0

I am trying to deploy a new virtual machine in a new subnet with a new NSG, but I get errors while deploying the template.

We are a MSP that builds custom software for our clients called 'SoftWare', which we want to host in Azure.

My current setup is as follows*:

  • A resource group named Contoso.Cloud
  • A virtual network also named Contoso.Cloud with 10.2.0.0/16 as address space
  • A subnet which hosts our backend services like Active Directory and such with 10.2.10.0/24 as prefix.
  • All resources are deployed in the same resource group

My goal with this template is to deploy a new subnet and NSG in the Contoso.Cloud vnet each time we create a new client VM.

*Names are sanitized for security reasons

This is my template:

{
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "adminUsername": {
            "type": "String",
            "metadata": {
                "description": "Username for the Virtual Machine."
            }
        },
        "adminPassword": {
            "type": "SecureString",
            "metadata": {
                "description": "Password for the Virtual Machine."
            }
        },
        "vmSize": {
            "defaultValue": "Standard_F2s_v2",
            "allowedValues": [
                "Standard_F2s_v2",
                "Standard_F4s_v2"
            ],
            "type": "String",
            "metadata": {
                "description": "Size of the virtual machine."
            }
        },
        "clientCode": {
            "type": "String",
            "metadata": {
                "description": "Please enter the ID of the clinic."
            }
        },
        "clientName": {
            "type": "String",
            "metadata": {
                "description": "Please enter the code of the clinic."
            }
        },
        "addressPrefix": {
            "defaultValue": "10.2.0.0/16",
            "allowedValues": [
                "10.2.0.0/16"
            ],
            "type": "String",
            "metadata": {
                "description": "Please enter the vnet address prefix here."
            }
        },
        "subnetPrefix": {
            "type": "String",
            "metadata": {
                "description": "Please enter the subnet prefix here."
            }
        }
    },
    "variables": {
        "storageAccountName": "ContosoStorageTST",
        "nicName": "[concat(toLower(variables('vmName')), '-', uniqueString(resourceGroup().id))]",
        "addressPrefix": "[parameters('addressPrefix')]",
        "subnetName": "[concat(parameters('clientCode'), '_', parameters('clientName'))]",
        "subnetPrefix": "[parameters('subnetPrefix')]",
        "vmName": "[concat(parameters('clientCode'), '-SoftWare1')]",
        "virtualNetworkName": "Contoso.Cloud",
        "subnetRef": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworkName'), variables('subnetName'))]",
        "networkSecurityGroupName": "[concat('SoftWare-NSG-', parameters('clientCode'))]",
        "backendSubnet": "10.2.10.0/24",
        "location": "West Europe"
    },
    "resources": [
        {
            "type": "Microsoft.Storage/storageAccounts",
            "apiVersion": "2018-11-01",
            "name": "[variables('storageAccountName')]",
            "location": "[variables('location')]",
            "sku": {
                "name": "Standard_LRS"
            },
            "kind": "Storage",
            "properties": {}
        },
        {
            "type": "Microsoft.Network/networkSecurityGroups",
            "apiVersion": "2019-08-01",
            "name": "[variables('networkSecurityGroupName')]",
            "location": "[variables('location')]",
            "properties": {
                "securityRules": [
                    {
                        "name": "allow_RDP_in",
                        "properties": {
                            "protocol": "tcp",
                            "sourcePortRange": "*",
                            "destinationPortRange": "3389",
                            "sourceAddressPrefix": "*",
                            "destinationAddressPrefix": "[parameters('subnetPrefix')]",
                            "access": "Allow",
                            "priority": 500,
                            "direction": "Inbound"
                        }
                    },
                    {
                        "name": "allow_core_to_client",
                        "properties": {
                            "protocol": "*",
                            "sourcePortRange": "*",
                            "destinationPortRange": "22",
                            "sourceAddressPrefix": "[variables('backendSubnet')]",
                            "destinationAddressPrefix": "*",
                            "access": "Allow",
                            "priority": 501,
                            "direction": "Inbound"
                        }
                    },
                    {
                        "name": "allow_client_to_core",
                        "properties": {
                            "protocol": "*",
                            "sourcePortRange": "*",
                            "destinationPortRange": "*",
                            "sourceAddressPrefix": "[parameters('subnetPrefix')]",
                            "destinationAddressPrefix": "[variables('backendSubnet')]",
                            "access": "Allow",
                            "priority": 502,
                            "direction": "Outbound"
                        }
                    },
                    {
                        "name": "deny_client_to_other_clients",
                        "properties": {
                            "protocol": "*",
                            "sourcePortRange": "*",
                            "destinationPortRange": "*",
                            "sourceAddressPrefix": "[variables('addressPrefix')]",
                            "destinationAddressPrefix": "[variables('addressPrefix')]",
                            "access": "Deny",
                            "priority": 4000,
                            "direction": "Outbound"
                        }
                    }
                ]
            }
        },
        {
            "type": "Microsoft.Network/virtualNetworks/subnets",
            "apiVersion": "2018-04-01",
            "name": "[concat(variables('virtualNetworkName'), '/', variables('subnetName'))]",
            "location": "[variables('location')]",
            "dependsOn": [
                "[resourceId('Microsoft.Network/networkSecurityGroups/', variables('networkSecurityGroupName'))]"
            ],
            "properties": {
                "addressPrefix": "[variables('subnetPrefix')]",
                "networkSecurityGroup": "[variables('networkSecurityGroupName')]"
            }
        },
        {
            "type": "Microsoft.Network/networkInterfaces",
            "apiVersion": "2018-11-01",
            "name": "[variables('nicName')]",
            "location": "[variables('location')]",
            "dependsOn": [
                "[concat('/subscriptions/<subscription-ID>/resourceGroups/SoftWare.Cloud/providers/Microsoft.Network/virtualNetworks/SoftWare.Cloud/subnets/', variables('subnetName'))]"

