Connecting VMs Together in a Virtual Network (Azure)

Check out a better formatted version of this post here, on my Notion.

Here - Don't be dismayed by the instructions.

The GUI Way? Peering VNets. The Powershell way? A bit more involved.

Today's Events:

• Configure a network security group + security rules using Powershell.
  
• The application server should connect to the database server over HTTP.
• BUT the database server shouldn't use HTTP to connect to the application server.

The first hurdle was getting the command to work.

tion>rg=Paolin
At line:1 char:39
+ az group create --name $rg --location rg=Paolin
+                                       ~
The '<' operator is reserved for future use.
+ CategoryInfo          : ParserError: (:) [], ParentContainsErrorRecordException
+ FullyQualifiedErrorId : RedirectionNotSupported

Until I tried it in bash:

rg = 32
az group create --name $rg --location eastus

Some numbers are changed below.

{
  "id": "/subscriptions/a78373f1-5023-41fe-ae36-d0742026d72f/resourceGroups/32",
  "location": "eastus",
  "managedBy": null,
  "name": "32",
  "properties": {
    "provisioningState": "Succeeded"
  },
  "tags": null,
  "type": "Microsoft.Resources/resourceGroups"
}

I made a new subnet, named it (Apps), addressed it, and tied it to a group:

m@Azure:~$ az network vnet create \
> --resource-group $rg \
> --name ERP-Servers \
> --address-prefix 10.0.0.0/16 \
> --subnet-name Apps \
> --subnet-prefix 10.0.0.0/24

There's a lot of return information:

• DDoS protection is not enabled (This resource will have been shut off by the time this posts)
• Provisioning state has succeeded.
• No BGP communities
• Private Endpoint Network Policies are Enabled

I repeat it for the Databases subnet:

az network vnet subnet create \
    --resource-group $rg \
    --vnet-name ERP-servers \
    --address-prefix 10.0.1.0/24 \
    --name Databases

The commands look similar, but they are not - one has subnet create, the other only create. They are both in Resource Group 32, but have different address prefix allotments.

Finally; The Network Security Group.

az network nsg create \
    --resource-group $rg \
    --name ERP-SERVERS-NSG

It's given a type of "Microsoft.Network/networkSecurityGroups" in Resource Group 32.


Now for the Ubuntu VMs:

wget -N https://raw.githubusercontent.com/MicrosoftDocs/mslearn-secure-and-isolate-with-nsg-and-service-endpoints/master/cloud-init.yml && \ Pulling the appropriate code from Microsoft's GitHub repository
az vm create \
    --resource-group $rg \ 32
    --name AppServer \
    --vnet-name ERP-servers \
    --subnet Applications \
    --nsg ERP-SERVERS-NSG \
    --image UbuntuLTS \
    --size Standard_B1ls \
    --admin-username azureuser \
    --custom-data cloud-init.yml \
    --no-wait \
    --admin-password (Entered, but not shown here) this isn't the real PW!

So, I'm not a person who likes to follow the directions to the letter when learning. What do you learn if you just copy and paste commands?

Can you see the error above?

Yes, my Applications subnet is called Apps. The code spells it out Applications. So I end up deleting and remaking the resource groups while following the instructions. At least it's a learning experience!

So now we have Databases, Applications, and a Network Security Group in Resource Group 32

Let's see how our VMs are running.

Name        Provisioned    Power
----------  -------------  ----------
AppServer   Succeeded      VM running
DataServer  Succeeded      VM running

Let's check our public IP addresses so we can SSH into them.

The next command has me putting those Public IPs to variables - In a Bash Shell! Could we always do this? Technology is amazing.

The connection times out initially because of an implicit deny all to outside traffic, and I fix that with a command that:

• Allow SSH access
• For servers in the Group

Can we connect now?

Connection timed out during banner exchange

Hm, not quite. The instructions say you may have to wait some minutes. I check the GUI, and the new rule is in place;

Also, seeing ⚠ and 'Succeeded' doesn't make a ton of sense to me, but whatever.

The resources are still there, so I can leave this and come back later.

I had to deviate from the instructions; Return later; Go to your VM inside your resource group, and click 'Connect' at the top ribbon. Copy the 'Login using VM local account' information.

 

And paste it into the Bash terminal.

Run it twice; The second time should ask for the password to the VM. As stated above, Azure has been having issues all day, and they come up again here; Includes a lot of time outs and not recognizing its own commands.

At the very least, I did get two VMs into the same Virtual Network.