Your company has prepared two web servers and they intend to start serving traffic to them soon. Both servers have IIS installed, but they don’t have port 80 (HTTP) or 443 (HTTPS) open for internet traffic. You have been tasked with creating an application security group, associating it with a network security group, and ensuring that the servers are accessible from the internet.
Learning Objectives
Successfully complete this lab by achieving the following learning objectives:
- Create a New Application Security Group
- Once in the Azure portal, click on the menu in the upper-left and select Virtual Machine. Note the location of these machines, as you’ll need that detail momentarily.
- Head back to the main menu and select All Services. In the search bar, type application security groups and select that service. On the Application Security group page, click the Add button.
- For the resource group section, click the drop-down menu and select the pre-existing resource group.
- Under the instance details section, set the name field to asgWebServers. Ensure the region is set to the same region as your virtual machines (see step 1).
- Click Review + create.
- Create a New Network Security Rule
- Go to the Azure menu in the upper-left, select All Services, and search for nsg.
- Go to Network Security groups and click on the existing security group.
- Select Inbound security rules on the left, and click add.
- For Destination, select Application Security group.
- For Destination application security group, choose asgWebServers.
- The Destination port ranges are set to 80,443.
- Set Priority to 124.
- Under Name, set to WebServers_Rule.
- Finally, click the add button. You’ll see this new rule amongst your list.
- Head back to the Azure menu in the upper-left and select Virtual Machine.
- Next, attach the application security group to the networking interface of each VM.
- Select your first VM.
- Click the Networking tab, and click Application security groups.
- Select Configure the application security group, select aswWebServers from the drop-down, and press Save.
- Repeat the last two steps for your second VM.
- Test Connectivity to the Web Servers
- Click on the Overview tab on the left-hand side.
- Copy the Public IP address and paste it into your browser (e.g., Chrome) using http. (If we had a certificate set up, the test would be the same for https).
- If successful with the previous steps, you will see the default IIS splash page.
- Feel free to put the other VM’s IP in a browser to see its IIS splash page.
