ExpressRoute Fridays. with the C+E Black Belts

Transcription

1 ExpressRoute Fridays with the C+E Black Belts Olivier Martin Azure Networking Black Belt Kevin Lopez ER Partner Sales Executive Jaime Schmidtke ER Partner Sales Executive Kevin Sullivan BCDR and ER Black belt

2 Before we get started Welcome customers and partners!!! Material is public information. No NDA info here. Use the IM window for questions. Sessions are recorded. We ll post

3 Agenda for September 30 th, 2016 Ignite : Great new things! Deep dive topic of the week: Guest Speaker : Karthik Ananthakrishnan (Azure Networking Principal Product Manager for ExpressRoute) ExpressRoute Layer 2 Detailed Scenarios Azure Networking Partner Spotlight: Barracuda Networks (NGF) Open Q&A!

4 What s new from Ignite 2016?!

5 High performance networking

6 Performance increase across all VM SKUs globally

7

8 SDN/Networking policy applied in software in the host Hardware accelerators used to apply all policies

9 The Virtual Datacenter

10

11 Internet Internet Internet Internet Azure load balancer Azure load balancer Azure load balancer Azure load balancer FW FW FW FW FW FW IIS IIS SQL Azure load balancer Azure load balancer Azure load balancer IIS IIS IIS IIS IIS IIS ExpressRoute SQL SQL ExpressRoute SQL Virtual Network Virtual Network Virtual Network Virtual Network Azure subscription Access Control Azure subscription Access Control Azure Active Directory Azure subscription Access Control

12

13 Building and running services on Azure

14

15 IPv6 for Azure VMs : General Availability Azure IPv6 IPv6 VIP Azure VMs (IaaS) VM VM VM IPv4 IPv4 VIP Azure Services & Storage Azure Load Balancer Inbound & Outbound Internet IPv6 Clients & Services IPv4 Clients and Services

16 ModSecurity and Core Rule Set Application XSS attack Gateway Site 1 Valid request WAF Site 2 SQL Injection L7 LB

17 WAF SKU for Application Gateway Available for public and private endpoints Application Gateway WAF WAF logs integrated with Azure Insights Azure Security Center coming soon L7 LB Portal, PowerShell, SDK supported Azure Security Center Azure Insights Storage

18 AG AG AG SQL VM SQL VM Virtual Network

19 Virtual Network Enables new virtual appliance scenarios

20 Secure and private crosspremises connectivity

21 BGP for redundant paths and dynamic routing Automatic shortest path selection and failover Transit over Microsoft global network Secure connectivity using Internet only for last mile

22 Support on-premises network with multiple ISPs and VPN devices

23 From active-standby to active-active Support both cross-premises and VNet-to-VNet connectivity Spreading traffic over multiple tunnels simultaneously

24 Seattle Silicon Valley Los Angeles Dublin Toronto Montreal Chicago Quebec City Chicago New York Newport, Wales New York City Washington DC London Las Vegas Washington DC Dallas Dallas US Atlanta Government Germany Berlin Amsterdam Paris Frankfurt Chennai Beijing China ShanghaiOsaka Hong Kong Tokyo Mumbai Singapore Sao Paulo Sydney Melbourne

25

26 Gateway SKU Max. Throughput (Gbps) Standard 1 HighPerformance 2 UltraPerformance 10

27

28 Monitoring and Diagnostics

29 Deeper insights into your network ExpressRoute Peering connection statistics ARP table, Route Summary, Route Table Virtual Network Effective security rules on every NIC Next hop and effective routes for every NIC in the subnet Application Gateway Metrics and alerts Back end health information Internet

30 Technical Deep Dive with special guest : Karthik Ananthakrishnan ExpressRoute Principal Product Manager

31 ExpressRoute Customer Connectivity Options Customers can connect to Expressroute using: 1. Virtual cross-connection to Expressroute through the co-location providers ethernet-exchange 2. Point-to-point Ethernet connection through a service provider 3. IPVPN connection through a MPLS provider MPLS providers typically offer managed Layer 3 connectivity and will address the VLAN mapping and routing for Expressroute. Layer 2 providers will typically provide VLAN mapping for Customers. Customers are responsible for setting up routing with Expressroute.

32 Partner Edge Partner Edge Primary Circuit Secondary Circuit Microsoft Edge Microsoft Edge CTAG: 10 Traffic to Office 365 Services CTAG: 20 Traffic to public IP addresses in Azure CTAG: 30 Traffic to Virtual Networks (VNets)

33 ExpressRoute VLAN Scenarios With Layer 2 Providers (802.1Q) 802.1Q VLAN Handoff To Customer Some Customer Edge devices does not support QinQ VLANS. The layer 2 provider will provide a VLAN mapping service to provide 802.1Q handoff to customers. Customer can terminate the provider layer2 connection on a single device or device pair.

