I've got a load-balanced end-point being served by 2 vms, and I shut down one of them through the web interface, however it seems that the shut-down endpoint is still being included in the load-balancer rotation. Is this the case or am I missing a silly mistake on my part?
Are you talking about new "Windows Azure Virtual Machines" or "Web/Worker based VM"?
With Windows Azure Virtual Machine, you can create multiple separate Virtual Machines and use Powershell cmdlets "get-azurevm" with parameter "-LBSetName" to set probe Load balancing undersame -LBSetName setting as below:
get-azurevm -ServiceName "XXXX" -Name "XXX" | Set-AzureEndpoint -Name "HttpIn" -Protocol "tcp" -PublicPort 80 -LocalPort 80 -LBSetName "XXX" -ProbePort 80 -ProbeProtocol "http" -ProbePath "/" | Update-AzureVM
If you configured the Load Balancer and shutdown the instance, the Load Balancer will still shows all machines configured with probe.
Related
I have a Virtual Machine Scale Set and a Load Balancer (regular LB, not Application Gateway). A health probe check an HTTP endpoint on the VM, which seems to work just fine: the endpoint returns a non-200 response if it knows it's not ready to process requests, which is a controlled and frequent state.
Problem: The lowest possible setting for probes are 5 seconds, and 2 consecutive failures, so at least 10 seconds will pass before a faulty VM is pulled from rotation. This is too long to wait since many requests could arrive and be rejected in that time period, even though the VM is aware of this state, and other VMs in the scale set are ready to process requests.
Question: Is there any way for the VM to instantly notify the load balancer that it wants to be pulled from rotation? The VM should then stay out of rotation until it starts returning 200 OK from the HTTP health probe endpoint.
Sidenote: az network nic ip-config address-pool remove (link) only seems to work for standalone VMs, not scale set VMs.
Using PowerShell you can add a nic to a load balancer this way:
$lb= get-azurermloadbalancer -name NRP-LB -resourcegroupname NRP-RG
$backend=Get-AzureRmLoadBalancerBackendAddressPoolConfig -name LB-backend -LoadBalancer $lb
$nic =get-azurermnetworkinterface -name lb-nic1-be -resourcegroupname NRP-RG
$nic.IpConfigurations[0].LoadBalancerBackendAddressPools=$backend
Set-AzureRmNetworkInterface -NetworkInterface $nic
and in a similar way remove a nic from a LB
$nic = Get-AzureRmNetworkInterface -ResourceGroupName NRP-RG -Name lb-nic1-be
$nic.IpConfigurations[0].LoadBalancerBackendAddressPools = $null
Set-AzureRmNetworkInterface -NetworkInterface $nic
This way you can pull out your machine from the load balancer and add it back when its working again.
See e.g. this link for more details.
I have a VM running SQL Server. I have port 1433 open on the Windows firewall and an Endpoint on the corresponding cloud service forwarding port 57501 to 1433. I haven't specified any ACLs on that endpoint. I want the endpoint to only be accessible from a specific subnet in the VNet where the VM exists.
If I set that in the ACL, it doesn't work - the ACL only seems to care about the public IP of the client. Since the public IP may change, this isn't an option.
What's the recommended approach here? Note that I don't want to connect directly to the VM hostname because I want to use the CNAME that the cloud service sets up for me (the actual Windows computer name is a random long string).
NSGs apply rules on the incoming/outgoing traffic at a VM or cloud-service-role-instance level.
Note that NSGs default rules allow traffic within the virtual network, and outbound to Internet. All other traffic is denied by default. You need to explicitly specify rules to change this behavior or allow any other traffic in/out.
You can create an NSG rule like below to allow only traffic from a specific subnet within a VNet.
Get-AzureNetworkSecurityGroup -Name "NSG-FrontEnd" `
| Set-AzureNetworkSecurityRule -Name rdp-rule `
-Action Allow -Protocol TCP -Type Inbound -Priority 100 `
-SourceAddressPrefix 192.168.1.0/24 -SourcePortRange '*' `
-DestinationAddressPrefix '*' -DestinationPortRange '1433'
I've 8 VMs (linux based) running a single VNet on Azure. If I've two VMs running a service on the same port which shows me machine status or shows some common details which is specific to the VM. Say for example
VM-1 runs a service on 8080 port and same same service has been deployed on VM-2 which runs on the same port 8080. To access to a service running on port 8080 I am opening a port on VM-1 through end points. I am able to access 8080 from web browser through VM-1 using servicename.webapp.net:8080. But If I want to check the status of VM-2, I am not able to open the port 8080 on the VM-2. Probably because the port is opened at the service level and not the VM level. Is there a way I can open the port at the VM level and use VM-x:port?
Another approach I thought which could be useful is : Assign the staticIP/ReservedIP to each of the VM and open the port on individual machines should be possible, instead of open the port at the VNet/service level. Is it possible to assign static/reserved IP to all 8 of the machines once they have been started and operational? And we also need to make sure that, after restart all the eight machines retain the same IPs.
I tried following blog https://azure.microsoft.com/en-us/documentation/articles/virtual-networks-reserved-public-ip/ and tried following command :
$image = Get-AzureVMImage|?{$_.ImageName -like "*AMI-20150919-849187*"}
New-AzureVMConfig -Name StaticIPVMCOnfig -InstanceSize Small -ImageName $image.ImageName
-CurrentStorageAccountName "myStorageACName"
| Add-AzureProvisioningConfig -Linux -LinuxUser root -Password MyP#ssword!
| New-AzureVM -ServiceName myCloudServiceName -ReservedIPName MyReservedIP
-Location "West Europe"
I still see the new VM is getting launched with same same VIP as the other VMs in the VNet. I am not sure if I am missing something.
