The Great Azure Networking Tour. Morgan Simonsen Innofactor

Size: px

Start display at page:

Download "The Great Azure Networking Tour. Morgan Simonsen Innofactor"

Daisy Morgan
5 years ago
Views:

1 The Great Azure Networking Tour Morgan Simonsen Innofactor

MCSA, MCT MVP Twitter: @msimonsen Email:

2 About Your Speaker: Morgan Simonsen Cloud MCSE, MCSA, MCT MVP Blog: morgansimonsen.com

3 Agenda Microsoft Hyper Scale Network Network Topology Architecture Patterns Network Performance Network Virtual Appliances Connectivity Availability Network Security Virtual Data Center (vdc)

4 The Big (Network) Picture Virtual Network Bring Your Own Network Users Internet Azure Virtual Network Segmentation with Subnets Full control with Routes and Security groups vnet Service Endpoints Front-End Access Reserved Public IPs ACLs for security Load balancing DNS services DDoS protection (Basic/Standard) Backend Connectivity ExpressRoute VPN Gateways Backend Connectivity Point-to-site for dev/test for Mac/Windows VPN Gateways for secure site-to-site connectivity ExpressRoute for private enterprise grade connectivity

5 Platform Services Infrastructure Services

7 Microsoft s Global Network 42 Azure regions 8,000+ ISP sessions 100+ edge sites 44 ExpressRoute locations 53,000+ km of lit fiber 2 per DC (metro) 3 per Region (terrestrial) 3+ per Continent (subsea) Low cost 100G QSPF Optimized for metro networks Intelligent traffic management Automatic failure recovery

8 Connecting to Azure Services

9 Regional Networks

Azure Availability Zones Protects applications and data from datacenter failures Unique physical locations within an Azure region Zone: 1 or more datacenters with independent cooling, power and

10 Azure Availability Zones Protects applications and data from datacenter failures Unique physical locations within an Azure region Zone: 1 or more datacenters with independent cooling, power and network Each region with AZs have at least 3 zones Zone-redundant services replicate applications and data across Availability Zones AZ give 99,99% SLA on VM uptime 2 categories of services that support AZ: Zonal service: pinned to a region (VM, managed disk, IP address) Zone-redundant service: platform replicates automatically across zones (zone redundant storage, SQL database, Standard LB) For best results: combine AZ with Azure Regions

11 Azure Availability Zones Regions that support AZ: Central US France Central East US 2 (Preview) West Europe (Preview) Southeast Asia (Preview) Services that support AZ: Linux Virtual Machines Windows Virtual Machines Virtual Machine Scale Sets Managed Disks Load Balancer Public IP address Zone-redundant storage SQL Database Pricing No additional cost when service deployed across AZs AZ-to-AZ data charges

12 Your Network in Azure

13 Your Network in Azure

14 Your Network in Azure

15 Your Network in Azure New VPN Gateway SKUs 6x faster! SKU Workload Throughput* S2S/V2V P2S SLA VpnGw1 Production 650 Mbps Max % VpnGw2 Production 1 Gbps Max % VpnGw3 Production 1.25 Gbps Max % Basic Dev/Test 100 Mbps Max %

Your Network in Azure New VPN Gateway SKUs 6x faster! SKU Workload Throughput* S2S/V2V P2S SLA VpnGw1 Production 650 Mbps Max. 30 128 99.

16 Your Network in Azure New VPN Gateway SKUs 6x faster! SKU Workload Throughput* S2S/V2V P2S SLA VpnGw1 Production 650 Mbps Max % VpnGw2 Production 1 Gbps Max % VpnGw3 Production 1.25 Gbps Max % Basic Dev/Test 100 Mbps Max %

17 Behind the Scenes Proprietary appliance Management Management plane SDN Azure Resource Manager Control Controller Data Control plane Switch (Host) Data plane Key to flexibility and scale is Host SDN

18 Network Performance Virtual Network SND: Network operations implemented in SW are much more variable than those implemented in HW Data center architecture is not homogenous and even varies within a DC; this will impact performance For some VMs encapsulation (NVGRE) is handled in SW by the host; for other VMs it can be offloaded to HW Latency within vnet: 1-2 ms Latency between peered vnets: 1-2 ms (except cross-region peerings) Occasional peaks of 3-4 ms due to network fabric reconfigs First ping might take 3-4 ms because SND routes need to be built Anything above 6 ms would warrant investigation Unless otherwise explained

Global DDoS Protection 2016/12/17: R.I.U. Star Patrol boasts they will take down Xbox and PSN on Christmas Day: https://www.youtube.com/watch?

