Note: Unless otherwise stated, select the default options or, in the case of the subscriptions and resource

groups, the only available

option.

• Create a virtual network.

• The name can be anything ("SpokeVnet1" in this example).

• The primary address space should be 10.10.10.0/24.
• The subnet address range should be 10.10.10.0/26.

• Create a network security group.

• The name can be anything ("SpokeNSG1" in this example).

• Associate this NSG with the virtual network just created

Note: Unless otherwise stated, select the default options or, in the case of the subscriptions and resource groups, the only available
option.

Note: Unless otherwise stated, select the default options or, in the case of the subscriptions and resource groups, the only available
option.

1. Create a virtual machine.

o The VM name can be anything ("SpokeServer1" in this example).
o The VM should be imaged with Windows Server 2019.
o The VM size should be B2s Standard.
o Username and password can be anything ("mythicaladmin" and "RUBYmountain135" in this example).
o The virtual network should be the previously created Vnet ("SpokeVnet1" in this example).
o IMPORTANT: Set Public IP to None.
o IMPORTANT: Set Boot Diagnostics to Off.
Note: A menos que se indique lo contrario, seleccione las opciones predeterminadas o, en el caso de las suscripciones y grupos de
recursos, la única opción disponible.

1. Create a virtual network.

o The name can be anything ("HubVnet1" in this example).
o The primary address space should 10.10.200.0/24.
o The subnet address range should be 10.10.200.0/26.
o Enable the Firewall option.
o The name can be anything ("Firewall1" in this example).
o The subnet address range should be 10.10.200.64/26.
1.
Note: Unless otherwise stated, select the default options or, in the case of the subscriptions and resource groups, the only available
option.

Peer the Virtual Networks Together and Create a Route Table

Note: Unless otherwise stated, select the default options or, in the case of the subscriptions and resource groups, the only available
option.

1. Peer the virtual networks.

o The names of both peers can be anything ("SpokeToHubPeer" and "HubToSpokePeer" in this example).
o IMPORTANT: Enable every peering option except gateway transit.
2. Create a route table and add a new route.
o The route name can be anything ("DefaultRoute1" in this example).
o The address prefix should be 0.0.0.0/0.
o The Next hop type is Virtual appliance.
o The Next hop address is 10.10.200.68, and the IP of the Azure Firewall.
3. Associate the route table to the second Vnet created ("SpokeVnet1" in this example).
Optional: Where indicated, a source public IP may be presented to further demonstrate inbound security filtering. This can be acquired
by querying Google or by browsing to one of many websites such as www.ipcow.com.
IMPORTANT: Before creating the firewall rule, take note of the public IP address of the firewall itself.

1. Add NAT rule collection and create rule.

o The rule collection name can be anything ("RDPForward" in this example).
o The priority can be any number between 100 and 50000 (1000 in this example).
o The rule name can be anything ("RDPtoPractica" in this example).
o Protocols allowed should be both TCP and UDP.
o Source address can be either a wildcard (*) or your public IPv4 address (as described above).
o The destination IP should be the public IP address of the firewall.
o The destination port should be 3389.
o The translated IP address should be the internal IP address of the virtual machine: 10.10.10.4.
o The translated port should also be 3389.
2. Create an inbound rule in the network security group.
o The name can be anything ("RDPtoPractica" in this example).
o The source IP range should be the firewall IP range: 10.10.200.64/26.
o The destination IP range should be 10.10.10.4.
o The destination port should be 3389.
o
3.