From 8ebff93719106604a4e4f42bffc77f95df9cb067 Mon Sep 17 00:00:00 2001 From: Asir Vedamuthu Selvasingh Date: Thu, 23 Jun 2016 15:06:20 -0700 Subject: [PATCH 1/3] first version of network security group sample --- .../samples/ManageNetworkInterface.java | 10 +- .../samples/ManageNetworkSecurityGroup.java | 233 +++++++++++++++++- 2 files changed, 231 insertions(+), 12 deletions(-) diff --git a/azure-samples/src/main/java/com/microsoft/azure/management/network/samples/ManageNetworkInterface.java b/azure-samples/src/main/java/com/microsoft/azure/management/network/samples/ManageNetworkInterface.java index cecc07167972..288f59eb3531 100644 --- a/azure-samples/src/main/java/com/microsoft/azure/management/network/samples/ManageNetworkInterface.java +++ b/azure-samples/src/main/java/com/microsoft/azure/management/network/samples/ManageNetworkInterface.java @@ -23,11 +23,11 @@ import java.util.Date; /** - * Azure Network sample for managing network interfaces - - * - Create a virtual machine with multiple network interfaces - * - Configure a network interface - * - List network interfaces - * - Delete a network interface. + *

Azure Network sample for managing network interfaces -

+ *

- Create a virtual machine with multiple network interfaces

+ *

- Configure a network interface

+ *

- List network interfaces

+ *

- Delete a network interface.

