virtual machine blocks all inbound access from the internet, including SSH. To connect to the virtual machine, use Azure Bastion. For more information, see [Quickstart: Deploy Azure Bastion with default settings](../../bastion/quickstart-host-portal.md).
340+
320341
### Configure network interface
321342

322343
A network interface is automatically created and attached to the chosen virtual network during creation. In this section, you add the IPv6 configuration to the existing network interface.
@@ -350,6 +371,19 @@ A network interface is automatically created and attached to the chosen virtual
350371

351372
In this section, you create the virtual machine and its supporting resources.
352373

374+
### Create a network security group
375+
376+
Create a network security group with [az network nsg create](/cli/azure/network/nsg#az-network-nsg-create). The default rules in the network security group deny all inbound access from the internet.
377+
378+
```azurecli-interactive
379+
az network nsg create \
380+
--resource-group myResourceGroup \
381+
--name myNSG
382+
```
383+
384+
> [!NOTE]
385+
> The default rules of the network security group block all inbound access from the internet, including SSH. To connect to the virtual machine, use Azure Bastion. For more information, see [Quickstart: Deploy Azure Bastion with default settings](../../bastion/quickstart-host-portal.md).
386+
353387
### Create network interface
354388

355389
You use [az network nic create](/cli/azure/network/nic#az-network-nic-create) to create the network interface for the virtual machine. The public IP addresses and the NSG created previously are associated with the NIC. The network interface is attached to the virtual network you created previously.
@@ -398,6 +432,22 @@ Use [az vm create](/cli/azure/vm#az-vm-create) to create the virtual machine.
398432

399433
In this section, you create the virtual machine and its supporting resources.
400434

435+
### Create a network security group
436+
437+
Create a network security group with [New-AzNetworkSecurityGroup](/powershell/module/az.network/new-aznetworksecuritygroup). The default rules in the network security group deny all inbound access from the internet.
438+
439+
```azurepowershell-interactive
440+
$nsg = @{
441+
Name = 'myNSG'
442+
ResourceGroupName = 'myResourceGroup'
443+
Location = 'eastus2'
444+
}
445+
New-AzNetworkSecurityGroup @nsg
446+
```
447+
448+
> [!NOTE]
449+
> The default rules of the network security group block all inbound access from the internet, including SSH. To connect to the virtual machine, use Azure Bastion. For more information, see [Quickstart: Deploy Azure Bastion with default settings](../../bastion/quickstart-host-portal.md).
450+
401451
### Create network interface
402452

403453
You use [New-AzNetworkInterface](/powershell/module/az.network/new-aznetworkinterface) and [New-AzNetworkInterfaceIpConfig](/powershell/module/az.network/new-aznetworkinterfaceipconfig) to create the network interface for the virtual machine. The public IP addresses and the NSG created previously are associated with the NIC. The network interface is attached to the virtual network you created previously.
@@ -516,65 +566,173 @@ New-AzVM @vm -GenerateSshKey
516566

517567
---
518568

519-
## Test SSH connection
569+
## Install nginx
570+
571+
In this section, you create a network security group rule to allow HTTP traffic and install nginx on the virtual machine using the Run Command feature.
520572

521573
# [Azure portal](#tab/azureportal)
522574

523-
You connect to the virtual machine with SSH to test the IPv4 public IP address.
575+
### Create an inbound security rule
524576

525-
1. In the search box at the top of the portal, enter **Public IP address**. Select **Public IP addresses** in the search results.
577+
1. In the search box at the top of the portal, enter **Network security group**. Select **Network security groups** in the search results.
578+
579+
1. Select **myNSG**.
580+
581+
1. Select **Inbound security rules** in **Settings**.
582+
583+
1. Select **+ Add**.
584+
585+
1. Enter or select the following information:
586+
587+
| Setting | Value |
588+
| ------- | ----- |
589+
| Source | Leave the default of **Any**. |
590+
| Source port ranges | Leave the default of **\***. |
591+
| Destination | Leave the default of **Any**. |
592+
| Service | Select **HTTP**. |
593+
| Action | Leave the default of **Allow**. |
594+
| Priority | Enter **100**. |
595+
| Name | Enter *myNSGRuleHTTP*. |
596+
597+
1. Select **Add**.
598+
599+
### Install nginx with Run Command
600+
601+
1. In the search box at the top of the portal, enter **Virtual machine**. Select **Virtual machines** in the search results.
602+
603+
1. Select **myVM**.
526604

