Azure(PowerShell)如何向多個現有網路安全組添加額外的IP（源地址前綴欄位）？

我需要一些幫助來向 Azure 中的一堆 NSG 添加額外的 IP (122.21.20.3/12)。這是為了允許額外的源地址。我能夠撰寫一個腳本來幫助我找到受影響的 NSG。我只需要將新 IP 添加到包含另一個類似 IP (122.21.20.2/12) 的 NSG：

$azSubs = Get-AzSubscription

foreach ( $azSub in $azSubs ) {
    Set-AzContext -Subscription $azSub | Out-Null

    $azNsgs = Get-AzNetworkSecurityGroup 
    
    foreach ( $azNsg in $azNsgs ) {
        Get-AzNetworkSecurityRuleConfig -NetworkSecurityGroup $azNsg | Where-Object { $_.SourceAddressPrefix -eq '122.21.20.2/12' } | `
            Select-Object @{label = 'NSG Name'; expression = { $azNsg.Name } }, 
                          @{label = 'Rule Name'; expression = { $_.Name } },
                          @{label = 'Source IP'; expression = { $_.SourceAddressPrefix } },
                          @{label = 'Port Range'; expression = { $_.DestinationPortRange } }, Access, Priority, Direction, `
                          @{label = 'Resource Group Name'; expression = { $azNsg.ResourceGroupName } } 
      
    }    
}

我可以獲得受影響的 NSG 串列。不確定如何將其放入每個的 SourceAddressPrefix 中。Set-AzNetworkSecurityRuleConfig是否用于此目的？請問有人有例子嗎？

非常感謝你！

uj5u.com熱心網友回復：

基于上述要求，我們創建了以下 PowerShell 腳本，它將拉取所有現有的網路安全組及其各自的 NSG 規則。

我們在下面的腳本中添加了一個條件，以僅提取具有ParticularIP我們想要的SourceAddressPrefix 的 NSG 規則，它將更新 NSG 規則為 RequiredSourceIPAddressPrefixes

這是 PowerShell 腳本：

connect-azaccount

$requiredIp=("10.x.x.x/27") ##Ip that you want to check 

$ngs=Get-AzNetworkSecurityGroup ##list all Network Security Groups in the subscription

foreach($ng in $ngs){
    $nsgrule=$ng.SecurityRules ##appending the nsg rules of that particular Network Security Groups

foreach( $item in $nsgrule) {
    $ruleip=$item| Select-Object -Property SourceAddressPrefix,name ##pulling the sourceIPAddressPrefix of that existing NSG rule
       
foreach( $ip in $ruleip)
    {
        if( $ip.SourceAddressPrefix -eq $requiredIp){
        
        $rec=Get-AzNetworkSecurityGroup -Name $ng.Name

        ## add the required IP in the "-SourceAddressPrefix" flag in the below cmdlet to update the NSG rule with the required IP address

        Set-AzNetworkSecurityRuleConfig -Name $ip.Name -NetworkSecurityGroup $rec -SourceAddressPrefix ($($requiredIp),"10.x.x.x/27") -Protocol Tcp -Access Allow -Direction Inbound -DestinationAddressPrefix * -SourcePortRange * -DestinationPortRange * -Priority 310
        Set-AzNetworkSecurityGroup -NetworkSecurityGroup $rec
    }
   }
}
}

這是示例輸出以供參考：

uj5u.com熱心網友回復：

是的，但您需要更改您的 NSG。

類似的東西，也許？

$NSG = Get-AzNetworkSecurityGroup -Name 'MyNSG' -ResourceGroupName 'MyRG'

$Params = @{
  'Name'                     = 'NewRule'
  'NetworkSecurityGroup'     = $NSG
  'Protocol'                 = '*'
  'Direction'                = 'Outbound'
  'Priority'                 = 200
  'SourceAddressPrefix'      = '*'
  'SourcePortRange'          = '*'
  'DestinationAddressPrefix' = '*'
  'DestinationPortRange'     = @('80', '443')
  'Access'                   = 'Deny'
}

Add-AzNetworkSecurityRuleConfig @Params | Set-AzNetworkSecurityGroup

uj5u.com熱心網友回復：

執行此任務的完整腳本是：

connect-azaccount

$requiredIp=("10.x.x.x/27") ##Ip that you want to check 

$ngs=Get-AzNetworkSecurityGroup ##list all Network Security Groups in the subscription

foreach($ng in $ngs){
    $nsgrule=$ng.SecurityRules ##appending the nsg rules of that particular Network Security Groups

foreach( $item in $nsgrule) {
    $ruleip=$item| Select-Object -Property SourceAddressPrefix,name ##pulling the sourceIPAddressPrefix of that existing NSG rule
       
foreach( $ip in $ruleip)
    {
        if( $ip.SourceAddressPrefix -eq $requiredIp){
        
        $rec=Get-AzNetworkSecurityGroup -Name $ng.Name

        ## add the required IP in the "-SourceAddressPrefix" flag in the below cmdlet to update the NSG rule with the required IP address

        Set-AzNetworkSecurityRuleConfig `
            -Name $ip.Name `
            -NetworkSecurityGroup $rec `
            -SourceAddressPrefix ( @($item.SourceAddressPrefix)   $newIP ) `
            -Protocol * `
            -Access Allow `
            -Direction Inbound `
            -DestinationAddressPrefix * `
            -SourcePortRange * `
            -DestinationPortRange * `
            -Priority $item.Priority
        Set-AzNetworkSecurityGroup -NetworkSecurityGroup $rec
    }
   }
}
}

標籤：天蓝色 电源外壳 powershell-2.0 powershell-3.0 azure-powershell

上一篇：在Format-Table中，如何洗掉某些單詞的結果？

下一篇：Powershell生成的計劃任務在運行時什么也不做