*/ public final class ManageNetworkInterface { diff --git a/azure-samples/src/main/java/com/microsoft/azure/management/network/samples/ManageNetworkSecurityGroup.java b/azure-samples/src/main/java/com/microsoft/azure/management/network/samples/ManageNetworkSecurityGroup.java index 7a594b114451..ac2402faf8fa 100644 --- a/azure-samples/src/main/java/com/microsoft/azure/management/network/samples/ManageNetworkSecurityGroup.java +++ b/azure-samples/src/main/java/com/microsoft/azure/management/network/samples/ManageNetworkSecurityGroup.java @@ -7,6 +7,22 @@ package com.microsoft.azure.management.network.samples; +import com.microsoft.azure.Azure; +import com.microsoft.azure.management.compute.KnownWindowsVirtualMachineImage; +import com.microsoft.azure.management.compute.VirtualMachine; +import com.microsoft.azure.management.compute.implementation.api.VirtualMachineSizeTypes; +import com.microsoft.azure.management.network.Network; +import com.microsoft.azure.management.network.NetworkInterface; +import com.microsoft.azure.management.network.NetworkSecurityGroup; +import com.microsoft.azure.management.network.NetworkSecurityRule; +import com.microsoft.azure.management.resources.fluentcore.arm.Region; +import com.microsoft.azure.management.resources.fluentcore.utils.ResourceNamer; +import com.microsoft.azure.management.samples.Utils; +import okhttp3.logging.HttpLoggingInterceptor; + +import java.io.File; +import java.util.Date; + /** * Azure Network sample for managing network security groups - * - Create a network security group for the front end of a subnet @@ -24,20 +40,223 @@ public final class ManageNetworkSecurityGroup { */ public static void main(String[] args) { + final String frontEndNSGName = ResourceNamer.randomResourceName("fensg", 24); + final String backEndNSGName = ResourceNamer.randomResourceName("bensg", 24); + final String rgName = ResourceNamer.randomResourceName("rgNEMS", 24); + final String vnetName = ResourceNamer.randomResourceName("vnet", 24); + final String networkInterfaceName1 = ResourceNamer.randomResourceName("nic1", 24); + final String networkInterfaceName2 = ResourceNamer.randomResourceName("nic2", 24); + final String publicIpAddressLeafDNS1 = ResourceNamer.randomResourceName("pip1", 24); + final String vmName = ResourceNamer.randomResourceName("vm", 24); + final String userName = "tirekicker"; + final String password = "12NewPA$$w0rd!"; + + try { - // Create a network security group for the front end of a subnet + //============================================================= + // Authenticate + + final File credFile = new File("my.azureauth"); + + Azure azure = Azure + .configure() + .withLogLevel(HttpLoggingInterceptor.Level.BASIC) + .authenticate(credFile) + .withDefaultSubscription(); + + // Print selected subscription + System.out.println("Selected subscription: " + azure.subscriptionId()); + + try { + + // Define a virtual network for VMs in this availability set + + System.out.println("Creating a virtual network ..."); + + Network network = azure.networks() + .define(vnetName) + .withRegion(Region.US_EAST) + .withNewGroup(rgName) + .withAddressSpace("172.16.0.0/16") + .defineSubnet("Front-end") + .withAddressPrefix("172.16.1.0/24") + .attach() + .defineSubnet("Back-end") + .withAddressPrefix("172.16.2.0/24") + .attach() + .create(); + + + //============================================================ + // Create a network security group for the front end of a subnet + // front end subnet contains two rules + // - ALLOW-SSH - allows SSH traffic into the front end subnet + // - ALLOW-WEB- allows HTTP traffic into the front end subnet + + System.out.println("Creating a security group for the front end - allows SSH and Web"); + NetworkSecurityGroup frontEndNSG = azure.networkSecurityGroups().define(frontEndNSGName) + .withRegion(Region.US_EAST) + .withNewGroup(rgName) + .defineRule("ALLOW-SSH") + .allowInbound() + .fromAnyAddress() + .fromAnyPort() + .toAnyAddress() + .toPort(22) + .withProtocol(NetworkSecurityRule.Protocol.TCP) + .withPriority(100) + .withDescription("Allow SSH") + .attach() + .defineRule("ALLOW-HTTP") + .allowInbound() + .fromAnyAddress() + .fromAnyPort() + .toAnyAddress() + .toPort(80) + .withProtocol(NetworkSecurityRule.Protocol.TCP) + .withPriority(101) + .withDescription("Allow HTTP") + .attach() + .create(); + + System.out.println("Created a security group for the front end: " + frontEndNSG.id()); + Utils.print(frontEndNSG); + + + //============================================================ + // Create a network security group for the back end of a subnet + // back end subnet contains two rules + // - ALLOW-SQL - allows SQL traffic only