{"id":154,"date":"2022-06-26T20:28:21","date_gmt":"2022-06-27T01:28:21","guid":{"rendered":"https:\/\/cloudlearning365.com\/?p=154"},"modified":"2022-10-14T09:38:56","modified_gmt":"2022-10-14T14:38:56","slug":"secure-aviatrix-controller-with-azure-application-gateway-v2","status":"publish","type":"post","link":"https:\/\/cloudlearning365.com\/?p=154","title":{"rendered":"Secure Aviatrix Controller with Azure Application Gateway V2"},"content":{"rendered":"\n

Aviatrix controller is already hardened. You may further lock it down with Settings -> Controller -> Access Security -> Controller Security Group Management. The controller would be protected by Security Group allowing access only from Aviatrix Gateways. Customer can add their own egress public IPs and CoPilot public IPs to security group, allowing inbound HTTPs access to the Aviatrix controller.<\/p>\n\n\n\n

Enterprises already utilizing Azure Application Gateway\/ WAF may want to place the Aviatrix controller behind it, for tighter security. This blog post shows how to place the Aviatrix controller behind Azure Application Gateway\/WAF<\/p>\n\n\n\n\n\n\n\n

\"\"<\/figure>\n\n\n\n

Before continue on, you need to make sure:<\/p>\n\n\n\n

  1. Already own your domain name, such as mydomain.com<\/li>
  2. Already requested SSL certificate for aviatrix controller, such as avx.domain.com, refer to my previous blog post<\/a><\/li>
  3. Assigned full-chain cert to the aviatrix controller as Server Public Certificate section, refer to this post<\/a> , and this post<\/a> (note, Application gateway doesn’t support self-signed certificate as backend)<\/li>
  4. In your domain DNS, avx.domain.com is set to point to the Aviatrix controller’s public IP, eg: 20.20.20.10 as shown above<\/li>
  5. Tested that https:\/\/avx.mydomain.com works as desired<\/li><\/ol>\n\n\n\n

    Let’s get started:<\/p>\n\n\n\n

    1. Application gateway require it’s own subnet, this article<\/a> recommended \/24 subnet, create such subnet in the same vNet where Aviatrix Controller and CoPilot resides.<\/li>
    2. Fill in basic information to create application gateway<\/li><\/ol>\n\n\n\n
      \"\"<\/figure>\n\n\n\n

      3. Add or use existing public IP for frontends<\/p>\n\n\n\n

      \"\"<\/figure>\n\n\n\n

      4. Add the Aviatrix Controller as backend pool<\/p>\n\n\n\n

      \"\"<\/figure>\n\n\n\n

      5. Add routing rules<\/p>\n\n\n\n

      \"\"<\/figure>\n\n\n\n

      6. Application gateway requires PFX certificate file for the SSL listener , in my previous post of obtaining SSL for Aviatrix controller, I’m using ZeroSSL to obtain SSL certificate. this article<\/a> show how to create a PFX certificate from the three files issued by ZeroSSL:<\/p>\n\n\n\n

      \"\"<\/figure>\n\n\n\n

      On MacOS or Linux:<\/p>\n\n\n\n

      cat certificate.crt ca_bundle.crt > full_chain.crt\nopenssl pkcs12 -export -out certificate.p12 -inkey private.key -in full_chain.crt<\/code><\/pre>\n\n\n\n
      On Windows:<\/pre>\n\n\n\n
      copy \/b certificate.crt + ca_bundle.crt full_chain.crt\nopenssl pkcs12 -export -out certificate.p12 -inkey private.key -in full_chain.crt<\/code><\/pre>\n\n\n\n
      Note<\/strong>: There is a PowerShell module Posh-ACME<\/a> help you to create all these certificates from an ACME capable certificate authority such as Let’s Encrypt<\/a>.<\/p>\n\n\n\n
      Once obtained the PFX certificate, provide it and password through the listener workflow:<\/p>\n\n\n\n
      \"\"<\/figure>\n\n\n\n
      In the Backend targets tab, pick backend pool from drop down, then Add new<\/strong> for Backend settings<\/strong><\/p>\n\n\n\n
      \"\"<\/figure>\n\n\n\n
      In Add Backend setting section, pick HTTPS as backend protocol (assuming your Aviatrix Controller already listen on HTTPS and already using Full-Chain certificate as server public cert.<\/p>\n\n\n\n
      One thing to note, if you obtained a certificate from a well known CA (Certificate Authority), then you can pick Yes in Use well known CA certificate, <\/p>\n\n\n\n
      \"\"<\/figure>\n\n\n\n
      If you are not using a well known CA issued certificate such as your Enterprise CA,  you will need to provide Base-64 encoded X.509 (.CER)<\/a> of the root CA cert. The following example shows extracting the root CA cert using a Windows client with Chrome browser:<\/p>\n\n\n\n
      Visit your SSL enabled Aviatrix controller, then click on the pad lock<\/p>\n\n\n\n
      \"\"<\/figure>\n\n\n\n
      Click and expand Connection is secure<\/strong><\/p>\n\n\n\n
      \"\"<\/figure>\n\n\n\n
      Click on Certificate is valid<\/strong><\/p>\n\n\n\n
      \"\"<\/figure>\n\n\n\n
      This opens up the server certificate<\/p>\n\n\n\n
      \"\"<\/figure>\n\n\n\n
      Click on Certificate Path<\/strong> tab, certificate is ordered as:<\/p>\n\n\n\n