19 Global DDoS Protection 2016/12/17: R.I.U. Star Patrol boasts they will take down Xbox and PSN on Christmas Day: Feb 2018: Github attacked via a reflection exploit in Memcached generating 1.35 terabits of attack traffic, the largest DDoS attack ever recorded.

21 Azure DDoS Protection offerings

22 DDoS Protection Standard and WAF

23 Azure DNS - Private Zone Support

24 Azure DNS - Private Zone Support

25 Connectivity Cross-Premises

26 Cross-Premises Connectivity

27 Cross-Premises Connectivity ExpressRoute

28 Cross-Premises Connectivity ExpressRoute S2S VPN

29 Cross-Premises Connectivity ExpressRoute S2S VPN

30 Cross-Premises Connectivity

31 New Features ExpressRoute & VPN 6x VPN throughput Improved UltraPerf ExpressRoute gateways (latency) Azure Monitor for ExpressRoute & VPN OMS Network Performance Monitoring for ExpressRoute Network Watcher for VPN Resource Health Check for ExpressRoute & VPN Security & compliance Custom IPsec/IKE policy for VPN Merging Microsoft & Azure Public Peering macos support for P2S AD (Radius)-based authentication ExpressRoute IPv6 for O365 & Azure public services ExpressRoute route filter for Microsoft peering selected services ExpressRoute connection weight Multi-site for policy-based firewalls VPN BGP routes & peering status

32 ExpressRoute Customer s Network Partner Edge Microsoft Edge Microsoft Peering for Office 365 and Dynamics 365 Azure Public Peering for Azure public IPs Azure Private Peering for Virtual Networks

33 ExpressRoute Customer s Network Partner Edge Microsoft Edge Microsoft Peering for Office 365 and Dynamics 365 Azure Private Peering for Virtual Networks

34 Global VNet Peering

35 Network Virtual Appliances Integrated with Azure Marketplace Consistency between on premises & Azure Audit/filter traffic to/from VNet Re-direct traffic flow with custom routes

36 NVA Transit with vnet Peering Internet / / Shared services such as NVA can be placed in Central/Hub VNet UDR routes to resources in peered VNet /16

37 NVA Transit with vnet Peering Internet /16 UDR Destination Next hop Next hop IP /0 NVA / Shared services such as NVA can be placed in Central/Hub VNet UDR routes to resources in peered VNet /16 UDR Destination Next hop Next hop IP /0 NVA

38 NVA Transit with vnet Peering Internet /16 UDR Destination Next hop Next hop IP /0 NVA / Shared services such as NVA can be placed in Central/Hub VNet UDR routes to resources in peered VNet /16 UDR Destination Next hop Next hop IP /0 NVA

NVA Transit with vnet Peering Internet 10.1.0.0/16 Destination Next hop Next hop IP 0.0.0.0/0 NVA 10.0.0.1 10.

services such as NVA can be placed in Central/Hub VNet UDR routes to resources in peered VNet VNet Peering

39 NVA Transit with vnet Peering Internet /16 Destination Next hop Next hop IP /0 NVA /16 UDR UDR Destination Next hop Next hop IP /0 NVA / FWD Shared services such as NVA can be placed in Central/Hub VNet UDR routes to resources in peered VNet VNet Peering is non transitive Spoke can connect to spoke directly or through Forwarder in the Hub /16 NVA FWD

40 Gateway Transit with vnet Peering / / /16 Gateway On-premises sites can be connected to VNets using shared Gateways Gateway Transit is easy to setup and cost effective

41 Gateway Transit with vnet Peering /16 UseRemoteGW / /16 AllowGWTransit AllowGWTransit Gateway On-premises sites can be connected to VNets using shared Gateways Gateway Transit is easy to setup and cost effective UseRemoteGW

42 Security for access to Azure services

43 Securing Access to PaaS Services

44 Securing Access to PaaS Services

45 Securing Access to PaaS Services X

46 Securing Access to PaaS Services X

VNet Service Endpoints Azure Storage AccountA Allow

your critical Azure resources to only your VNet

47 VNet Service Endpoints Azure Storage AccountA Allow VNet A Route Vnet A Services in your VNet, managed by Azure! Directly extends your VNet to the service Secure your critical Azure resources to only your VNet Traffic remains on the Microsoft backbone GA : Azure Storage, Azure SQL Database & Azure Cosmos DB

48 Service Endpoints : Configuration Simple-click setup on an Azure subnet No NAT or GW devices! Network admins can set independently

49 Securing Azure resources to VNets Integrated with service portal dashboards Set for existing or new resources Secure to VNets by name: Service endpoints is a prerequisite Configure once. Automatically applies to all access to child resources.

