Skip to main content

Connecting VMs Together in a Virtual Network (Azure)

Spinning circle, Azure VMs in a Virtual Network

Check out a better formatted version of this post here, on my Notion.

Here - Don't be dismayed by the instructions.

The GUI Way? Peering VNets. The Powershell way? A bit more involved.


Today's Events:

  • Configure a network security group + security rules using Powershell.
  • The application server should connect to the database server over HTTP.
  • BUT the database server shouldn't use HTTP to connect to the application server.


The first hurdle was getting the command to work.


tion>rg=Paolin
At line:1 char:39
+ az group create --name $rg --location rg=Paolin
+                                       ~
The '<' operator is reserved for future use.
+ CategoryInfo          : ParserError: (:) [], ParentContainsErrorRecordException
+ FullyQualifiedErrorId : RedirectionNotSupported
Until I tried it in bash:

rg = 32
az group create --name $rg --location eastus


Some numbers are changed below.

{
  "id": "/subscriptions/a78373f1-5023-41fe-ae36-d0742026d72f/resourceGroups/32",
  "location": "eastus",
  "managedBy": null,
  "name": "32",
  "properties": {
    "provisioningState": "Succeeded"
  },
  "tags": null,
  "type": "Microsoft.Resources/resourceGroups"
}

I made a new subnet, named it (Apps), addressed it, and tied it to a group:

m@Azure:~$ az network vnet create \
> --resource-group $rg \
> --name ERP-Servers \
> --address-prefix 10.0.0.0/16 \
> --subnet-name Apps \
> --subnet-prefix 10.0.0.0/24
There's a lot of return information:
  • DDoS protection is not enabled (This resource will have been shut off by the time this posts)
  • Provisioning state has succeeded.
  • No BGP communities
  • Private Endpoint Network Policies are Enabled

I repeat it for the Databases subnet:

az network vnet subnet create \
    --resource-group $rg \
    --vnet-name ERP-servers \
    --address-prefix 10.0.1.0/24 \
    --name Databases

The commands look similar, but they are not - one has subnet create, the other only create. They are both in Resource Group 32, but have different address prefix allotments.

Finally; The Network Security Group.

az network nsg create \
    --resource-group $rg \
    --name ERP-SERVERS-NSG

It's given a type of "Microsoft.Network/networkSecurityGroups" in Resource Group 32.


Now for the Ubuntu VMs:

wget -N https://raw.githubusercontent.com/MicrosoftDocs/mslearn-secure-and-isolate-with-nsg-and-service-endpoints/master/cloud-init.yml && \ Pulling the appropriate code from Microsoft's GitHub repository
az vm create \
    --resource-group $rg \ 32
    --name AppServer \
    --vnet-name ERP-servers \
    --subnet Applications \
    --nsg ERP-SERVERS-NSG \
    --image UbuntuLTS \
    --size Standard_B1ls \
    --admin-username azureuser \
    --custom-data cloud-init.yml \
    --no-wait \
    --admin-password
(Entered, but not shown here) this isn't the real PW!

So, I'm not a person who likes to follow the directions to the letter when learning. What do you learn if you just copy and paste commands?

Can you see the error above?

Yes, my Applications subnet is called Apps. The code spells it out Applications. So I end up deleting and remaking the resource groups while following the instructions. At least it's a learning experience!

So now we have Databases, Applications, and a Network Security Group in Resource Group 32

Let's see how our VMs are running.


Name        Provisioned    Power
----------  -------------  ----------
AppServer   Succeeded      VM running
DataServer  Succeeded      VM running

Let's check our public IP addresses so we can SSH into them.



The next command has me putting those Public IPs to variables - In a Bash Shell! Could we always do this? Technology is amazing.

The connection times out initially because of an implicit deny all to outside traffic, and I fix that with a command that:
  • Allow SSH access
  • For servers in the Group
Can we connect now?

Connection timed out during banner exchange

Hm, not quite. The instructions say you may have to wait some minutes. I check the GUI, and the new rule is in place;


Also, seeing ⚠ and 'Succeeded' doesn't make a ton of sense to me, but whatever.

The resources are still there, so I can leave this and come back later.

I had to deviate from the instructions; Return later; Go to your VM inside your resource group, and click 'Connect' at the top ribbon. Copy the 'Login using VM local account' information.


And paste it into the Bash terminal.



Run it twice; The second time should ask for the password to the VM. As stated above, Azure has been having issues all day, and they come up again here; Includes a lot of time outs and not recognizing its own commands.

At the very least, I did get two VMs into the same Virtual Network.



Comments

Popular posts from this blog

Connecting IoT Devices to a Registration Server (Packet Tracer, Cisco)

In Packet Tracer, a demo software made by Cisco Systems. It certainly has changed a lot since 2016. It's almost an Olympic feat to even get started with it now, but it does look snazzy. This is for the new CCNA, that integrates, among other things, IoT and Automation, which I've worked on here before. Instructions here . I don't know if this is an aspect of "Let's make sure people are paying attention and not simply following blindly", or an oversight - The instructions indicate a Meraki Server, when a regular one is the working option here. I have to enable the IoT service on this server. Also, we assign the server an IPv4 address from a DHCP pool instead of giving it a static one. For something that handles our IoT business, perhaps that's safer; Getting a new IPv4 address every week or so is a minimal step against an intruder, but it is a step. There are no devices associated with this new server; In an earlier lab (not shown), I attached them to 'H

Securing Terraform and You Part 1 -- rego, Tfsec, and Terrascan

9/20: The open source version of Terraform is now  OpenTofu     Sometimes, I write articles even when things don't work. It's about showing a learning process.  Using IaC means consistency, and one thing you don't want to do is have 5 open S3 buckets on AWS that anyone on the internet can reach.  That's where tools such as Terrascan and Tfsec come in, where we can make our own policies and rules to be checked against our code before we init.  As this was contract work, I can't show you the exact code used, but I can tell you that this blog post by Cesar Rodriguez of Cloud Security Musings was quite helpful, as well as this one by Chris Ayers . The issue is using Rego; I found a cool VS Code Extension; Terrascan Rego Editor , as well as several courses on Styra Academy; Policy Authoring and Policy Essentials . The big issue was figuring out how to tell Terrascan to follow a certain policy; I made it, put it in a directory, and ran the program while in that directory

Building, Breaking, and Building A CRM with Retool

 I like no- or low-code solutions to things. I've often wanted to simply push a button or move some GUI around and have the code implement itself.  I've thought about building something that's like a customer relationship management (CRM) system for keeping up with my network better than my little spreadsheet where I click links and then go like something. The general idea in this CRM Development is:  To have a GUI to add people to a NRM (Network Relationship Management).       Attach it to a database (MySQL is what I went with eventually using Amazon Relational Database service, but you can use PostGRES, and probably others).     Make sure components are connected to each other in the retool interface. This video is a good start. Watching the tutorial video, heard some SQL commands and went 'Oh no 😳" before going "Wait I know basic SQL", which is good, because you'll see.  When you get set up, there's a plethora of resources you can use -- Incl