Attaching the screenshots one is created without static/reservedIP CMDlets. Another is created from PowerShell. Both share the same VIP.
Could someone please help with this?
PS: Intentionally I am keeping the public VIPs to show that they are same. (I've closed and not using this service anymore).
Thanks,
JE
Yes you can assign static IP to to the VMs using powershell command-
get-azurevm -servicename "testservice" -name "testvm" | Set-AzureStaticVNetIP -IPAddress "10.87.96.41" | Update-AzureVM
Next thing is you want to make sure you don't lose the IP when instance goes to stopped state. For this what you can do is define explicit parameter StayProvisioned with the stop azure vm command in powershell-
stop-azurevm -ServiceName "testservice" -Name "testvm" -StayProvisioned
StayProvisioned doesn't allow IP to be freed even if VM is stopped.
If you are looking for public IP of VM-
"Every Virtual Machine is automatically assigned a free public Virtual IP (VIP) address"
In order to find out the public ip goto- Azure portal and then your VM dashboard. Here at the right side you see a quick glance tab under which you will be able to see the public IP. Snapshot for your reference-
You can use this public ip to directly connect to vm using RDP. Using powershell you can use below command for the same.
Get-AzureVM -ServiceName "testservice" -Name "testvm" | select PublicIPAddress
NOTE - Public IP will be null if instance is in stopped state. To know more on public IP you can read this-
https://azure.microsoft.com/en-in/documentation/articles/virtual-networks-instance-level-public-ip/
[Edited]
I have written a small service to grab files from one ftp server, edit them, and then send them to another ftp server. The catch being the ftp server being sent to requires a white-list of IP's. Now I chose to host this service on a Azure VM set up with a virtual public reserved IP address, thinking it would create a static IP that I could use for the white-list.
Unfortunately even though the VM states the virtual public reserved IP is connected to the VM, when opening up a browser and going to whatismyip.com I get a completely different IP and of course Azure shuts all VMs down once every 2-3 months for maintenance (which I assume flushes the IP).
Now I understand that the IP received from whatismyip.com is probably connected to the Azure load balancer but I can't figure out for the life of me why that would be the one that shows up for outbound connections.
My questions are:
Is it possible to obtain a static public IP for outbound connections for that whitelist?
Is there some obvious workaround I'm missing?
Will Azure scheduled maintenance shutdowns save IP information?
Is Azure just not a good platform for this kind of work? If so what is?
Now it is indeed possible. Please see https://azure.microsoft.com/en-us/documentation/articles/virtual-networks-reserved-public-ip/ for details.
The powershell code is as follows:
New-AzureReservedIP –ReservedIPName MyReservedIP –Location "Central US"
$image = Get-AzureVMImage|?{$_.ImageName -like "*RightImage-Windows-2012R2-x64*"}
New-AzureVMConfig -Name TestVM -InstanceSize Small -ImageName $image.ImageName `
| Add-AzureProvisioningConfig -Windows -AdminUsername adminuser -Password MyP#ssw0rd!! `
| New-AzureVM -ServiceName TestService -ReservedIPName MyReservedIP -Location "Central US"
Besides, now outbound connections only use a handful IPs by default. You can see them in new portal: https://portal.azure.com in site's Settings → Properties
Does anyone knows if obtaining a static IP address for a Web or Worker Role on Windows Azure is possible (possibly only in private beta)?
A few years later, Azure now lets you reserve IP addresses for VMs and cloud services (Web and Worker roles). However, it is only accessible from PowerShell for the time being (this will change in the future, apparently).
The first five static IP addresses are free. To create an IP you will need to make sure you have the latest version of the Azure PowerShell command-line interface and also have your Azure account linked to Azure PowerShell (outside the scope of this post but not hard).
To Create a new IP in PowerShell:
$ReservedIP = New-AzureReservedIP -ReservedIPName "FirewallIP" -Label "WebAppFirewallIP" -Location "Japan West"
To associate it with a VM:
New-AzureVMConfig -Name "WebAppVM" -InstanceSize Small -ImageName $images[60].ImageName | Add-AzureProvisioningConfig -Windows -AdminUsername cloudguy -Password Abc123 | New-AzureVM -ServiceName "WebApp" –ReservedIPName $ReservedIP -Location "Japan West"
To insert your new IP into a Web or Worker Role (if the worker role has an external endpoint), add the following to ServiceConfiguration.Cloud.cscfg:
<ServiceConfiguration>
<NetworkConfiguration>
<AddressAssignments>
<ReservedIPs>
<ReservedIP name="<reserved-ip-name>"/>
</ReservedIPs>
</AddressAssignments>
</NetworkConfiguration>
</ServiceConfiguration>
To view an IP at any time:
Get-AzureReservedIP -ReservedIPName "FirewallIP"
Source: Documentation
There's an update to this story. Back in October 2011, Microsoft announced improved in-place updates to existing deployed services (announcement here). You can now update your deployment in several ways without having the assigned IP address changed. For example:
Grow/shrink Role size
Increase local storage size
Change endpoints
Add / remove roles
Once you deploy: As long as you don't delete your deployment, your IP address will stay as-is.
Unfortunately, this is not possible for the time being... If you need to do IP-based access control, you could open a support call and request the current IP address range for a given datacenter, but there is no real guarantee it won't change over time.