from the front end subnet + // - DENY-WEB - denies all internet bound traffic from the back end subnet + + System.out.println("Creating a security group for the front end - allows SSH and Web"); + NetworkSecurityGroup backEndNSG = azure.networkSecurityGroups().define(backEndNSGName) + .withRegion(Region.US_EAST) + .withExistingGroup(rgName) + .defineRule("ALLOW-SQL") + .allowInbound() + .fromAddress("172.16.1.0/24") + .fromAnyPort() + .toAnyAddress() + .toPort(1433) + .withProtocol(NetworkSecurityRule.Protocol.TCP) + .withPriority(100) + .withDescription("Allow SQL") + .attach() + .defineRule("DENY-WEB") + .denyOutbound() + .fromAnyAddress() + .fromAnyPort() + .toAnyAddress() + .toAnyPort() + .withAnyProtocol() + .withDescription("Deny Web") + .withPriority(200) + .attach() + .create(); + + System.out.println("Created a security group for the back end: " + backEndNSG.id()); + Utils.print(backEndNSG); + + + System.out.println("Created a virtual network: " + network.id()); + Utils.print(network); + + System.out.println("Creating multiple network interfaces"); + System.out.println("Creating network interface 1"); + + NetworkInterface networkInterface1 = azure.networkInterfaces().define(networkInterfaceName1) + .withRegion(Region.US_EAST) + .withExistingGroup(rgName) + .withExistingPrimaryNetwork(network) + .withSubnet("Front-end") + .withPrimaryPrivateIpAddressDynamic() + .withNewPrimaryPublicIpAddress(publicIpAddressLeafDNS1) + .withIpForwarding() + .create(); + + System.out.println("Created network interface 1"); + Utils.print(networkInterface1); + + + System.out.println("Applying front end network security group to network interface 1"); + networkInterface1.update() + .withExistingNetworkSecurityGroup(frontEndNSG) + .apply(); + System.out.println("Applied front end network security group to network interface 1"); + + + System.out.println("Creating network interface 2"); + NetworkInterface networkInterface2 = azure.networkInterfaces().define(networkInterfaceName2) + .withRegion(Region.US_EAST) + .withExistingGroup(rgName) + .withExistingPrimaryNetwork(network) + .withSubnet("Back-end") + .withPrimaryPrivateIpAddressDynamic() + .create(); + + System.out.println("Created network interface 2"); + Utils.print(networkInterface2); + + System.out.println("Applying front end network security group to network interface 2"); + networkInterface2.update() + .withExistingNetworkSecurityGroup(backEndNSG) + .apply(); + System.out.println("Applied front end network security group to network interface 2"); + + //============================================================= + // Create a virtual machine with multiple network interfaces + + System.out.println("Creating a Windows VM"); + + Date t1 = new Date(); + + VirtualMachine vm = azure.virtualMachines().define(vmName) + .withRegion(Region.US_EAST) + .withExistingGroup(rgName) + .withExistingPrimaryNetworkInterface(networkInterface1) + .withPopularWindowsImage(KnownWindowsVirtualMachineImage.WINDOWS_SERVER_2012_R2_DATACENTER) + .withAdminUserName(userName) + .withPassword(password) + .withSize(VirtualMachineSizeTypes.STANDARD_D3_V2) + .create(); + + Date t2 = new Date(); + System.out.println("Created VM: (took " + + ((t2.getTime() - t1.getTime()) / 1000) + " seconds) " + vm.id()); + // Print virtual machine details + Utils.print(vm); + + + // List network security groups + + // Attach network security groups to a VM + + // Update a network security group - // Create a network security group fro the back end of a subnet + // Delete a network security group - // List network security groups + } catch (Exception f) { - // Update a network security group + System.out.println(f.getMessage()); + f.printStackTrace(); - // Delete a network security group + } finally { - } catch (Exception e) { - System.err.println(e.getMessage()); + try { + System.out.println("Deleting Resource Group: " + rgName); + azure.resourceGroups().delete(rgName); + System.out.println("Deleted Resource Group: " + rgName); + } catch (NullPointerException npe) { + System.out.println("Did not create any resources in Azure. No clean up is necessary"); + } catch (Exception g) { + g.printStackTrace(); + } + } + } catch (Exception e){ + System.out.println(e.getMessage()); + e.printStackTrace(); } } From 9683779dd405193a3dfb410f27c3d40c00bb483d Mon Sep 17 00:00:00 2001 From: Asir Vedamuthu Selvasingh Date: Thu, 23 Jun 2016 16:29:53 -0700 Subject: [PATCH 2/3] flushed out network security group sample :) --- .../samples/ManageNetworkSecurityGroup.java | 212 ++++++++++++------ 1 file changed, 139 insertions(+), 73 deletions(-) diff --git a/azure-samples/src/main/java/com/microsoft/azure/management/network/samples/ManageNetworkSecurityGroup.java