527-
2. Select **myPublicIP-IPv4**.
605+
1. In **Operations**, select **Run command**.
528606

529-
3. The public IPv4 address is in the **Overview** in **IP address**. In this example it's, **20.22.46.19**.
607+
1. Select **RunShellScript**.
530608

531-
4. Open an SSH connection to the virtual machine by using the following command. Replace the IP address with the IP address of your virtual machine. Replace **`azureuser`** with the username you chose during virtual machine creation. The **`-i`** is the path to the private key that you downloaded earlier. In this example, it's **~/.ssh/mySSHKey.pem**.
609+
1. Enter the following commands:
532610

533611
```bash
534-
ssh -i ~/.ssh/mySSHkey.pem [email protected]
612+
sudo apt-get update
613+
sudo apt-get install -y nginx
535614
```
615+
616+
1. Select **Run**.
617+
618+
1. Wait for the command to complete. The output pane displays **Enable succeeded** when complete.
619+
536620
# [Azure CLI](#tab/azurecli/)
537621

538-
Use [az network public-ip show](/cli/azure/network/public-ip#az-network-public-ip-show) to display the IP addresses of the virtual machine.
622+
### Create an inbound security rule
623+
624+
Use [az network nsg rule create](/cli/azure/network/nsg/rule#az-network-nsg-rule-create) to create a network security group rule to allow HTTP traffic.
539625

540626
```azurecli-interactive
541-
az network public-ip show \
627+
az network nsg rule create \
542628
--resource-group myResourceGroup \
543-
--name myPublicIP-IPv4 \
544-
--query ipAddress \
545-
--output tsv
629+
--nsg-name myNSG \
630+
--name myNSGRuleHTTP \
631+
--protocol '*' \
632+
--direction inbound \
633+
--source-address-prefix '*' \
634+
--source-port-range '*' \
635+
--destination-address-prefix '*' \
636+
--destination-port-range 80 \
637+
--access allow \
638+
--priority 100
546639
```
547640

641+
### Install nginx
642+
643+
Use [az vm run-command invoke](/cli/azure/vm/run-command#az-vm-run-command-invoke) to install nginx on the virtual machine.
644+
548645
```azurecli-interactive
549-
user@Azure:~$ az network public-ip show \
550-
> --resource-group myResourceGroup \
551-
> --name myPublicIP-IPv4 \
552-
> --query ipAddress \
553-
> --output tsv
554-
20.119.201.208
646+
az vm run-command invoke \
647+
--resource-group myResourceGroup \
648+
--name myVM \
649+
--command-id RunShellScript \
650+
--scripts "sudo apt-get update && sudo apt-get install -y nginx"
651+
```
652+
653+
# [Azure PowerShell](#tab/azurepowershell/)
654+
655+
### Create an inbound security rule
656+
657+
Use [Get-AzNetworkSecurityGroup](/powershell/module/az.network/get-aznetworksecuritygroup) and [Add-AzNetworkSecurityRuleConfig](/powershell/module/az.network/add-aznetworksecurityruleconfig) to create a network security group rule to allow HTTP traffic.
658+
659+
```azurepowershell-interactive
660+
## Place the network security group into a variable. ##
661+
$nsg = @{
662+
Name = 'myNSG'
663+
ResourceGroupName = 'myResourceGroup'
664+
}
665+
$nsgObj = Get-AzNetworkSecurityGroup @nsg
666+
667+
## Create the network security group rule. ##
668+
$nsgRule = @{
669+
Name = 'myNSGRuleHTTP'
670+
Protocol = '*'
671+
Direction = 'Inbound'
672+
Priority = 100
673+
SourceAddressPrefix = '*'
674+
SourcePortRange = '*'
675+
DestinationAddressPrefix = '*'
676+
DestinationPortRange = 80
677+
Access = 'Allow'
678+
}
679+
$nsgObj | Add-AzNetworkSecurityRuleConfig @nsgRule | Set-AzNetworkSecurityGroup
680+
```
681+
682+
### Install nginx
683+
684+
Use [Invoke-AzVMRunCommand](/powershell/module/az.compute/invoke-azvmruncommand) to install nginx on the virtual machine.
685+
686+
```azurepowershell-interactive
687+
$vm = @{
688+
ResourceGroupName = 'myResourceGroup'
689+
Name = 'myVM'
690+
CommandId = 'RunShellScript'
691+
ScriptString = 'sudo apt-get update && sudo apt-get install -y nginx'
692+
}
693+
Invoke-AzVMRunCommand @vm
555694
```
556695

696+
---
697+
698+
## Test dual-stack connectivity
699+
700+
Verify nginx is running by connecting to the public IPv4 address of the virtual machine.
701+
702+
# [Azure portal](#tab/azureportal)
703+
704+
1. In the search box at the top of the portal, enter **Public IP address**. Select **Public IP addresses** in the search results.
705+
706+
1. Select **myPublicIP-IPv4**.
707+
708+
1. Note the public IPv4 address in the **Overview** under **IP address**. In this example, it's **203.0.113.77**.
709+
710+
1. Open your web browser and browse to `http://203.0.113.77`. Replace the IP address with the public IPv4 address of your virtual machine.
711+
712+
1. The default nginx welcome page is displayed, confirming that the web server is running and accessible over IPv4.
713+
714+
# [Azure CLI](#tab/azurecli/)
715+
716+
Use [az network public-ip show](/cli/azure/network/public-ip#az-network-public-ip-show) to display the IP addresses of the virtual machine.
717+
557718
```azurecli-interactive
558719
az network public-ip show \
559720
--resource-group myResourceGroup \
560-
--name myPublicIP-IPv6 \
721+
--name myPublicIP-IPv4 \
561722
--query ipAddress \
562723
--output tsv
563724
```
564725
565-
```azurecli-interactive
566-
user@Azure:~$ az network public-ip show \
567-
> --resource-group myResourceGroup \
568-
> --name myPublicIP-IPv6 \
569-
> --query ipAddress \
570-
> --output tsv
571-
2603:1030:408:6::9d
572-
```
726+
Open your web browser and browse to the IPv4 address displayed. The default nginx welcome page confirms that the web server is running and accessible.
573727
574-
Open an SSH connection to the virtual machine by using the following command. Replace the IP address with the IP address of your virtual machine.
728+
Use the following command to display the IPv6 address:
575729
576730
```azurecli-interactive
577-
ssh [email protected]
731+
az network public-ip show \
732+
--resource-group myResourceGroup \
733+
--name myPublicIP-IPv6 \
734+
--query ipAddress \
735+
--output tsv
578736
```
579737
580738
# [Azure PowerShell](#tab/azurepowershell/)
@@ -589,13 +747,9 @@ $ip4 = @{
589747
Get-AzPublicIPAddress @ip4 | select IpAddress
590748
```
591749
592-
```azurepowershell-interactive
593-
PS /home/user> Get-AzPublicIPAddress @ip4 | select IpAddress
750+
Open your web browser and browse to the IPv4 address displayed. The default nginx welcome page confirms that the web server is running and accessible.
594751
595-
IpAddress
596-
---------
597-
20.72.115.187
598-
```
752+
Use the following command to display the IPv6 address:
599753
600754
```azurepowershell-interactive
601755
$ip6 = @{
@@ -605,20 +759,6 @@ $ip6 = @{
605759
Get-AzPublicIPAddress @ip6 | select IpAddress
606760
```
607761
608-
```azurepowershell-interactive
609-
PS /home/user> Get-AzPublicIPAddress @ip6 | select IpAddress
610-
611-
IpAddress
612-
---------
613-
2603:1030:403:3::1ca
614-
```
615-
616-
Open an SSH connection to the virtual machine by using the following command. Replace the IP address with the IP address of your virtual machine.
617-
618-
```azurepowershell-interactive
619-
ssh [email protected]
620-
```
621-
622762
---
623763
624764
## Clean up resources

0 commit comments

Comments
 (0)