azure-firewall-demo/run.ps1 at main · JanneMattila/azure-firewall-demo

History

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

##################################

# _ _____

# / \ ____ | ___|_ __

# / _ \ |_ / | |_ \ \ /\ / /

# / ___ \ / / | _| \ V V /

# /_/ \_\/___| |_| \_/\_/

# demo script

##################################

# Remember to update you Azure Az PowerShell module!

# https://learn.microsoft.com/en-us/powershell/azure/install-az-ps?view=azps-7.0.0

Update-Module Az

# Remember to install Bicep!

# https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/install#azure-powershell

bicep --version # 0.4.1124 or newer

# Login to Azure

# *Explicitly* select your working context

Select-AzSubscription -Subscription "<YourSubscriptionName>"

# Run deployment

Set-Location .\deploy\

# To understand the demo structure better, see tree of directories

tree

$username = "jumpboxuser"

$plainTextPassword = (New-Guid).ToString() + (New-Guid).ToString().ToUpper()

$plainTextPassword

$password = ConvertTo-SecureString -String $plainTextPassword -AsPlainText

$resourceGroupName = "rg-azure-firewall-demo"

# Run deployment in single command

$global:result = .\deploy.ps1 -Username $username -Password $password -ResourceGroupName $resourceGroupName

# Run deployment using multi-line command to print the deployment duration (you need to execute all lines)

Measure-Command -Expression {

$global:result = .\deploy.ps1 `

-Username $username `

-Password $password `

-ResourceGroupName $resourceGroupName

} | Format-Table

# Note: If you get deployment errors, then you can see details in either:

# - Resource Group -> Activity log

# - Resource Group -> Deployments

$bastion = $result.Outputs.bastionName.value

$virtualMachineResourceId = $result.Outputs.virtualMachineResourceId.value

$bastion

$virtualMachineResourceId

# Few notes about deployment:

# - Same deployment can be executed in pipeline

# by Azure AD Service Principal

# - You can deploy this to multiple resources groups

# - This is extremely handy since deleting also takes time

# - Initial deployment takes roughly 30 minutes

# - Incremental deployments take roughly 15 minutes

###############################

# ____

# | _ \ ___ _ __ ___ ___

# | | | |/ _ \ '_ ` _ \ / _ \

# | |_| | __/ | | | | | (_) |

# |____/ \___|_| |_| |_|\___/

# script

###############################

# 1. Open VM Blade -> Connect -> Bastion

# 2. Use following credentials:

$username

$username | clip

$plainTextPassword

$plainTextPassword | clip

# Connect to a VM using Bastion and the native client on your Windows computer

# https://learn.microsoft.com/en-us/azure/bastion/connect-native-client-windows

az login -o none

az extension add --upgrade --yes --name bastion

az extension add --upgrade --yes --name ssh

az network bastion ssh `

--name $bastion `

--resource-group $resourceGroupName `

--target-resource-id $virtualMachineResourceId `

--username $username `

--auth-type password

# Now you can execute commands from our jumpbox

spoke1="http://10.1.0.4"

spoke2="http://10.2.0.4"

spoke3="http://10.3.0.4"

curl $spoke1

# -> <html><body>Hello

curl $spoke2

# -> <html><body>Hello

curl $spoke3

# -> <html><body>Hello

# Test outbound internet accesses

BODY=$(echo "HTTP GET \"https://github.com\"")

curl -X POST --data "$BODY" "$spoke1/api/commands" # OK (via firewall)

curl -X POST --data "$BODY" "$spoke2/api/commands" # Deny