|
1 | 1 | In this exercise, you configure the access to the virtual machine (VM) you created earlier in this module. |
2 | 2 |
|
3 | | -> [!IMPORTANT] |
4 | | -> The VM for this exercise was createdly previously in this module. If you deleted the VM or resource group created in unit 3, you'll need to redo the previous exercise (**Exercise - Create an Azure virtual machine**). |
5 | | -
|
6 | | -Right now, the VM you created and installed Nginx on during the previous exercise isn't accessible from the internet. In this exercise, you'll create a network security group that changes that by allowing inbound HTTP access on port 80. |
7 | | - |
8 | | -> [!NOTE] |
9 | | -> It's important that you're in the BASH version of Cloud Shell for some of the commands in this exercise. You can use the **Switch to...** button if you're currently in PowerShell mode. |
10 | | -
|
11 | | -## Task 1: Access your web server |
12 | | - |
13 | | -In this procedure, you get the IP address for your VM and attempt to access your web server's home page. |
14 | | - |
15 | | -1. Run the following `az vm list-ip-addresses` command to get your VM's IP address and store the result as a Bash variable: |
16 | | - |
17 | | - ```bash |
18 | | - IPADDRESS="$(az vm list-ip-addresses \ |
19 | | - --resource-group "IntroAzureRG" \ |
20 | | - --name my-vm \ |
21 | | - --query "[].virtualMachine.network.publicIpAddresses[*].ipAddress" \ |
22 | | - --output tsv)" |
23 | | - ``` |
24 | | -2. Run the following `curl` command to download the home page: |
25 | | - |
26 | | - ```bash |
27 | | - curl --connect-timeout 5 http://$IPADDRESS |
28 | | - ``` |
29 | | - |
30 | | - The `--connect-timeout` argument specifies to allow up to five seconds for the connection to occur. After five seconds, you see an error message that states that the connection timed out: |
31 | | - |
32 | | - ```output |
33 | | - curl: (28) Connection timed out after 5001 milliseconds |
34 | | - ``` |
35 | | - |
36 | | - This message means that the VM wasn't accessible within the timeout period. |
37 | | -3. As an optional step, try to access the web server from a browser: |
38 | | - |
39 | | - |
40 | | - 1. Run the following to print your VM's IP address to the console: |
41 | | - |
42 | | - ```bash |
43 | | - echo $IPADDRESS |
44 | | - ``` |
45 | | - |
46 | | - You see an IP address, for example, *23.102.42.235*. |
47 | | - 2. Copy the IP address that you see to the clipboard. |
48 | | - 3. Open a new browser tab and go to your web server. After a few moments, you see that the connection isn't happening. If you wait for the browser to time out, you see something like this: |
49 | | - |
50 | | - :::image type="content" source="../media/browser-request-timeout-d7cc0e02.png" alt-text="Screenshot of a web browser showing an error message that says the connection timed out."::: |
51 | | - |
52 | | - 4. Keep this browser tab open for later. |
53 | | -
|
54 | | -## Task 2: List the current network security group rules |
55 | | -
|
56 | | -Your web server wasn't accessible. To find out why, let's examine your current NSG rules. |
57 | | -
|
58 | | -1. Run the following `az network nsg list` command to list the network security groups that are associated with your VM: |
59 | | - |
60 | | - ```azurecli |
61 | | - az network nsg list \ |
62 | | - --resource-group "IntroAzureRG" \ |
63 | | - --query '[].name' \ |
64 | | - --output tsv |
65 | | - ``` |
66 | | - |
67 | | - You see this output: |
68 | | - |
69 | | - ```output |
70 | | - my-vmNSG |
71 | | - ``` |
72 | | - |
73 | | - Every VM on Azure is associated with at least one network security group. In this case, Azure created an NSG for you called *my-vmNSG*. |
74 | | -2. Run the following `az network nsg rule list` command to list the rules associated with the NSG named *my-vmNSG*: |
75 | | - |
76 | | - ```azurecli |
77 | | - az network nsg rule list \ |
78 | | - --resource-group "IntroAzureRG" \ |
79 | | - --nsg-name my-vmNSG |
80 | | - ``` |
81 | | - |
82 | | - You see a large block of text in JSON format in the output. In the next step, you'll run a similar command that makes this output easier to read. |
83 | | -3. Run the `az network nsg rule list` command a second time. This time, use the `--query` argument to retrieve only the name, priority, affected ports, and access (**Allow** or **Deny**) for each rule. The `--output` argument formats the output as a table so that it's easy to read. |
84 | | - |
85 | | - ```azurecli |
86 | | - az network nsg rule list \ |
87 | | - --resource-group "IntroAzureRG" \ |
88 | | - --nsg-name my-vmNSG \ |
89 | | - --query '[].{Name:name, Priority:priority, Port:destinationPortRange, Access:access}' \ |
90 | | - --output table |
91 | | - ``` |
92 | | - |
93 | | - You see this output: |