            ],
            "properties": {
                "ipConfigurations": [
                    {
                        "name": "ipconfig1",
                        "properties": {
                            "privateIPAllocationMethod": "Dynamic",
                            "subnet": {
                                "id": "[variables('subnetRef')]"
                            }
                        }
                    }
                ]
            }
        },
        {
            "type": "Microsoft.Compute/virtualMachines",
            "apiVersion": "2018-10-01",
            "name": "[variables('vmName')]",
            "location": "[variables('location')]",
            "dependsOn": [
                "[resourceId('Microsoft.Storage/storageAccounts/', variables('storageAccountName'))]",
                "[resourceId('Microsoft.Network/networkInterfaces/', variables('nicName'))]",
                "[concat('/subscriptions/<subscription-ID>/resourceGroups/SoftWare.Cloud/providers/Microsoft.Network/virtualNetworks/SoftWare.Cloud/subnets/', variables('subnetName'))]"
            ],
            "properties": {
                "hardwareProfile": {
                    "vmSize": "[parameters('vmSize')]"
                },
                "osProfile": {
                    "computerName": "[variables('vmName')]",
                    "adminUsername": "[parameters('adminUsername')]",
                    "adminPassword": "[parameters('adminPassword')]"
                },
                "storageProfile": {
                    "imageReference": {
                        "id": "[resourceId('Microsoft.Compute/images', 'SoftWare1-IMAGE-Roles ')]"
                    },
                    "osDisk": {
                        "createOption": "FromImage"
                    }
                },
                "networkProfile": {
                    "networkInterfaces": [
                        {
                            "id": "[resourceId('Microsoft.Network/networkInterfaces',variables('nicName'))]"
                        }
                    ]
                },
                "diagnosticsProfile": {
                    "bootDiagnostics": {
                        "enabled": false,
                        "storageUri": "[reference(resourceId('Microsoft.Storage/storageAccounts/', variables('storageAccountName'))).primaryEndpoints.blob]"
                    }
                }
            }
        }
    ]
}

These are my parameters:

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "adminUsername": {
      "value": "admin-local"
    },
    "adminPassword": {
      "value": "myPassword,"
    },
    "vmSize": {
      "value": "Standard_F2s_v2"
    },
    "clientCode": {
      "value": "TST01"
    },
    "clientName": {
      "value": "TST-Example"
    },
    "addressPrefix": {
      "value": "10.2.0.0/16"
    },
    "subnetPrefix": {
      "value": "10.2.20.0/28"
    }
  }
}

The error I get is:

 "Cannot parse the request. (Code: InvalidRequestFormat)
    - Value for reference id is missing. Path properties.networkSecurityGroup. (Code: MissingJasonReferenceId)

This leads me to believe I need to make an additonal reference to the NSG while deploying the subnet, but in every example template I find this does not happen. When I deploy just the subnet, without NSG, with a different template, it goes of without a hitch.

Another issue might be that there is no vnet specified at the network interface, but when I look at examples, the only thing they do is using the 'dependsOn' option, which is only used when the vnet is created in the same template as the network interface. This is not the case however.

1 Answer 1

0

Your issue is this line in your subnet configuration:

"networkSecurityGroup": "[variables('networkSecurityGroupName')]"

You need to full resource ID of the NSG, not the name.

Change it to

"networkSecurityGroup": "[resourceId('Microsoft.Network/networkSecurityGroups',variables('networkSecurityGroupName'))]"
1
  • Thank you, this has solved my problem
    – Danslerr
    May 6, 2020 at 13:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .