The Designing and Implementing Microsoft Azure Networking Solutions (AZ-700)

Here are the steps and explanations for configuring VNET1 to log all events and metrics and query them by using KQL:

To en able logging for VNET1, you need to create a diagnostic setting that collects the platform metrics and logs from the virtual network and routes them to one or more des tinations.  You can choose to send the data to a Log Analytics workspace, a storage account, an event hub, or a partner solution 1 .

To create a diagnostic setting, you need to go to the Azure portal and select your virtual network.  Then select Diagnostic settings under Monitoring and select + Add diagnostic s etting 1 .

On the Add diagnostic setting page, enter or select the following information:

Diagnostic setting name: Type a unique name for your diagnostic setting.

Destination details: Select the desti nation where you want to send the data. For example, you can select Send to Log Analytics workspace and choose your workspace from the list.

Log: Select the categories of logs that you want to collect.  For VNET1, you can select NetworkSecurityGro up Event and NetworkSecurityGroupRuleCounter as the log categories 2 .

Metric: Select AllMetrics to collect all the platform m etrics for VNET1 2 .

Select Save to create your diagnostic se tting 1 .

To query the events a nd metrics from the Azure portal by using KQL, you need to go to the Log Analytics workspace that you selected as the destination.  Then select Logs under Gener al and enter your KQ L query in the query editor 3 .

For example, you can use the following KQL query to get the top 10 network security group events for VNET1 in the last 24 hours:

NetworkSecurityGroupEvent

| where TimeGenerated > ago(24h)

| where ResourceId contains " VNET1 "

| summarize count() by EventID

| top 10 by count_

Copy

Select Run to execute your query and view the re sults in a tabl e or a chart 3 .

Here are the steps and explanations for ensuring that the storage34280945 storage account will only accept con nections from hosts on VNET1:

To restrict network access to your storage account, you need to configure the Azure Storage firewall and virtual network settings for your storage account.  You can do this in the Azure portal by selecti ng your storage account and then selecting  Networki ng  under  Settings 1 .

O n the  Networking   page, select  Firewalls and virtual networks , and then select  Selected ne tworks  under  Allow access from 1 . This will block all access to your storage account except from the networks or resources that you specify.

Under Virtual netwo rks, select + Add existing virtual network.  Then select VNET1 from the list of virtual networks and select the sub net that c ontains the hosts that you want to allow access to y our storage acco unt 1 .  This will enable a service endpoin t for Storage in the sub net and configure a virtual network rule f or that subnet through the Azure storage firewall 2 .

Select  Add  to add the virtual network and subnet to your storage accoun t 1 .

Select  Save  to apply your changes 1 .

To configure a policy in Azure API Management that can be used by an Azure Application Gateway to protect against known web attack vectors and only allow requests from IP addresses in Canada, follow these steps:

Step-by-Step Solution

Step 1: Create or Access Your API Management Instance

Navigate to the Azure Portal .

Search for “API Management services”  and select your API Management instance.

Step 2: Configure the Policy

In the API Management instance , go to the  “APIs”  section.

Select the API  you want to apply the policy to.

Go to the “Design” tab .

Select “All operations”  if you want to apply the policy to all operations, or select a specific operation.

Step 3: Add the Inbound Policy

In the Inbound processing section , click on  “+ Add policy” .

Select “IP filter”  from the list of policies.

Add the IP address ranges for Canada . You can find the IP ranges for Canada from a reliable source or use a service that provides this information.

Here is an example of the XML configuration for the policy:

< inbound >

< ip-filter action= " allow " >

< address-range from= " 24.0.0.0 " to= " 24.255.255.255 " / >

< address-range from= " 47.0.0.0 " to= " 47.255.255.255 " / >

< !-- Add other Canadian IP ranges as needed -- >

< /ip-filter >

< ip-filter action= " deny " >

< address-range from= " 0.0.0.0 " to= " 255.255.255.255 " / >

< /ip-filter >

< /inbound >

Save the policy  to apply the changes.

Explanation

IP Filter Policy : This policy allows you to filter incoming requests based on their IP addresses. By specifying the IP ranges for Canada, you ensure that only requests originating from these IPs are allowed.

Inbound Processing : Applying the policy in the inbound section ensures that the requests are filtered before they reach your API.

By following these steps, you can configure a polic y in Azure API Management that res tricts a ccess to your API to only those requests ori ginating from IP ad dresses in Canada, thereby enhancing security and compliance

To prevent all Azure hosts outside of subnet1-2 from conne cting to TCP port 5585 on hosts within subnet1-2, you can use a  Network Security Group (NSG) . This solution is straightforward and minimizes administrative effort.

Step-by-Step Solution

Step 1: Create a Network Security Group (NSG)

Navigate to the Azure Portal .

Search for “Network security groups”  and select it.

Click on “Create” .

Enter the following details :

Subscription : Select your subscription.

Resource Group : Select an existing resource group or create a new one.

Name : Enter a name for the NSG (e.g.,  NSG-Subnet1-2).

Region : Select the region where your virtual network is located.

Click on “Review + create”  and then  “Create” .

Step 2: Create an Inbound Security Rule

Navigate to the newly created NSG .

Select “Inbound security rules”  from the left-hand me nu.

Click on “Add”  to create a new rule.

Enter the following details :

Source : Select  Service Tag .

Source Service Tag : Select  VirtualNetwork .

Source port ranges : Leave as *.

Destination : Select  IP Addresses .

Destination IP addresses/CIDR ranges : Enter the IP range of subnet1-2 (e.g., 10.1.2.0/24).

Destination port ranges : Enter 5585.

Protocol : Select  TCP .

Action : Select  Deny .

Priority : Enter a priority value (e.g., 100).

Name : Enter a name for the rule (e.g., Deny-TCP-5585).

Click on “Add”  to create the rul e.

Step 3: Associate the NSG with Subnet1-2

Navigate to the virtual network  that contains subnet1-2.

Select “Subnets”  from the left-hand menu.

Select subnet1-2  from the list of subnets.

Click on “Network security group” .

Select the NSG  you created (NSG-Subnet1-2).

Click on “Save” .

Explanation

Network Security Group (NSG) : NSGs are used to filter network traffic to and from Azure resources in an Azure virtual network.  They contain security rules tha t allow or deny inbound and outbound traffic based on source and destination IP addresses, port, and pr otocol 1 .

Inbound Security Rule : By creating a rule that denies traffic on TCP port 5585 from any source outside of subnet1-2, you ensure that only hosts within subnet1-2 can connect to this port.

Association with Subnet : Associating the NSG with subnet1-2 ensures that the security rules are applied to all resources within this subnet.

By following these steps, you can effectively prevent all Azure hosts outside of subnet1-2 from connecting to TCP port 5585 on hosts within subnet1-2, while minimizing administrative effort.