b/azure-samples/src/main/java/com/microsoft/azure/management/network/samples/ManageNetworkSecurityGroup.java index ac2402faf8fa..446df03cea1e 100644 --- a/azure-samples/src/main/java/com/microsoft/azure/management/network/samples/ManageNetworkSecurityGroup.java +++ b/azure-samples/src/main/java/com/microsoft/azure/management/network/samples/ManageNetworkSecurityGroup.java @@ -8,12 +8,12 @@ package com.microsoft.azure.management.network.samples; import com.microsoft.azure.Azure; -import com.microsoft.azure.management.compute.KnownWindowsVirtualMachineImage; +import com.microsoft.azure.management.compute.KnownLinuxVirtualMachineImage; import com.microsoft.azure.management.compute.VirtualMachine; import com.microsoft.azure.management.compute.implementation.api.VirtualMachineSizeTypes; import com.microsoft.azure.management.network.Network; -import com.microsoft.azure.management.network.NetworkInterface; import com.microsoft.azure.management.network.NetworkSecurityGroup; +import com.microsoft.azure.management.network.NetworkInterface; import com.microsoft.azure.management.network.NetworkSecurityRule; import com.microsoft.azure.management.resources.fluentcore.arm.Region; import com.microsoft.azure.management.resources.fluentcore.utils.ResourceNamer; @@ -22,14 +22,16 @@ import java.io.File; import java.util.Date; +import java.util.List; /** * Azure Network sample for managing network security groups - * - Create a network security group for the front end of a subnet - * - Create a network security group fro the back end of a subnet + * - Create a network security group for the back end of a subnet + * - Create Linux virtual machines for the front end and back end + * -- Apply network security groups * - List network security groups - * - Update a network security group - * - Delete a network security group. + * - Update a network security group. */ public final class ManageNetworkSecurityGroup { @@ -47,9 +49,11 @@ public static void main(String[] args) { final String networkInterfaceName1 = ResourceNamer.randomResourceName("nic1", 24); final String networkInterfaceName2 = ResourceNamer.randomResourceName("nic2", 24); final String publicIpAddressLeafDNS1 = ResourceNamer.randomResourceName("pip1", 24); - final String vmName = ResourceNamer.randomResourceName("vm", 24); + final String frontEndVMName = ResourceNamer.randomResourceName("fevm", 24); + final String backEndVMName = ResourceNamer.randomResourceName("bevm", 24); final String userName = "tirekicker"; final String password = "12NewPA$$w0rd!"; + final String sshKey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCfSPC2K7LZcFKEO+/t3dzmQYtrJFZNxOsbVgOVKietqHyvmYGHEC0J2wPdAqQ/63g/hhAEFRoyehM+rbeDri4txB3YFfnOK58jqdkyXzupWqXzOrlKY4Wz9SKjjN765+dqUITjKRIaAip1Ri137szRg71WnrmdP3SphTRlCx1Bk2nXqWPsclbRDCiZeF8QOTi4JqbmJyK5+0UqhqYRduun8ylAwKKQJ1NJt85sYIHn9f1Rfr6Tq2zS0wZ7DHbZL+zB5rSlAr8QyUdg/GQD+cmSs6LvPJKL78d6hMGk84ARtFo4A79ovwX/Fj01znDQkU6nJildfkaolH2rWFG/qttD azjava@javalib.com"; try { @@ -80,13 +84,15 @@ public static void main(String[] args) { .withNewGroup(rgName) .withAddressSpace("172.16.0.0/16") .defineSubnet("Front-end") - .withAddressPrefix("172.16.1.0/24") - .attach() + .withAddressPrefix("172.16.1.0/24") + .attach() .defineSubnet("Back-end") - .withAddressPrefix("172.16.2.0/24") - .attach() + .withAddressPrefix("172.16.2.0/24") + .attach() .create(); + System.out.println("Created a virtual network: " + network.id()); + Utils.print(network); //============================================================ // Create a network security group for the front end of a subnet @@ -94,30 +100,30 @@ public static void main(String[] args) { // - ALLOW-SSH - allows SSH traffic into the front end subnet // - ALLOW-WEB- allows HTTP traffic into the front end subnet - System.out.println("Creating a security group for the front end - allows SSH and Web"); + System.out.println("Creating a security group for the front end - allows SSH and HTTP"); NetworkSecurityGroup frontEndNSG = azure.networkSecurityGroups().define(frontEndNSGName) .withRegion(Region.US_EAST) .withNewGroup(rgName) .defineRule("ALLOW-SSH") - .allowInbound() - .fromAnyAddress() - .fromAnyPort() - .toAnyAddress() - .toPort(22) - .withProtocol(NetworkSecurityRule.Protocol.TCP) - .withPriority(100) - .withDescription("Allow SSH") - .attach() + .allowInbound() + .fromAnyAddress() + .fromAnyPort() + .toAnyAddress() + .toPort(22) + .withProtocol(NetworkSecurityRule.Protocol.TCP) + .withPriority(100) + .withDescription("Allow SSH") + .attach() .defineRule("ALLOW-HTTP") - .allowInbound() - .fromAnyAddress() - .fromAnyPort() - .toAnyAddress() - .toPort(80) - .withProtocol(NetworkSecurityRule.Protocol.TCP) - .withPriority(101) - .withDescription("Allow