94 | | - |
95 | | - ```output |
96 | | - Name Priority Port Access |
97 | | - ----------------- ---------- ------ -------- |
98 | | - default-allow-ssh 1000 22 Allow |
99 | | - ``` |
100 | | - |
101 | | - You see the default rule, *default-allow-ssh*. This rule allows inbound connections over port 22 (SSH). SSH (Secure Shell) is a protocol that's used on Linux to allow administrators to access the system remotely. The priority of this rule is 1000. Rules are processed in priority order, with lower numbers processed before higher numbers. |
102 | | - |
103 | | -By default, a Linux VM's NSG allows network access only on port 22. This port enables administrators to access the system. You need to also allow inbound connections on port 80, which allows access over HTTP. |
104 | | -
|
105 | | -## Task 3: Create the network security rule |
106 | | -
|
107 | | -Here, you create a network security rule that allows inbound access on port 80 (HTTP). |
108 | | -
|
109 | | -1. Run the following `az network nsg rule create` command to create a rule called *allow-http* that allows inbound access on port 80: |
110 | | - |
111 | | - ```azurecli |
112 | | - az network nsg rule create \ |
113 | | - --resource-group "IntroAzureRG" \ |
114 | | - --nsg-name my-vmNSG \ |
115 | | - --name allow-http \ |
116 | | - --protocol tcp \ |
117 | | - --priority 100 \ |
118 | | - --destination-port-range 80 \ |
119 | | - --access Allow |
120 | | - ``` |
121 | | - |
122 | | - For learning purposes, here you set the priority to 100. In this case, the priority doesn't matter. You would need to consider the priority if you had overlapping port ranges. |
123 | | -2. To verify the configuration, run `az network nsg rule list` to see the updated list of rules: |
124 | | - |
125 | | - ```azurecli |
126 | | - az network nsg rule list \ |
127 | | - --resource-group "IntroAzureRG" \ |
128 | | - --nsg-name my-vmNSG \ |
129 | | - --query '[].{Name:name, Priority:priority, Port:destinationPortRange, Access:access}' \ |
130 | | - --output table |
131 | | - ``` |
132 | | - |
133 | | - You see both the *default-allow-ssh* rule and your new rule, *allow-http*: |
134 | | - |
135 | | - ```output |
136 | | - Name Priority Port Access |
137 | | - ----------------- ---------- ------ -------- |
138 | | - default-allow-ssh 1000 22 Allow |
139 | | - allow-http 100 80 Allow |
140 | | - ``` |
141 | | - |
142 | | -## Task 4: Access your web server again |
143 | | - |
144 | | -Now that you configured network access to port 80, let's try to access the web server a second time. |
| 3 | +Launch the exercise and follow the instructions. |
145 | 4 |
|
146 | 5 | > [!NOTE] |
147 | | -> After you update the NSG, it may take a few moments before the updated rules propagate. Retry the next step, with pauses between attempts, until you get the desired results. |
148 | | -
|
149 | | -1. Run the same `curl` command that you ran earlier: |
150 | | - |
151 | | - ```bash |
152 | | - curl --connect-timeout 5 http://$IPADDRESS |
153 | | - ``` |
154 | | - |
155 | | - You see this response: |
156 | | - |
157 | | - ```html |
158 | | - <html><body><h2>Welcome to Azure! My name is my-vm.</h2></body></html> |
159 | | - ``` |
160 | | -2. As an optional step, refresh your browser tab that points to your web server. You see the home page: |
161 | | - |
162 | | - :::image type="content" source="../media/browser-request-successful-df21c6f1.png" alt-text="A screenshot of a web browser showing the home page from the web server. The home page displays a welcome message."::: |
163 | | - |
164 | | -
|
165 | | -Nice work. In practice, you can create a standalone network security group that includes the inbound and outbound network access rules you need. If you have multiple VMs that serve the same purpose, you can assign that NSG to each VM at the time you create it. This technique enables you to control network access to multiple VMs under a single, central set of rules. |
166 | | -
|
167 | | -You've completed this exercise and all of the exercises for this module. To clean up your Azure environment and avoid leaving VMs running when not in use, delete the **IntroAzureRG** resource group. |
| 6 | +> You'll need access to a Microsoft Azure subscription to complete this exercise. |
168 | 7 |
|
169 | | -## Clean up |
170 | | -1. From the Azure home page, under Azure services, select **Resource groups**. |
171 | | -1. Select the **IntroAzureRG** resource group. |
172 | | -1. Select **Delete resource group**. |
173 | | -1. Enter `IntroAzureRG` to confirm deletion of the resource group and select delete. |
| 8 | +[](https://microsoftlearning.github.io/AZ-900-Microsoft-Azure-Fundamentals/Instructions/Labs/03-exercise-create-azure-virtual-machine.html) |
0 commit comments