Hi,
In my previous post, I showed how to create a light-weight Azure function that allows you to request the Azure Datacenter IP ranges via API. You can rapidly test it by following the instructions on the section 3- Try it before deploying
it here : https://buildwindows.wordpress.com/2017/11/19/get-azure-datacenter-ip-ranges-via-api/
The feedback was positive, but a lot have asked for a way to see if there were updates compared to the last version, and what the updates are if any.
In this post, I will publish the second version of the API (with the how-to), that allows you to :
- Get the current Azure Datacenter IP ranges
- Get the current Azure Datacenter IP ranges for a specific region
- Get region names (since, unfortunately, the region names published by Microsoft are not exactly the same used by the Microsoft Azure services)
- New : Get the current version ID of the Azure Datacenter IP ranges
- New : Get the previous version ID of the Azure Datacenter IP ranges
- New : Get the difference between the current and the previous version for all regions
- New : Get the difference between the current and the previous version for a specific region
The new features will allow you an easy integration with your environment, and simplify the update of your Firewall rules within your infrastructure.
-
1- How to request the API ?
The API supports only POST requests. You can make the following API requests using the following body construction.
Here the examples using Powershell, but you can use any tool to request the API using the same body content
#V1
#Get the current Azure IP address ranges of all region
$body = @{“region”=“all”;“request”=“dcip”} | ConvertTo-Json
#Get the current Azure IP address ranges of a specific region, example europewest
$body = @{“region”=“europewest”;“request”=“dcip”} |ConvertTo-Json
#Get the azure regions names, that we can request IPs for
$body= @{“request”=“dcnames”} |ConvertTo-Json
#Post the request
$webrequest=Invoke-WebRequest -Method “POST” -uri ` https://azuredcip.azurewebsites.net/getazuredcipranges -Body $body
ConvertFrom-Json -InputObject $webrequest.Content
#New in V2
#Get the (added and/or removed) IP address ranges updates of a specific region
$body = @{“request”=“getupdates”;“region”=“asiaeast”} | ConvertTo-Json
#Get the (added and/or removed) IP address ranges updates of all regions
$body = @{“request”=“getupdates”;“region”=“all”} | ConvertTo-Json
#Get the current Azure DC IP ranges version ID
$body = @{“request”=“currentversion”} | ConvertTo-Json
#Get the previous Azure DC IP ranges version ID
$body = @{“request”=“previousversion”} | ConvertTo-Json
#Post the request
$webrequest = Invoke-WebRequest -Method “POST” -uri ` https://azuredcip.azurewebsites.net/getazuredcipupdates -Body $body
ConvertFrom-Json -InputObject $webrequest.Content
-
2- How to build the solution ?
2.1- Solutions components
The V2 version is still using only Azure Functions, but unlike V1, it uses multiple functions within the Function App:
-
1 Function App
- Function 1
- Function 2
- Function 3
- Proxy1
- Proxy2
- Storage Account
The following table details each component configuration. If you want to create the solution within your environment, create the same components using the given configuration:
Function App
|
Name |
Description |
App Service Plan |
| azuredcip | This Function App will host the entire solution. It will include 3 functions, 1 Storage Account and two Proxies | Shared or greater. Use at least a Basic Tier to benefit from SSL, Custom Names and backup |
Function1
|
Name |
Description |
Language |
Integrate |
Manage |
| azuredcipranges | This function will return you the V1 information. https://buildwindows.wordpress.com/2017/11/19/get-azure-datacenter-ip-ranges-via-api/ |
HttpTrigger – Powershell |
Allowed HTTP Methods : POST Authorization level : Anonymous |
You can add Function Keys if you want to secure the API Access. In my case, my API still Public (anonymous) to continue support my V1 |
Function2
|
Name |
Description |
Language |
Integrate |
Manage |
||||||||||||||||||||||||
| azuredciprangesupdater | This function will do the following : – Get the current Azure DC IP ranges version and store it to the storage account – Always keep the previous Azure DC IP ranges version file in the storage account – Create and store a file containing the current and previous files difference and store it to the storage account – Return the mentioned information based on the API request body |
HttpTrigger – Powershell |
Keep the default http output Allowed HTTP Methods : POST Authorization level : Function |
You can use the default function key or generate an new key. This API will not be directly exposed, so you can protect it with a key |
Function3
|
Name |
Description |
Language |
| triggerazdciprangesupdate | This function will trigger the azuredciprangesupdater weekly to update the current and previous version | TimerTrigger – Powershell Schedule : 0 0 0 * * 3 (Each Wednesday, but you can choose any day of the week, as Microsoft will not apply the updates before one week of their publication) |
Proxy 1
|
Name |
Description |
Root template |
Allowed HTTP methods |
Backend URL |
| getazuredcipranges | This proxy will relay requests to azuredcipranges | /getazuredcipranges | POST | https://azuredcip.azurewebsites.net/api/azuredcipranges (add the key if you have secured it) |
Proxy 2
|
Name |
Description |
Root template |
Allowed HTTP methods |
Backend URL |
| getazuredcipupdates | This proxy will relay requests to azuredcipranges | /getazuredcipupdates | POST | https://azuredcip.azurewebsites.net/api/azuredciprangesupdater?code=typethekeyhere |
Storage Account
|
Name |
Description |
container |
Files |
|
azuredcipsa |
This is the storage account automatically created with the Function app (it can have any other name) | azuredcipfiles | Upload the following files: – vnow.json – vprevious.json NB : These files are fake files. During the first API update request, the vnow content will be copied to the vprevious file. The vnow content will be then replaced by the real current version. At this moment, you can only request the current version. After one week, a new version of the file will be published by MS, so another cycle will set the vnow and the vprevious to real 2 consecutive versions, so you can benefit from the update and comparison feature. |
2.2- Download the files
You can download the needed files here, you will find the powershell code for each function (function1, function2, function3) and the two json files (vnow.json and vprevious.json).
NB : As mentioned before, after the first request to the API (getupdates), you will have a valid vnow version, but the previous version will be the version uploaded now. You need to wait at least 1 week to have the valid version.
Enjoy!!
buildwindows 