Cấu hình Network Watcher

# Tạo Resource Group
az group create \
  --name rg-az104-m31 \
  --location southeastasia \
  --tags Course=AZ-104 Module=31 Environment=Lab

# Tạo VNet + Subnet
az network vnet create \
  --resource-group rg-az104-m31 \
  --name vnet-lab31 \
  --address-prefix 10.31.0.0/16 \
  --subnet-name subnet-web \
  --subnet-prefix 10.31.1.0/24 \
  --location southeastasia

# Tạo NSG với rule chặn SSH từ internet (để test IP Flow Verify)
az network nsg create \
  --resource-group rg-az104-m31 \
  --name nsg-lab31-web \
  --location southeastasia

# Cho phép HTTP (80) từ internet
az network nsg rule create \
  --resource-group rg-az104-m31 \
  --nsg-name nsg-lab31-web \
  --name "Allow-HTTP-Inbound" \
  --priority 100 \
  --direction Inbound \
  --access Allow \
  --protocol Tcp \
  --destination-port-range 80

# Chặn SSH (22) từ internet — để test IP Flow Verify
az network nsg rule create \
  --resource-group rg-az104-m31 \
  --nsg-name nsg-lab31-web \
  --name "Deny-SSH-Inbound" \
  --priority 200 \
  --direction Inbound \
  --access Deny \
  --protocol Tcp \
  --destination-port-range 22

# Gắn NSG vào Subnet
az network vnet subnet update \
  --resource-group rg-az104-m31 \
  --vnet-name vnet-lab31 \
  --name subnet-web \
  --network-security-group nsg-lab31-web

# Tạo VM trong subnet
az vm create \
  --resource-group rg-az104-m31 \
  --name vm-nw-lab31 \
  --image Ubuntu2204 \
  --size Standard_B1s \
  --vnet-name vnet-lab31 \
  --subnet subnet-web \
  --admin-username azureuser \
  --generate-ssh-keys \
  --location southeastasia \
  --tags Course=AZ-104 Module=31

# Tạo Storage Account cho NSG Flow Logs và Packet Capture
STORAGE_NAME="stnwlab31$(date +%s | tail -c 6)"
az storage account create \
  --name "$STORAGE_NAME" \
  --resource-group rg-az104-m31 \
  --location southeastasia \
  --sku Standard_LRS \
  --kind StorageV2 \
  --https-only true

echo "Storage Account: $STORAGE_NAME"
echo "VM tạo xong. Môi trường lab sẵn sàng."

VM_ID=$(az vm show \
  --resource-group rg-az104-m31 \
  --name vm-nw-lab31 \
  --query id -o tsv)

VM_PRIVATE_IP=$(az vm show \
  --resource-group rg-az104-m31 \
  --name vm-nw-lab31 \
  --show-details \
  --query privateIps -o tsv)

echo "VM Private IP: $VM_PRIVATE_IP"

# Test 1: HTTP (port 80) từ internet vào VM — kỳ vọng ALLOW
echo "=== Test 1: HTTP Inbound (port 80) — kỳ vọng Allow ==="
az network watcher test-ip-flow \
  --resource-group rg-az104-m31 \
  --vm vm-nw-lab31 \
  --direction Inbound \
  --protocol TCP \
  --local "$VM_PRIVATE_IP:80" \
  --remote "203.0.113.1:12345" \
  --out table

# Test 2: SSH (port 22) từ internet vào VM — kỳ vọng DENY
echo "=== Test 2: SSH Inbound (port 22) — kỳ vọng Deny ==="
az network watcher test-ip-flow \
  --resource-group rg-az104-m31 \
  --vm vm-nw-lab31 \
  --direction Inbound \
  --protocol TCP \
  --local "$VM_PRIVATE_IP:22" \
  --remote "203.0.113.1:54321" \
  --out table

# Test 3: HTTPS (port 443) outbound từ VM ra internet — kỳ vọng ALLOW (no outbound deny)
echo "=== Test 3: HTTPS Outbound (port 443) — kỳ vọng Allow ==="
az network watcher test-ip-flow \
  --resource-group rg-az104-m31 \
  --vm vm-nw-lab31 \
  --direction Outbound \
  --protocol TCP \
  --local "$VM_PRIVATE_IP:50000" \
  --remote "8.8.8.8:443" \
  --out table

VM_PRIVATE_IP=$(az vm show \
  --resource-group rg-az104-m31 \
  --name vm-nw-lab31 \
  --show-details --query privateIps -o tsv)

NIC_ID=$(az vm show \
  --resource-group rg-az104-m31 \
  --name vm-nw-lab31 \
  --query "networkProfile.networkInterfaces[0].id" -o tsv)

# NSG Diagnostics — xem effective rules trên NIC của VM
echo "=== NSG Effective Security Rules ==="
az network watcher run-configuration-diagnostic \
  --resource "$NIC_ID" \
  --direction Inbound \
  --protocol TCP \
  --source "203.0.113.1" \
  --destination "$VM_PRIVATE_IP" \
  --destination-port 80 \
  --out table

