#!
/bin/bash
az vm create \
--resource-group $RG_BRANCH \
--name $APP_VM \
--image UbuntuLTS \
--size $VM_SIZE \
--admin-username $ADMIN_USER \
--generate-ssh-keys \
--vnet-name $VNET_BRANCH \
--subnet $SUBNET_APP
# Wait a little for NICs & NSGs to be created by Azure
sleep 10
# 4. Create VNet peering (bidirectional) — using resource IDs so
SUBSCRIPTION_ID not required explicitly
VNET_HQ_ID=$(az network vnet show -g $RG_HQ -n $VNET_HQ --query id
-o tsv)
VNET_BRANCH_ID=$(az network vnet show -g $RG_BRANCH -n
$VNET_BRANCH --query id -o tsv)
# Peer from HQ -> Branch
az network vnet peering create \
--name HQ-to-Branch \
--resource-group $RG_HQ \
--vnet-name $VNET_HQ \
--remote-vnet $VNET_BRANCH_ID \
--allow-vnet-access
# Peer from Branch -> HQ
az network vnet peering create \
--name Branch-to-HQ \
--resource-group $RG_BRANCH \
--vnet-name $VNET_BRANCH \
--remote-vnet $VNET_HQ_ID \
--allow-vnet-access
# 5. Allow ICMP inbound in NSGs attached to the VMs' NICs
# Get NIC names
DB_NIC=$(az vm show -g $RG_HQ -n $DB_VM --query
'[Link][0].id' -o tsv | xargs -n1 basename)
APP_NIC=$(az vm show -g $RG_BRANCH -n $APP_VM --query
'[Link][0].id' -o tsv | xargs -n1 basename)
# Get NSG names attached to NICs (if any) or to subnet
DB_NSG=$(az network nic show -g $RG_HQ -n $DB_NIC --query
'[Link]' -o tsv || true)
APP_NSG=$(az network nic show -g $RG_BRANCH -n $APP_NIC --query
'[Link]' -o tsv || true)
# If NIC has no NSG, try subnet NSG
if [ -z "$DB_NSG" ] || [ "$DB_NSG" == "" ]; then
DB_NSG=$(az network vnet subnet show -g $RG_HQ --vnet-name
$VNET_HQ -n $SUBNET_DB --query '[Link]' -o tsv ||
true)
fi
if [ -z "$APP_NSG" ] || [ "$APP_NSG" == "" ]; then
APP_NSG=$(az network vnet subnet show -g $RG_BRANCH --vnet-name
$VNET_BRANCH -n $SUBNET_APP --query '[Link]' -o tsv
|| true)
fi
# Create rules if NSGs exist; otherwise create a new NSG and associate to
NICs
create_icmp_rule() {
NSG_ID=$1
RG=$2
if [ -z "$NSG_ID" ] || [ "$NSG_ID" == "" ]; then
# create NSG and associate
NSG_NAME=NSG-$RANDOM
az network nsg create -g $RG -n $NSG_NAME
# Associate to NIC
if [ "$RG" == "$RG_HQ" ]; then
az network nic update -g $RG -n $DB_NIC --network-security-group
$NSG_NAME
NSG_ID=$(az network nsg show -g $RG -n $NSG_NAME --query id -o tsv)
else
az network nic update -g $RG -n $APP_NIC --network-security-group
$NSG_NAME
NSG_ID=$(az network nsg show -g $RG -n $NSG_NAME --query id -o tsv)
fi
fi
NSG_NAME=$(basename $NSG_ID)
# Create ICMP rule
az network nsg rule create -g $RG --nsg-name $NSG_NAME --name Allow-
Ping --priority 1000 --protocol Icmp --access Allow --direction Inbound --
source-address-prefixes '*' --destination-address-prefixes '*' --source-port-
ranges '*' --destination-port-ranges '*'
create_icmp_rule "$DB_NSG" $RG_HQ
create_icmp_rule "$APP_NSG" $RG_BRANCH
# 6. Gather private IPs and print instructions for validation
DB_PRIV_IP=$(az vm show -g $RG_HQ -n $DB_VM --show-details --query
'privateIps' -o tsv)
APP_PRIV_IP=$(az vm show -g $RG_BRANCH -n $APP_VM --show-details --
query 'privateIps' -o tsv)
echo "DB Private IP: $DB_PRIV_IP"
echo "APP Private IP: $APP_PRIV_IP"
echo "To verify: ssh ${ADMIN_USER}@$(az vm show -g $RG_BRANCH -n
$APP_VM --show-details --query publicIps -o tsv)"
echo "From the app VM run: ping -c 4 $DB_PRIV_IP"