Configure Azure Networking

# To log in to Azure Resource Manager (use TenantID switch for faster log in)
Login-AzureRmAccount [-TenantID xxxxxxxxx]

# To view all subscriptions tied to your account
Get-AzureRmSubscription

# To switch subscriptions
Get-AzureRmSubscription -SubscriptionName "{SubscriptionName}" | Select-AzureRmSubscription

#Create a Resource Group
New-AzureRmResourceGroup -Name "{ResourceGroupName}" -Location "{Location}"

# Ensure you have AzureRm.Compute module is installed
# To view installed modules 
Get-Module

# To list all modules
#Get-Module -ListAvailable

# If AzureRmCompute is not installed, go ahead and install it
#Install-Module AzureRM.Compute

# Create an availability set; use the managed switch if you are using a managed disk
$availset = New-AzureRmAvailabilitySet -ResourceGroupName "{ResourceGroupName}" -Name "{AvailabilitySetName}" -Location "{Location}" [-managed]

# Create a subnet configuration (Note: you can create more than one subnet in your VN)
$subnetConfig = New-AzureRmVirtualNetworkSubnetConfig -Name "{Name}" -AddressPrefix "{IPAddressRange}"

# Create a virtual network (multiple subnets can be added using a comma-delimited list)
$vnet = New-AzureRmVirtualNetwork -ResourceGroupName "{ResourceGroupName}" -Location "{Location}" -Name "{Name}" -AddressPrefix "{IPAddressRange}" -Subnet $subnetConfig

# (Optional) Create a public IP address and specify a DNS name (you may concatenate the $(Get-Random) function to the Name for uniqueness
# This step is optional and only necessary if you require public access to your VM
$pip = New-AzureRmPublicIpAddress -ResourceGroupName "{ResourceGroupName}" -Location "{Location}" -AllocationMethod {Static|Dynamic} -IdleTimeoutInMinutes "{N}" -Name "{Name}"

# Create IP configuration(s)
# When assigning multiple IP configurations, one configuration must be assigned as primary
# To test whether an IP Address is available in your virtual network use the following:
# Test-AzureRmNetworkInterfaceIpConfig -IPAddress "{IPAddress}" -VirtualNetwork "{VirtualNetwork}" 
$IPAddress = "{IPAddress}"
# You can reference subnets be index number of by name using $vnet.Subnets|?{$_.Name -eq "{SubnetName}"} 
$IPConfig = New-AzureRmNetworkInterfaceIpConfig -Name "{Name}" -Subnet $vnet.Subnets[0] -PrivateIpAddress $IPAddress [-PublicIpAddress $pip] -Primary   

# Create any number of security rules
# The example below allows inbound access on port 3389 for RDP connections
$nsgRuleRDP = New-AzureRmNetworkSecurityRuleConfig -Name "{Name}" -Protocol TCP -Direction Inbound -Priority 1000 -SourceAddressPrefix * -SourcePortRange * -DestinationAddressPrefix * -DestinationPortRange 3389 -Access Allow

# Create a network security group and assign the rules (multiple rules can be added using a comma-delimited string)
$nsg = New-AzureRmNetworkSecurityGroup -ResourceGroupName "{ResourceGroupName}" -Location "{Location}" -Name "{Name}" -SecurityRules $nsgRuleRDP

# Create a network interface card and associate with the IP configurations (multiple configurations can be added using a comma-delimited list)
$nic = New-AzureRmNetworkInterface -Name "{Name}" -ResourceGroupName "{ResourceGroupName}" -Location "{Location}" -IpConfiguration $IPConfig -NetworkSecurityGroupId $nsg.Id

# Getting/Setting the storage account is optional.  If not specified, Azure will automatically provision a new storage account
# Get an existing storage account
$sta = Get-AzureRmStorageAccount -ResourceGroupName "{ResourceGroupName}" -Name "{Name}"
# Create a new storage account
#$sta = New-AzureRmStorageAccount -ResourceGroupName "{ResourceGroupName}" -Name "{Name}"  –SkuName "{SkuName}" -Location "{Location}"

# Define a credential object
$cred = Get-Credential

# Create a virtual machine configuration
$vmConfig = New-AzureRmVMConfig -VMName "{VMName}" -VMSize "{VMSize}" -AvailabilitySetId $availset.Id | 
Set-AzureRmVMOperatingSystem -Linux|-Windows -ComputerName "{VMName}" -Credential $cred | 
Set-AzureRmVMSourceImage -PublisherName "{PublisherName}" -Offer "{Offer}" -Skus "{Sku}" -Version latest | 
Add-AzureRmVMNetworkInterface -Id $nic.Id