HTTP") - .attach() + .allowInbound() + .fromAnyAddress() + .fromAnyPort() + .toAnyAddress() + .toPort(80) + .withProtocol(NetworkSecurityRule.Protocol.TCP) + .withPriority(101) + .withDescription("Allow HTTP") + .attach() .create(); System.out.println("Created a security group for the front end: " + frontEndNSG.id()); @@ -128,44 +134,49 @@ public static void main(String[] args) { // Create a network security group for the back end of a subnet // back end subnet contains two rules // - ALLOW-SQL - allows SQL traffic only from the front end subnet - // - DENY-WEB - denies all internet bound traffic from the back end subnet + // - DENY-WEB - denies all outbound internet traffic from the back end subnet + + System.out.println("Creating a security group for the front end - allows SSH and " + + "denies all outbound internet traffic "); - System.out.println("Creating a security group for the front end - allows SSH and Web"); NetworkSecurityGroup backEndNSG = azure.networkSecurityGroups().define(backEndNSGName) .withRegion(Region.US_EAST) .withExistingGroup(rgName) .defineRule("ALLOW-SQL") - .allowInbound() - .fromAddress("172.16.1.0/24") - .fromAnyPort() - .toAnyAddress() - .toPort(1433) - .withProtocol(NetworkSecurityRule.Protocol.TCP) - .withPriority(100) - .withDescription("Allow SQL") - .attach() + .allowInbound() + .fromAddress("172.16.1.0/24") + .fromAnyPort() + .toAnyAddress() + .toPort(1433) + .withProtocol(NetworkSecurityRule.Protocol.TCP) + .withPriority(100) + .withDescription("Allow SQL") + .attach() .defineRule("DENY-WEB") - .denyOutbound() - .fromAnyAddress() - .fromAnyPort() - .toAnyAddress() - .toAnyPort() - .withAnyProtocol() - .withDescription("Deny Web") - .withPriority(200) - .attach() + .denyOutbound() + .fromAnyAddress() + .fromAnyPort() + .toAnyAddress() + .toAnyPort() + .withAnyProtocol() + .withDescription("Deny Web") + .withPriority(200) + .attach() .create(); System.out.println("Created a security group for the back end: " + backEndNSG.id()); Utils.print(backEndNSG); - - System.out.println("Created a virtual network: " + network.id()); - Utils.print(network); - System.out.println("Creating multiple network interfaces"); System.out.println("Creating network interface 1"); + + //======================================================== + // Create a network interface and apply the + // front end network security group + + System.out.println("Creating a network interface for the front end"); + NetworkInterface networkInterface1 = azure.networkInterfaces().define(networkInterfaceName1) .withRegion(Region.US_EAST) .withExistingGroup(rgName) @@ -176,18 +187,22 @@ public static void main(String[] args) { .withIpForwarding() .create(); - System.out.println("Created network interface 1"); - Utils.print(networkInterface1); - + System.out.println("Created network interface for the front end"); System.out.println("Applying front end network security group to network interface 1"); networkInterface1.update() .withExistingNetworkSecurityGroup(frontEndNSG) .apply(); System.out.println("Applied front end network security group to network interface 1"); + Utils.print(networkInterface1); + + //======================================================== + // Create a network interface and apply the + // back end network security group + + System.out.println("Creating a network interface for the back end"); - System.out.println("Creating network interface 2"); NetworkInterface networkInterface2 = azure.networkInterfaces().define(networkInterfaceName2) .withRegion(Region.US_EAST) .withExistingGroup(rgName) @@ -196,47 +211,98 @@ public static void main(String[] args) { .withPrimaryPrivateIpAddressDynamic() .create(); - System.out.println("Created network interface 2"); - Utils.print(networkInterface2); + System.out.println("Created network interface for the back end"); - System.out.println("Applying front end network security group to network interface 2"); + System.out.println("Applying back end network security group to network interface 2"); networkInterface2.update() .withExistingNetworkSecurityGroup(backEndNSG) .apply(); - System.out.println("Applied front end network security group to network interface 2"); + System.out.println("Applied back end network security group to network interface 2"); + Utils.print(networkInterface2); + //============================================================= - // Create a virtual machine with multiple network interfaces + // Create a virtual machine (for the front end) + // with the network interface that has the network security group for the front end - System.out.println("Creating a Windows VM"); + System.out.println("Creating a Linux virtual machine (for the front end) - " + + "with the network interface that has the network security group for the front end"); Date t1 = new Date(); - VirtualMachine vm = azure.virtualMachines().define(vmName) + VirtualMachine frontEndVM = azure.virtualMachines().define(frontEndVMName) .withRegion(Region.US_EAST) .withExistingGroup(rgName) .withExistingPrimaryNetworkInterface(networkInterface1) - .withPopularWindowsImage(KnownWindowsVirtualMachineImage.WINDOWS_SERVER_2012_R2_DATACENTER) - .withAdminUserName(userName) - .withPassword(password) + .withPopularLinuxImage(KnownLinuxVirtualMachineImage.UBUNTU_SERVER_16_04_LTS) + .withRootUserName(userName) + .withSsh(sshKey) .withSize(VirtualMachineSizeTypes.STANDARD_D3_V2) .create(); Date t2 = new Date(); - System.out.println("Created VM: (took " - + ((t2.getTime() - t1.getTime()) / 1000) + " seconds) " + vm.id()); + System.out.println("Created Linux VM: (took " + + ((t2.getTime() - t1.getTime()) / 1000) + " seconds) " + frontEndVM.id()); // Print virtual machine details - Utils.print(vm); + Utils.print(frontEndVM); + + + //============================================================= + // Create a virtual machine (for the back end) + // with the network interface that has the network security group for the back end + + System.out.println("Creating a Linux virtual machine (for the back end) - " + + "with the network interface that has the network security group for the back end"); + + t1 = new Date(); + + VirtualMachine backEndVM = azure.virtualMachines().define(backEndVMName) + .withRegion(Region.US_EAST) + .withExistingGroup(rgName) + .withExistingPrimaryNetworkInterface(networkInterface2) + .withPopularLinuxImage(KnownLinuxVirtualMachineImage.UBUNTU_SERVER_16_04_LTS) + .withRootUserName(userName) + .withSsh(sshKey) + .withSize(VirtualMachineSizeTypes.STANDARD_D3_V2) + .create(); + t2 = new Date(); + System.out.println("Created a Linux VM: (took " + + ((t2.getTime() - t1.getTime()) / 1000) + " seconds) " + backEndVM.id()); + Utils.print(backEndVM); + + //======================================================== // List network security groups - // Attach network security groups to a VM + System.out.println("Walking through network security groups"); + List networkSecurityGroups = azure.networkSecurityGroups().listByGroup(rgName); + for (NetworkSecurityGroup networkSecurityGroup: networkSecurityGroups) { + Utils.print(networkSecurityGroup); + } + + + //======================================================== // Update a network security group - // Delete a network security group + System.out.println("Updating the front end network security group to allow FTP"); + + frontEndNSG.update() + .defineRule("ALLOW-FTP") + .allowInbound() + .fromAnyAddress() + .fromAnyPort() + .toAnyAddress() + .toPortRange(20, 21) + .withProtocol(NetworkSecurityRule.Protocol.TCP) + .withDescription("Allow FTP") + .withPriority(200) + .attach() + .apply(); + System.out.println("Updated the front end network security group"); + Utils.print(frontEndNSG); } catch (Exception f) { System.out.println(f.getMessage()); @@ -254,7 +320,7 @@ public static void main(String[] args) { g.printStackTrace(); } } - } catch (Exception e){ + } catch (Exception e) { System.out.println(e.getMessage()); e.printStackTrace(); } From 0a31ab7198350290408ac89d836fe66337186631 Mon Sep 17 00:00:00 2001 From: Asir Vedamuthu Selvasingh Date: Thu, 23 Jun 2016 16:39:26 -0700 Subject: [PATCH 3/3] Rolling back ManageNetworkInterface --- .../network/samples/ManageNetworkInterface.java | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/azure-samples/src/main/java/com/microsoft/azure/management/network/samples/ManageNetworkInterface.java b/azure-samples/src/main/java/com/microsoft/azure/management/network/samples/ManageNetworkInterface.java index 288f59eb3531..cecc07167972 100644 --- a/azure-samples/src/main/java/com/microsoft/azure/management/network/samples/ManageNetworkInterface.java +++ b/azure-samples/src/main/java/com/microsoft/azure/management/network/samples/ManageNetworkInterface.java @@ -23,11 +23,11 @@ import java.util.Date; /** - *

Azure Network sample for managing network interfaces -

- *

- Create a virtual machine with multiple network interfaces

- *

- Configure a network interface

- *

- List network interfaces

- *

- Delete a network interface.

+ * Azure Network sample for managing network interfaces - + * - Create a virtual machine with multiple network interfaces + * - Configure a network interface + * - List network interfaces + * - Delete a network interface. */ public final class ManageNetworkInterface {