AzureWebFarm/New-AzEgressVirtualNetwork.ps1 at master · LockstepGroup/AzureWebFarm · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
#requires -module Ipv4Math
#requires -module Az

[CmdletBinding()]
Param (
    [Parameter(Mandatory = $true, Position = 0)]
    [string]$VirtualNetworkName,

    [Parameter(Mandatory = $true)]
    [string]$ResourceGroupName,

    [Parameter(Mandatory = $true)]
    [string]$Location,

    [Parameter(Mandatory = $true)]
    [string]$AddressPrefix,

    [Parameter(Mandatory = $false)]
    [switch]$MakeNewResourceGroup,

    [Parameter(Mandatory = $false)]
    [switch]$WithVpnGateway,

    [Parameter(Mandatory = $false)]
    [string[]]$SpokeVirtualNetwork
)

# Check to see if ResourceGroup exists
try {
    $ResourceGroup = Get-AzResourceGroup -Name $ResourceGroupName -ErrorAction Stop
} catch {
    if ($MakeNewResourceGroup) {
        # Create new ResourceGroup if -MakeNewResourceGroup is specified.
        $ResourceGroup = New-AzResourceGroup -Name $ResourceGroupName -Location $Location
    } else {
        $PSCmdlet.ThrowTerminatingError(
            [System.Management.Automation.ErrorRecord]::new(
                ([System.ArgumentException]"ResourceGroup does not exist. Either specify an existing ResourceGroup or use -MakeNewResourceGroup parameter."),
                '1004',
                [System.Management.Automation.ErrorCategory]::CloseError,
                $ResourceGroupName
            )
        )
    }
}


#region Create Virtual Network
$VirtualNetworkParams = @{
    'Name'              = $VirtualNetworkName
    'ResourceGroupName' = $ResourceGroupName
    'Location'          = $Location
    'AddressPrefix'     = $AddressPrefix
}

$VirtualNetwork = New-AzVirtualNetwork @VirtualNetworkParams -ErrorAction Stop
#endregion Create Virtual Network

#region Create VPN Gateway
if ($WithVpnGateway) {

    #region Gateway Subnet
    $SubnetParams = @{
        'Name'           = 'GatewaySubnet'
        'AddressPrefix'  = ((Get-NetworkAddress -IpAndMaskLength $AddressPrefix) + '/24')
        'VirtualNetwork' = $VirtualNetwork
    }

    $VirtualNetwork = Add-AzVirtualNetworkSubnetConfig @SubnetParams | Set-AzVirtualNetwork
    $GatewaySubnet = Get-AzVirtualNetworkSubnetConfig -Name 'GatewaySubnet' -VirtualNetwork $VirtualNetwork
    #endregion Gateway Subnet

    #region Create Public IP
    $PublicIpParams = @{
        'Name'              = 'egress-gateway-pip'
        'ResourceGroupName' = $ResourceGroupName
        'Location'          = $Location
        'AllocationMethod'  = 'Dynamic'
    }

    $PublicIpAddress = New-AzPublicIpAddress @PublicIpParams
    #endregion Create Public IP

    #region Create Ip Configuration
    $IpConfigParams = @{
        'Name'              = 'egress-gateway-ipc'
        'SubnetId'          = $GatewaySubnet.Id
        'PublicIpAddressId' = $PublicIpAddress.Id
    }
    $GatewayIpConfig = New-AzVirtualNetworkGatewayIpConfig @IpConfigParams
    #endregion Create Ip Configuration

    #region Create VirtualNetworkGateway
    $VirtualNetworkGatewayParams = @{
        'Name'              = 'egress-gateway-vpn'
        'ResourceGroupName' = $ResourceGroupName
        'Location'          = $Location
        'IpConfigurations'  = $GatewayIpConfig
        'GatewayType'       = 'Vpn'
        'VpnType'           = 'RouteBased'
        'GatewaySku'        = 'VpnGw1'
    }
    $VirtualNetworkGateway = New-AzVirtualNetworkGateway @VirtualNetworkGatewayParams
    #endregion Create VirtualNetworkGateway

}
#endregion Create VPN Gateway

#region VirtualNetwork Peering
if ($SpokeVirtualNetwork) {
    $ExistingVirtualNetworks = Get-AzVirtualNetwork
    foreach ($spoke in $SpokeVirtualNetwork) {
        $ThisSpokeVirtualNetwork = $ExistingVirtualNetworks | Where-Object { $_.Name -eq $spoke }
        if ($ThisSpokeVirtualNetwork.Location -eq $VirtualNetwork.Location) {
            # Hub to Spoke
            $HubVnetPeeringParams = @{
                'Name'                   = "egress-peer-$spoke"
                'Virtualnetwork'         = $VirtualNetwork
                'RemoteVirtualNetworkId' = $ThisSpokeVirtualNetwork.Id
                'AllowForwardedTraffic'  = $true
                'AllowGatewayTransit'    = $true
            }
            $HubPeering = Add-AzVirtualNetworkPeering @HubVnetPeeringParams

            # Spoke to Hub
            $SpokeVnetPeeringParams = @{
                'Name'                   = "$spoke-peer-egress"
                'RemoteVirtualNetworkId' = $VirtualNetwork.Id
                'Virtualnetwork'         = $ThisSpokeVirtualNetwork
                'AllowForwardedTraffic'  = $true
                'UseRemoteGateways'      = $true
            }
            $SpokeVnetPeering = Add-AzVirtualNetworkPeering @SpokeVnetPeeringParams
        } else {
            Write-Warning "Specificed Spoke Network is not in the same region as new egress network: $spoke"
        }
    }
}
#endregion VirtualNetwork Peering