# (skip if you want Azure to provision this automatically) Set boot diagnostics (the storage account cannot be a premium storage account)
#Set-AzureRmVMBootDiagnostics -VM $vmConfig -Enable -ResourceGroupName "{ResourceGroupName}" -StorageAccountName "{StorageAccountName}"
# (or disable boot diagnostics - enabled by default)
#Set-AzureRmVMBootDiagnostics -VM $vmConfig -Disable

# Set the virtual machine disk (you can add multiple disks; use the CreateOption ATTACH if using a pre-existing disks)
$osDiskUri = $STA.PrimaryEndpoints.Blob.ToString() + "vhds/" + "{Name}" + ".vhd"
Set-AzureRmVMOSDisk -VM $vmConfig -VhdUri $osDiskUri -Name "{Name}" -CreateOption {FromImage|Attach|Empty} -Caching {ReadWrite|ReadOnly|None}

# Create the VM
New-AzureRMVM -ResourceGroupName "{ResourceGroupName}" -Location "{Location}" -VM $vmConfig

# Create the public IP address for the LB
$pipLB = New-AzureRmPublicIpAddress -ResourceGroupName "{ResourceGroupName}" -Name "{IPName}" -Location "{Location}" -AllocationMethod {Static|Dynamic} -DomainNameLabel {"Label"}

# Add the new IP to the front end pool
$frontendIP = New-AzureRmLoadBalancerFrontEndIpConfig -Name "{Name}" -PublicIpAddressId $pipLB.Id

# Create a backend pool
$bepool = New-AzureRmLoadBalancerBackendAddressPoolConfig -Name "{Name}" 

# Setup any initial NAT rule(s)
$inNatRule1 = New-AzureRmLoadBalancerInboundNatRuleConfig -Name "{Name}" -FrontendIpConfiguration $frontendIP -Protocol {TCP|UDP} -FrontendPort "{nnnn}" -BackendPort "{nnnn}"

# Create any health probe(s)
$hProbe1 = New-AzureRmLoadBalancerProbeConfig -Name "{Name}" -Protocol TCP -Port "{nnnn}" -IntervalInSeconds "{nn}" -ProbeCount "{n}"
# HTTP probes have a slightly different notation
#$httpProbe1 = New-AzureLoadBalancerProbeConfig -Name "{Name}" -Protocol http -RequestPath "{RelativeUrl}" -Port "{nnnn}" -IntervalInSeconds "{nn}" -ProbeCount "{n}"

# Create load balancer rule(s)
$lbrule1 = New-AzureRmLoadBalancerRuleConfig -Name "{Name}" -FrontendIpConfiguration $frontendIP -BackendAddressPool $bepool -Probe $hProbe1 -Protocol {TCP|HTTP} -FrontendPort "{nnnn}" -BackendPort "{nnnn}"

# Create the load balancer (multiple rules can be added using a comma-delimited string
$newLB = New-AzureRmLoadBalancer -ResourceGroupName "{ResourceGroupName}" -Name "{Name}" -Location "{Location}" -FrontendIpConfiguration $frontendIP -InboundNatRule $inNatRule1 -LoadBalancingRule $lbrule1 -BackendAddressPool $bepool -Probe $hProbe1

# Additional NAT Rules can be added to the LB after initialization using the following (the same pattern can be used to add probes and LB rules)
#$inNatRule2 = New-AzureRmLoadBalancerInboundNatRuleConfig -Name "{Name}" -FrontendIpConfiguration $frontendIP -Protocol "TCP|UDP" -FrontendPort "{nnnn}" -BackendPort "{nnnn}"
#$newLB | Add-AzureRmLoadBalancerInboundNatRuleConfig $inNatRule2 

# Associate the NIC
# If you need to get reinstantiate the pointer to the NIC card you previously created, use the following:
# $nic = Get-AzureRmNetworkInterface -ResourceGroupName "{ResourceGroupName}" -Name "{Name}"
# You can reference IP Configurations by index or by name using $nic.IpConfigurations|?{$_.Name -eq "{IpConfigName}"}
$nic.IpConfigurations[0].LoadBalancerInboundNatRules.Add($newLB.InboundNatRules[0])
$nic | Set-AzureRmNetworkInterface


# You can also associate the NIC to a backend pool as follows:
$nic.IpConfigurations[0].LoadBalancerBackendAddressPools.Add($newLB.BackendAddressPools[0])
$nic | Set-AzureRmNetworkInterface

# Adding a security rule to and existing security group
# Create the security rule
$nsgRuleXXX = New-AzureRmNetworkSecurityRuleConfig -Name "{Name}" -Protocol {TCP|UDP|*} -Direction {Inbound|Outbound} -Priority 1000 -SourceAddressPrefix * -SourcePortRange * -DestinationAddressPrefix * -DestinationPortRange "{Port(s)}" -Access Allow


# Add the rule to the appropriate NSG
$nsg | Add-AzureRmNetworkSecurityRuleConfig $nsgRuleXXX
$nsg | Set-AzureRmNetworkSecurityGroup