This guide is intended for IT infrastructure architects and DevOps professionals responsible for deploying or enabling Web Access in the Azure public cloud.
This guide applies to Nasuni Edge Appliance 10.1 and higher.
Introduction
Azure Front Door is a cloud-based content delivery network (CDN) service that improves download performance and optimizes traffic over high-bandwidth connections.
The simplest way to set up Front Door is to expose the Edge Appliance to the internet through a public IP address that allows access only from Front Door. This guide focuses on that configuration and does not cover setups using Azure Private Links.
Prerequisites
The account setting “Restrict Session IP” must be set to False by Nasuni Support.
An Edge Appliance must be deployed to Azure and joined to the NMC.
A public Fully Qualified Domain Name (FQDN) for your instance and corresponding SSL/TLS server certificate.
Access to DNS to set up the FQDN.
Account Configuration
By default, Web Access restricts sessions to a single IP address. Because requests routed through Front Door might originate from different IP addresses, this restriction must be disabled.
To have Restrict Session IP disabled for Web Access, contact Nasuni Support. For more information, see Web Access - Deployment Architecture and Sizing.
Restricting the Public IP
To allow only HTTPS access via the Azure Front Door servers, follow these steps:
Log in to Azure.
Navigate to Virtual Machines and select the Edge Appliance instance.
Expand the Networking category and select Network Settings. A public IP address displays in the right-hand panel. If an IP is not configured, follow these steps:
Click the Configure link, the NIC network settings load.
Click ipconfig1 to load the Edit IP configuration window.
Check the Associate public IP address checkbox. A dropdown box appears, populated with a new public IP address. Alternatively, create a new public IP address by clicking Create a public IP address, followed by Save.
Navigate to the Networking category and click Network settings to refresh the page. The new IP address is displayed.
Scroll down to Rules and click HTTPS. An HTTPS window opens on the right side.
Using the Source drop-down, select Service Tag.
Using the Source service tag drop-down, select AzureFrontDoor.Backend.
Enter “*” in the Source port ranges field.
Using the Destination drop-down, select Any.
Set the Service field to HTTPS.
Click Save.
Adding a Valid Certificate to the Edge Appliance
Azure Front Door requires a properly signed certificate on the origin (Edge Appliance).
To add the certificate to an Edge Appliance, log in to the Edge Appliance on port 8443 and navigate to Configuration → SSL Certificates. A certificate can be generated by clicking Generate Certificate or uploaded by clicking Upload Certificate.
Adding an Azure Front Door
To add a Front Door, follow these steps:
Log in to Azure.
Navigate to the search bar and enter “front door”. Services are displayed in the search result. Select Front Door.
Click Create front door.
Click Quick create.
Enter the following Front Door profile attributes:
Subscription: Use this drop-down to select your subscription.
Resource group: Use this drop-down to choose a resource group.
Name: Enter a name.
Tier: Click Standard.
Endpoint name: Generates a DNS record for all of the IPs.
Origin type: Public IP address.
Origin host name: Use this drop-down to pick the hostname IP address.
Caching: Leave blank.
WAF Policy: Leave blank.
Click Review + create.
Review the profile for accuracy, and click Create.
Click Go to resource and proceed to the Editing the Front Door section.
Editing the Front Door
After provisioning an Azure Front Door, use the following sections to complete the setup.
Origins
To update the origin group, follow these steps:
From the left-hand menu, expand Settings, and click Origin groups.
Click default-origin-group. An Update origin group panel opens on the right side.
Uncheck the Enable session affinity checkbox.
(Optional) To enable health probes, click Enable health probes and enter the following configuration into the provided fields:
Path: /fs/auth/login
Protocol: HTTPS
Probe Method: Get
Interval (in seconds): 100
Navigate to the Origin host name, and click the “…”, followed by edit.
Using the Update origin panel, uncheck the Enable the validation checkbox. The rest of the fields remain unchanged.
Click Apply.
Click Update.
Note: It might take a few minutes for the origin to update.
Rule Sets
After configuring the origin, create a rule set.
To create a rule set, follow these steps:
Navigate to the left-side menu, expand the Settings category, and click Rule sets.
Click +Add.
Enter a Rule set name.
Click Add a condition.
Use the Operator drop-down to select Equal.
Click the Edit in the Values field and use the right-side panel to enter “/”
At the bottom of the Edit panel, click Update.
Click Add an action.
Use the Redirect type drop-down to select Temporary redirect.
Use the Redirect protocol drop-down to select HTTPS.
In the Destination path field, enter “/fs”.
Click Save.
Routes
After configuring the rule set, you must configure the routes.
To configure the Front Door routes, follow these steps:
Navigate to the left-side menu, expand the Settings category, and click Front door manager.
Click Default route.
Navigate to Redirect and check the Redirect all traffic to use HTTPS checkbox.
Next to Forwarding protocol, click the HTTPS only radio button.
Click the Rule set drop-down, and select the rule set created in the previous step.
Click Update.
Testing
After completing the Azure Front Door configuration, follow these steps to confirm a proper setup:
Navigate to the left-side menu, and click Overview.
Copy the Endpoint hostname by clicking
.Paste the endpoint hostname into a browser and confirm that the Web Access page is displayed.
Note: If the redirect rule is not set up or working, append “/fs” to the URL.
FQDN Setup
To use a custom FQDN for a Web Access instance, create a CNAME record in the customer’s DNS that points to the endpoint hostname obtained in the previous step. After the FQDN is registered in DNS, configure the domain.
To set up the FQDN, follow these steps:
Log in to portal.azure.com.
Navigate to Virtual Machines and select the Edge Appliance instance.
Expand the Settings category and select Domains.
Click +Add.
Choose a Domain type.
Non-Azure validated domain: Validates the domain with a non-Azure service.
Azure pre-validated domain: Use Azure to pre-validate the domain.
Choose your method of DNS Management.
Azure managed DNS: Manage the DNS with Azure.
All other DNS services: Use a service that is not Azure.
Use the Custom domain field to enter your custom domain. For example, www.yourdomain.com.
Choose a Certificate type.
Select AFD managed (Recommended) to have Azure create your own certificate.
Note: You must create a CNAME record or a TXT record (if DNS validation is used) in your DNS host that points to the Front Door endpoint.
Select Bring your own certificate to upload your own certificate.
Use the TLS policy drop-down to select the latest policy.
Click Add.
Under the Validation state column, click Pending.
The Validate custom domain ownership panel displays on the right side with instructions on verifying ownership of the domain.
Under the Settings category, click Front Door Manager.
Click the default-route.
Click the Domains drop-down, and select the additional domain.
Click Update.
For more information, see Azure documentation at Domains in Azure Front Door.