Azure Network Site
This page shows how to write Terraform and Azure Resource Manager for Network Site and write them securely.
azurerm_vpn_site (Terraform)
The Site in Network can be configured in Terraform with the resource name azurerm_vpn_site
. The following sections describe 10 examples of how to use the resource and its parameters.
Example Usage from GitHub
resource "azurerm_vpn_site" "az_vpnsite_1" {
location = azurerm_resource_group.vWAN_RG.location
resource_group_name = azurerm_resource_group.vWAN_RG.name
virtual_wan_id = azurerm_virtual_wan.default.id
name = "vpn_session1"
link {
resource "azurerm_vpn_site" "homelab1" {
name = "homelab1"
resource_group_name = azurerm_resource_group.global.name
location = azurerm_vpn_gateway.canadacentral.location
virtual_wan_id = azurerm_virtual_wan.global.id
resource "azurerm_vpn_site" "vpn_site" {
name = azurecaf_name.vpn_site.result
location = var.location
resource_group_name = var.resource_group_name
virtual_wan_id = var.virtual_wan_id
address_cidrs = try(var.settings.address_cidrs, null)
resource "azurerm_vpn_site" "vpn_site" {
name = azurecaf_name.vpn_site.result
location = var.location
resource_group_name = var.resource_group_name
virtual_wan_id = var.virtual_wan_id
address_cidrs = try(var.settings.address_cidrs, null)
resource "azurerm_vpn_site" "vpn_site" {
for_each = var.vpn_sites
address_cidrs = lookup(each.value, "address_cidrs", null) != null ? split(",", replace(lookup(each.value, "address_cidrs", null), " ", "")) : []
device_model = lookup(each.value, "device_model", null)
device_vendor = lookup(each.value, "device_vendor", null)
resource "azurerm_vpn_site" "vpn_site" {
name = azurecaf_name.vpn_site.result
location = var.location
resource_group_name = var.resource_group_name
virtual_wan_id = var.virtual_wan_id
address_cidrs = try(var.settings.address_cidrs, null)
resource "azurerm_vpn_site" "microhack-eus2-onprem-site" {
name = "eus2-onprem-site"
location = azurerm_resource_group.vwan-microhack-hub-rg.location
resource_group_name = azurerm_resource_group.vwan-microhack-hub-rg.name
virtual_wan_id = azurerm_virtual_wan.microhack-vwan.id
resource "azurerm_vpn_site" "alpha" {
name = "alpha-site"
resource_group_name = data.terraform_remote_state.vwan.outputs.resource_group.name
location = data.terraform_remote_state.vwan.outputs.resource_group.location
virtual_wan_id = data.terraform_remote_state.vwan.outputs.virtual_wan.id
resource "azurerm_vpn_site" "beta" {
name = "beta-site"
resource_group_name = data.terraform_remote_state.vwan.outputs.resource_group.name
location = data.terraform_remote_state.vwan.outputs.resource_group.location
virtual_wan_id = data.terraform_remote_state.vwan.outputs.virtual_wan.id
resource "azurerm_vpn_site" "sites" {
// This should be a map of objects
provider = azurerm.vwantarget
for_each = var.vwanVpnSiteConfigs
name = each.value["vpnSiteName"]
resource_group_name = each.value["vpnSiteRgName"]
Parameters
-
address_cidrs
optional - set of string -
device_model
optional - string -
device_vendor
optional - string -
id
optional computed - string -
location
required - string -
name
required - string -
resource_group_name
required - string -
tags
optional - map from string to string -
virtual_wan_id
required - string -
link
list block-
fqdn
optional - string -
id
optional computed - string -
ip_address
optional - string -
name
required - string -
provider_name
optional - string -
speed_in_mbps
optional - number -
bgp
list block-
asn
required - number -
peering_address
required - string
-
-
-
timeouts
single block
Explanation in Terraform Registry
Manages a VPN Site.
Tips: Best Practices for The Other Azure Network Resources
In addition to the azurerm_network_security_group, Azure Network has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.
azurerm_network_security_group
Ensure to disable RDP port from the Internet
It is better to disable the RDP port from the Internet. RDP access should not be accepted from the Internet (*, 0.0.0.0, /0, internet, any), and consider using the Azure Bastion Service.
azurerm_network_security_rule
Ensure to set a more restrictive CIDR range for ingress from the internet
It is better to set a more restrictive CIDR range not to use very broad subnets. If possible, segments should be divided into smaller subnets.
azurerm_network_watcher_flow_log
Ensure to enable Retention policy for flow logs and set it to enough duration
It is better to enable a retention policy for flow logs. Flow logs show us all network activity in the cloud environment and support us when we face critical incidents.