34 ExpressRoute VLAN Scenarios With Layer 2 Providers (802.1ad) 802.1ad (QinQ) VLAN Handoff To Customer In this example, the provider swaps the outer tag on the carrier network. The Inner tag assigned on the ExpressRoute circuit can remain unchanged or remapped by the provider. Customer needs to configure a BGP Pair for each routing domain (Private, Public and Microsoft) for SLA with ExpressRoute

35 Azure Portal Set-up For VLAN and Routing Configuration

36 Partner Spotlight : Barracuda Networks

37 Accelerating Your Journey to a Safe Cloud Barracuda Security Solutions for Microsoft Azure +

38 Today s Discussion It s all about securing workloads in Microsoft Azure Moving applications to the cloud Building out data center capacity The logistics of remote connectivity of workloads in the cloud How to ensure security across common scenarios

39 Migrating to the Cloud? Prepare for These Common Challenges: Security, privacy, and compliance concerns Managing mission-critical or development workloads Complexities of migrating your physical data center to Microsoft Azure Vulnerabilities to mobile and Bring-Your-Own-Devices, web 2.0 applications, and remote network users

40 Customer s Responsibility in a Shared Security Model Your company Network Security Customer Applications & Content Identity & Access Control Operating Systems / Platform Data Encryption You define controls and security IN the Cloud Azure Platform Physical Infrastructure Network Infrastructure Virtualization Layer Azure takes care of the Security OF the Cloud

41 Barracuda Security Solutions for Microsoft Azure Accelerating Your Journey to a Safe Cloud Security Compliance Migration Control Ensure users, data and applications are protected Employ multi-layer security, archiving, and data protection technology Optimize user productivity Improve company-wide collaboration and minimize employee downtime Seamless, unified experience Continue the same level of familiarity with the technologies as workloads are moved from on-premises to the cloud Maximize Azure investment Overcome potential adoption challenges to realize the value of your investment faster

42 Barracuda NextGen Firewall F

43 Barracuda NextGen Firewall F on Azure The Ultimate Protection Against Network Security Threats Cloud Security Threats Community gaps Exploited system vulnerabilities Remote access Networking Protection IPS/IDS Integrated intrusion prevention URL filtering User and application aware IPsec VPNs secure remote connectivity Dynamically scales with your network Networking & Infrastructu re

44 Most Common Use Cases VPN Tunnels Unlimited site-to-site VPN tunnels to connect two networks protected by F-Series Firewalls Multi-Tier Architecture Build secure multi-tier architecture in Azure to keep a level of segregation between tiers ExpressRoute Visibility and control on all traffic coming across the ExpressRoute connection Traffic Control Inbound/outbound traffic control while providing IPS/IDS functionality Access to Resources Access to resources in Azure (unlimited clientto-site VPN, SSL VPN)

45 Use Case Multi-Tier Deploying Multi-Tier Architecture in Azure Use Case Multi-Tier Secure remote access for mobile users Dedicated VPN clients available for Windows, Mac, Linux Clientless SSL VPN Multiple supported protocols: TINA, IPsec, L2TP, PPTP Multiple site-to-site connectivity VNET-to-VNET connectivity Automatic user ID synchronization across sites Supports multiple ISPs Built-in WAN optimization Full ExpressRoute support Comprehensive security enforcement Internal and cross-region network segmentation Access control based on user and instance identity Full traffic visibility and monitoring

46 Best Practices Multi-Tier Architecture Use Case Multi-Tier Preventing direct connections through a reverse-proxy architecture Terminate all connections at a proxy Decrypt all data Inspect for any malicious content or embedded attacks Controlling traffic between VNETs Provide full visibility into traffic using IP, port, application, or protocol Control traffic between VNETs (block, allow, or re-direct)

47 Improve VPN Connectivity Overcoming IPsec Limitations Use Case Multi-Tier Powerful extensions to standard IPsec tunnel management TINA (Transport Independent Network Architecture) developed exclusively by Barracuda The TINA protocol allows use of TCP, UDP, and ESP for high speed VPN connections Substantially improves the VPN connectivity

48 Use Case - ExpressRoute Protecting Microsoft Azure ExpressRoute Use Case ExpressRoute Security Encrypts traffic across ExpressRoute Prevents direct traffic flow between applications and the cloud Inspects and logs all inbound and outbound traffic for reporting purposes Reliability VNET-to-VNET connectivity Automatically sets up a VPN for secondary connection in the event of failure Allows multiple ExpressRoutes; one primary and one secondary Intelligence Prioritizes traffic from any specified application and sends it via a configured link Blocks specific application traffic from going to and from Azure Allows or denies certain users based on credentials and access privileges

49 Best Practices Securing ExpressRoute Use Case ExpressRoute Preserving Low Latency Maintain a quality of service based off of protocol and application to achieve equal or better bandwidth than other applications Enabling End-to-End Line Security Encrypt traffic from end-to-end and send it through the system, while maintaining full control over keys and algorithms Controlling Traffic Access Monitor and control traffic based on IP addresses, ports, protocol, user identity, AD security groups, FQDN, Application Detection, and RPC portmapper information Protecting Networks from MPLS Failure Switch to an internet baseline in the event of MPLS router or line failure, and then automatically use that particular connection

50 User and Application Awareness Barracuda NextGen Firewall F Use Case ExpressRoute

51 Next Steps and Resources Learn Contact Try Ask 1. Learn more For a rich library of resources, visit the Barracuda Azure website Videos Technical Briefs 2. Contact Barracuda azure_support@barracuda.com 3. Start a 30-day free trial Deployment Architecture Diagrams 4. Ask for a demo and proof-of-concept

52 Open Q&A

53 Thank you! Session recording will be posted shortly here :