# Next Hop — traffic từ VM đến Google DNS (8.8.8.8)
echo "=== Next Hop: VM → 8.8.8.8 ==="
az network watcher show-next-hop \
  --resource-group rg-az104-m31 \
  --vm vm-nw-lab31 \
  --source-ip "$VM_PRIVATE_IP" \
  --dest-ip 8.8.8.8 \
  --out table

# Bật NSG Flow Logs v2 — ghi toàn bộ traffic qua NSG
STORAGE_NAME=$(az storage account list \
  --resource-group rg-az104-m31 \
  --query "[0].name" -o tsv)

STORAGE_ID=$(az storage account show \
  --name "$STORAGE_NAME" \
  --resource-group rg-az104-m31 \
  --query id -o tsv)

NSG_ID=$(az network nsg show \
  --resource-group rg-az104-m31 \
  --name nsg-lab31-web \
  --query id -o tsv)

az network watcher flow-log create \
  --location southeastasia \
  --resource-group rg-az104-m31 \
  --name flowlog-nsg-lab31 \
  --nsg "$NSG_ID" \
  --storage-account "$STORAGE_ID" \
  --enabled true \
  --format JSON \
  --log-version 2 \
  --retention 7

echo "NSG Flow Logs bật thành công. Logs sẽ xuất hiện trong Storage Account sau 10 phút."
echo "Path: insights-logs-networksecuritygroupflowevent/..."

VM_ID=$(az vm show \
  --resource-group rg-az104-m31 \
  --name vm-nw-lab31 \
  --query id -o tsv)

# Cài Network Watcher Agent trên VM (cần cho Connection Monitor và Packet Capture)
az vm extension set \
  --resource-group rg-az104-m31 \
  --vm-name vm-nw-lab31 \
  --name NetworkWatcherAgentLinux \
  --publisher Microsoft.Azure.NetworkWatcher \
  --version 1.4

echo "Network Watcher Agent cài xong."

# Tạo Connection Monitor — kiểm tra VM đến Google DNS (8.8.8.8:53)
# và đến Microsoft (microsoft.com:443) mỗi 30 giây
az network watcher connection-monitor create \
  --connection-monitor-name "cm-vm-to-internet-lab31" \
  --network-watcher-name "NetworkWatcher_southeastasia" \
  --resource-group "NetworkWatcherRG" \
  --location southeastasia \
  --endpoints '[
    {
      "name": "source-vm-nw-lab31",
      "type": "AzureVM",
      "resourceId": "'"$VM_ID"'"
    },
    {
      "name": "dest-google-dns",
      "type": "ExternalAddress",
      "address": "8.8.8.8"
    },
    {
      "name": "dest-microsoft-com",
      "type": "ExternalAddress",
      "address": "microsoft.com"
    }
  ]' \
  --test-configurations '[
    {
      "name": "tc-udp-dns",
      "testFrequencySec": 30,
      "protocol": "UDP",
      "udpConfiguration": {"port": 53}
    },
    {
      "name": "tc-tcp-https",
      "testFrequencySec": 30,
      "protocol": "TCP",
      "tcpConfiguration": {"port": 443}
    }
  ]' \
  --test-groups '[
    {
      "name": "tg-internet-connectivity",
      "enabled": true,
      "sources": ["source-vm-nw-lab31"],
      "destinations": ["dest-google-dns", "dest-microsoft-com"],
      "testConfigurations": ["tc-udp-dns", "tc-tcp-https"]
    }
  ]'

# Xem Topology của VNet lab31
az network watcher show-topology \
  --resource-group rg-az104-m31 \
  --location southeastasia \
  --output json | python3 -c "
import sys, json
data = json.load(sys.stdin)
print('=== Network Topology Resources ===')
for r in data.get('resources', []):
    print(f\"  Type: {r.get('type',''):<40} Name: {r.get('name','')}\")
"

echo "Connection Monitor tạo xong. Kết quả sẽ xuất hiện sau 2-3 phút."

# Xóa Connection Monitor (nằm trong NetworkWatcherRG, phải xóa riêng)
az network watcher connection-monitor delete \
  --connection-monitor-name "cm-vm-to-internet-lab31" \
  --network-watcher-name "NetworkWatcher_southeastasia" \
  --resource-group "NetworkWatcherRG"

# Tắt NSG Flow Logs trước khi xóa NSG
az network watcher flow-log delete \
  --location southeastasia \
  --name flowlog-nsg-lab31

# Xóa Resource Group — kéo theo VM, VNet, NSG, Storage Account
az group delete --name rg-az104-m31 --yes --no-wait

echo "Cleanup hoàn tất."
echo "Lưu ý: NetworkWatcherRG và NetworkWatcher_southeastasia KHÔNG bị xóa."
echo "Chúng là shared resources, xóa nếu không còn VNet nào trong region."