Microsoft.Network/vpnSites (Azure Resource Manager)
The vpnSites in Microsoft.Network can be configured in Azure Resource Manager with the resource name Microsoft.Network/vpnSites
. The following sections describe how to use the resource and its parameters.
Example Usage from GitHub
"type": "Microsoft.Network/vpnSites",
"apiVersion": "2018-11-01",
"name": "branch-ne",
"location": "westeurope",
"dependsOn": [
"[variables('virtualWanName')]"
"type": "Microsoft.Network/vpnSites",
"apiVersion": "2019-04-01",
"location": "string",
"tags": {},
"properties": {
"virtualWan": {
"type": "Microsoft.Network/vpnSites",
"apiVersion": "2018-11-01",
"name": "branch-ne",
"location": "westeurope",
"dependsOn": [
"[variables('virtualWanName')]"
"type": "Microsoft.Network/vpnSites",
"tags": {
"key1": "value1"
},
"properties": {
"provisioningState": "Succeeded",
"type": "Microsoft.Network/vpnSites",
"tags": {
"key1": "value1"
},
"properties": {
"provisioningState": "Succeeded",
"type": "Microsoft.Network/vpnSites",
"tags": {
"key1": "value1"
},
"properties": {
"provisioningState": "Succeeded",
"type": "Microsoft.Network/vpnSites",
"tags": {
"key1": "value1"
},
"properties": {
"provisioningState": "Succeeded",
"type": "Microsoft.Network/vpnSites",
"tags": {
"key1": "value1",
"key2": "value2"
},
"properties": {
"type": "Microsoft.Network/vpnSites",
"tags": {
"key1": "value1",
"key2": "value2"
},
"properties": {
"type": "Microsoft.Network/vpnSites",
"tags": {
"key1": "value1"
},
"properties": {
"provisioningState": "Succeeded",
Parameters
name
required - stringtype
required - stringapiVersion
required - stringlocation
required - stringResource location.
tags
optional - stringResource tags.
properties
requiredvirtualWan
optionalid
required - stringResource ID.
deviceProperties
optionaldeviceVendor
optional - stringName of the device Vendor.
deviceModel
optional - stringModel of the device.
linkSpeedInMbps
optional - integerLink speed.
ipAddress
optional - stringThe ip-address for the vpn-site.
siteKey
optional - stringThe key for vpn-site that can be used for connections.
addressSpace
optionaladdressPrefixes
required - arrayA list of address blocks reserved for this virtual network in CIDR notation.
bgpProperties
optionalasn
optional - integerThe BGP speaker's ASN.
bgpPeeringAddress
optional - stringThe BGP peering address and BGP identifier of this BGP speaker.
peerWeight
optional - integerThe weight added to routes learned from this BGP speaker.
bgpPeeringAddresses
optional arrayipconfigurationId
optional - stringThe ID of IP configuration which belongs to gateway.
customBgpIpAddresses
optional - arrayThe list of custom BGP peering addresses which belong to IP configuration.
isSecuritySite
optional - booleanIsSecuritySite flag.
vpnSiteLinks
optional arrayproperties
optionallinkProperties
optionallinkProviderName
optional - stringName of the link provider.
linkSpeedInMbps
optional - integerLink speed.
ipAddress
optional - stringThe ip-address for the vpn-site-link.
fqdn
optional - stringFQDN of vpn-site-link.
bgpProperties
optionalasn
optional - integerThe BGP speaker's ASN.
bgpPeeringAddress
optional - stringThe BGP peering address and BGP identifier of this BGP speaker.
name
optional - stringThe name of the resource that is unique within a resource group. This name can be used to access the resource.
o365Policy
optionalbreakOutCategories
optionalallow
optional - booleanFlag to control allow category.
optimize
optional - booleanFlag to control optimize category.
default
optional - booleanFlag to control default category.
Frequently asked questions
What is Azure Network Site?
Azure Network Site is a resource for Network of Microsoft Azure. Settings can be wrote in Terraform.
Where can I find the example code for the Azure Network Site?
For Terraform, the rickchen918/vwan, raykao/hub-spoke-environment and aztfmod/terraform-azurerm-caf source code examples are useful. See the Terraform Example section for further details.
For Azure Resource Manager, the tkubica12/azure-virtual-wan, da-edra/scraping-azure and tkubica12/azure-virtual-wan source code examples are useful. See the Azure Resource Manager Example section for further details.