Edit

Access Control List Creation and Configuration Examples

  • Article

This article gives examples of how to create and update Access Control Lists (ACLS).

Overview of the ACL create flow

Creating an Access Control List (ACL) associated with a Network-to-Network Interconnect (NNI) involves these steps:

  • Create a Network Fabric resource and add an NNI child resource to it.

  • Create ingress and egress ACL resources using the az networkfabric acl create command. You can provide match configurations and the default action for the ACL. You can also provide dynamic match configurations either inline, or in a file stored in your Azure storage account blob container.

  • Update the NNI resource with the ingress and egress ACL IDs using the az networkfabric nni update command. You need to provide valid ACL resource IDs in the --ingress-acl-id and --egress-acl-id parameters.

  • Provision the Network Fabric resource using the az networkfabric fabric provision command. This generates the base configuration and the dynamic match configuration for the ACLs and sends them to the devices.

Overview of the ACL update flow

  • Create ingress and egress ACL resources using az networkfabric acl create as described in the previous section.

  • Update the ingress or egress ACL using the az networkfabric acl update command.

  • Verify the configuration state of the ACL is accepted.

  • Verify the configuration state of the fabric is accepted.

  • Execute Fabric Commit to update the ACL.

Example commands

Access Control list on a Network-to-Network Interconnect

This example shows you how to create an NNI with two ACLs - one for ingress and one for egress.

The ACLs must be applied before provisioning the Network Fabric. This limitation is temporary and will be removed in future release. The ingress and egress ACLs are created before the NNI resource and referenced when the NNI is created, which also triggers the creation of the ACLs. This configuration must be done before provisioning the network fabric.

Create ingress ACL: example command

az networkfabric acl create \
    --resource-group "example-rg"
    --location "eastus2euap" \
    --resource-name "example-Ipv4ingressACL" \
    --configuration-type "Inline" \
    --default-action "Permit" \
    --dynamic-match-configurations "[{ipGroups:[{name:'example-ipGroup',ipAddressType:IPv4,ipPrefixes:['10.20.3.1/20']}],vlanGroups:[{name:'example-vlanGroup',vlans:['20-30']}],portGroups:[{name:'example-portGroup',ports:['100-200']}]}]" \
    --match-configurations "[{matchConfigurationName:'example-match',sequenceNumber:123,ipAddressType:IPv4,matchConditions:[{etherTypes:['0x1'],fragments:['0xff00-0xffff'],ipLengths:['4094-9214'],ttlValues:[23],dscpMarkings:[32],portCondition:{flags:[established],portType:SourcePort,layer4Protocol:TCP,ports:['1-20']},protocolTypes:[TCP],vlanMatchCondition:{vlans:['20-30'],innerVlans:[30]},ipCondition:{type:SourceIP,prefixType:Prefix,ipPrefixValues:['10.20.20.20/12']}}],actions:[{type:Count,counterName:'example-counter'}]}]"

Create egress ACL: example command

az networkfabric acl create \
    --resource-group "example-rg" \
    --location "eastus2euap" \
    --resource-name "example-Ipv4egressACL" \
    --configuration-type "File" \
    --acls-url "https://ACL-Storage-URL" \
    --default-action "Permit" \
    --dynamic-match-configurations "[{ipGroups:[{name:'example-ipGroup',ipAddressType:IPv4,ipPrefixes:['10.20.3.1/20']}],vlanGroups:[{name:'example-vlanGroup',vlans:['20-30']}],portGroups:[{name:'example-portGroup',ports:['100-200']}]}]"

Access Control List on an isolation domain external network

Use the az networkfabric acl create command to create ingress and egress ACLs for the external network. In the example, we specify the resource group, name, location, network fabric ID, external network ID, and other parameters. You can also specify the match conditions and actions for the ACL rules using the --match and --action parameters.

This command creates an ingress ACL named acl-ingress that allows ICMP traffic from any source to the external network:

az networkfabric acl create \
    --resource-group myResourceGroup \
    --name acl-ingress \
    --location eastus \
    --network-fabric-id /subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/myResourceGroup/providers/Microsoft.NetworkFabric/networkFabrics/myNetworkFabric \
    --external-network-id /subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/myResourceGroup/providers/Microsoft.NetworkFabric/externalNetworks/ext-net \
    --match "ip protocol icmp" \
    --action allow

Use the az networkfabric externalnetwork update command to update the external network with the resource group, name, and network fabric ID. You also need to specify the ingress and egress ACL IDs using the --ingress-acl-id and --egress-acl-id parameters. For example, the following command updates the external network named ext-net to reference the ingress ACL named acl-ingress:

az networkfabric externalnetwork update \
    --resource-group myResourceGroup \
    --name ext-net \
    --network-fabric-id /subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/myResourceGroup/providers/Microsoft.NetworkFabric/networkFabrics/myNetworkFabric \
    --ingress-acl-id /subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/myResourceGroup/providers/Microsoft.NetworkFabric/acls/acl-ingress

More example scenarios and commands

To create an egress ACL for an NNI that denies all traffic except for HTTP and HTTPS, you can use this command:

az networkfabric acl create \
    --name acl-egress \
    --resource-group myResourceGroup \
    --nni-id /subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/myResourceGroup/providers/Microsoft.NetworkFabric/networkInterfaces/myNni \
    --match "ip protocol tcp destination port 80 or 443" \
    --action allow \
    --default-action deny

To update an existing ACL to add a new match condition and action, you can use this command:

az networkfabric acl update \
    --name acl-ingress \
    --resource-group myResourceGroup \
    --match "ip protocol icmp" \
    --action allow \
    --append-match-configurations

To list all the ACLs in a resource group, you can use this command:

az networkfabric acl list --resource-group myResourceGroup

To show the details of a specific ACL, you can use this command:

az networkfabric acl show \
    --name acl-ingress \
    --resource-group myResourceGroup

To delete an ACL, you can use this command:

az networkfabric acl delete \
    --name acl-egress \
    --resource-group myResourceGroup