Can IPAM be used to manage AVS devices

[tonydean37]

Hi,

This project looks really interesting and sounds ideal for keeping track of native Azure IP addresses. I was wondering if it has the ability to read the information in an AVS instance so we can automatically track/monitor usage in that environment?

Thanks

[DCMattyG]

Hey @tonydean37, I'll make the assumption you're referring to Azure VMware Solution here. At this moment, Azure IPAM isn't aware of the address space consumed in the Private Clouds within an AVS. That said, I'll get working on integrating it right away, since I agree visibility into AVS Private Clouds would be extremely useful here.

Thanks for the suggestion!

[DCMattyG]

Hi @tonydean37 , first and foremost please ask as many questions as you'd like. We're here to help you be successful and to make sure everyone enjoys our IPAM project.

It's funny you should mention Public IP's as I was just having this conversation with a colleague the other day...

I'm curious what you mean by "managed" in the context of Azure Public IP's. Generally these IP's are pulled from Azure-owned blocks and not in the control of the customer, and often are not able to be summarized into a large CIDR as they can be highly non-contiguous. We're you just looking for a way to track the currently assigned Public IP's for various endpoints, or are you implying something else?

[tonydean37]

Brill - thank you. :)

The major benefit would be to be able to discover these, so we have a record of them in a single IPAM solution. Ideally including the DNS name and associated device where possible.

When I saw that we had about 30 that are not associated with anything, it made me think if we could somehow integrate this into automation? So if a user needed a public IP, check to see if there is one that isn't associated to anything and use that. I think that could become a bit complicated though and could cause issues further down the line if someone has created a PIP for their own use and not assigned it to anything yet, so the more I think about it, then the less I think it is required.

As you say, the fact that PIPs are highly non-contiguous, I'm not too sure how this would look in the database, but it would be nice if these were all in a single section, to provide a quick overview of PIP usage.

[tonydean37]

Morning @DCMattyG, I've been having a bit of a play with Azure Resource Graph and seeing what I can pull out regarding IPs. I saw a workbook Clive Watson had written, so have added a bit of code, so we can pull out the PIP of the Azure firewalls we have too. I can then create a workbook for PIPs so we have a record somewhere.

Wondered if you thought this would cover all PIPs, or if there are other resource types I would need to look at too?

Resources
//| where (type == "microsoft.network/publicipaddresses" or type == "microsoft.network/azurefirewalls")
| extend Details = pack_all()
| extend FWipAddress = extract(@'"address":"(.*)"',1,tostring(properties.hubIPAddresses.publicIPs))
| extend DNSName = extract(@'domainNameLabel":(.*),',1,tostring(properties.dnsSettings))
| extend FQDN = extract(@'fqdn":(.*)',1,tostring(properties.dnsSettings))
| extend AttachedResource = extract(@':"(.*)"',1,tostring(properties.ipConfiguration))
| extend IPAddress = strcat(FWipAddress, tostring(properties.ipAddress))
| summarize count() by subscriptionId, resourceGroup, type
, publicIPAllocationMethod = tostring(properties.publicIPAllocationMethod), name, IPAddress, FWipAddress, DNSName, FQDN
, tostring(properties.ipAddress)
, tostring(properties.provisioningState)
, tostring(properties.publicIPAddressVersion)
, AttachedResource
| where isnotempty(publicIPAllocationMethod) or isnotempty(FWipAddress)
| project subscriptionId, resourceGroup, ['type'], name, IPAddress, publicIPAllocationMethod, DNSName, FQDN, properties_provisioningState, properties_publicIPAddressVersion, AttachedResource
| order by IPAddress desc

[DCMattyG]

Thank you for this @tonydean37! I'll definitely use this as a starting point. My intention is to have a separate page where users can view all of the Public IP information, and it will also have the PIP's matched to their attached resources where applicable.

I'm wrapping up the vWan Hub work today, and then starting the AVS exploration next. Public IP's are in my queue right after we see what we can do for AVS.

[tonydean37]

This all sounds really great - thank you :). Appreciate the speedy responses to all the queries.

Have a great weekend!