VNet Service Endpoints : Deep-Dive Azure Storage Storage Diagnostics SrcIP: 10.

50 VNet Service Endpoints : Deep-Dive Azure Storage Storage Diagnostics SrcIP: , AcctA:GetBlob SrcIP: , AcctB:PutBlob Endpoints: Carry VNet identity to the service Source IPs switch to private VNet IPs Before: Source: Public IP1 Source: VM private IP ( ) Access is from VNet1: Subnet1 Service IPs and DNS entries remain asis today Private IP: Public IP1 Subnet 1 Enable service endpoint once. Secure resources as and when you want. VNet1

Access from on-premises Secure Azure resources to onpremises via NAT IPs Add NAT IPs using IP firewall for services With endpoints, service IPs and DNS entries remain as is today

51 Access from on-premises Secure Azure resources to onpremises via NAT IPs Add NAT IPs using IP firewall for services With endpoints, service IPs and DNS entries remain as is today VNetA SERVICE ENDPOINT ExpressRoute Private Peering or Site-to-Site VPN AccountA Internet Allow VNet A Allow Onprem: NATIPs ExpressRoute Public Peering or the Internet On-premises

52 Service Tags in NSGs Restrict network access to just the Azure services you use. Maintenance of IP addresses for each tag provided by Azure Support for global and regional tags (varies by service) Preview: Azure Storage, SQL, TrafficManager Internet Deny Internet outbound Allow only Azure service traffic Network Security Group (NSG) Azure Services Action Name Source Destination Port Allow AllowStorage VirtualNetwork Storage Any Allow AllowSQL VirtualNetwork Sql.EastUS Any Deny DenyAllOutBound Any Any Any

53 Service Endpoints: Filter service traffic with appliances Route: 0/0->NVA Filter: Allow myacct*.blob.core.win dows.net Service endpoints bypass NVAs for service traffic, if registered on originating subnet Subnet 1 NVA Subnet Optionally, continue using NVAs for auditing/filtering service traffic Register endpoint on NVA subnet instead and secure resouces to that subnet SERVICE ENDPOINT Allow NVA Subnet

54 Stitching Azure services together Allow only Azure storage traffic DEPLOY HDI Service HDI Subnet Allow HDI subnet Internet Secure Azure resources to managed service subnets with endpoints Applies to all services directly deployed into VNet

55 Services in a Virtual Network Deploy into Virtual Network VNet Service Endpoints SQL DB Managed Instance Azure Active Directory Domain Services for ARM Azure Batch for ARM Azure App Service V2 Azure API Management Azure Batch for ASM VNets HDInsight Azure App Service V1 RedisCache Azure Storage Azure SQL Database Azure Cosmos DB More services on the roadmap!

56 vnet Security

Simplifying the NSG Management Denying Outbound Internet access is common practice Automating NSG rules to whitelist Azure Datacenter IP ranges is tedious and error prone Introducing Augmented rules,

57 Simplifying the NSG Management Denying Outbound Internet access is common practice Automating NSG rules to whitelist Azure Datacenter IP ranges is tedious and error prone Introducing Augmented rules, comma separated list of IP address ranges Internet Deny Internet outbound Allow only Azure service traffic Azure Services Service Tags are named monikers for Azure Services that are usable in NSG Storage, SQL, AzureTrafficManager Network Security Group (NSG) Action Name Source Destination Port Allow AllowStorage VirtualNetwork IP1, Storage IP2 IP100 Any Allow AllowSQL VirtualNetwork IP101, Sql.EastUS IP102.. Any Deny DenyAllOutBound Any Internet Any Any

58 Application Security Groups Network security as natural extension of application architecture. Security policies for dynamic workloads Network Security Group (NSG) Action Name Source Destination Port Deny BlockQuarantineVMs Any QuarantineVMs Any Allow RemoteRDP VirtualNetwork WindowsVMs 3389 (RDP) Allow RemoteSSH SysAdminVMs LinuxVMs 22 (SSH) Allow AllowInternetToWeb Internet Web 80,8080 (HTTP) Allow AllowWebToApp Web App 443 (HTTPS) Allow AllowAppToDb App Db 3306 (MySQL) Allow AllowMyOnPremises /24, / /28, /25, Deny DenyAllOutBound Any Any Any 80,8080, 443 Universal NSG: Single policy for your virtual network

BlockQuarantineVMs Any QuarantineVMs Any Allow AllowInternetToWeb Internet Web 80,8080 (HTTP) Allow

59 Application Security Groups Effortless scaling Network security management simplified Easy to manage, update and enforce new policies Network Security Group (NSG) Action Name Source Destination Port Deny BlockQuarantineVMs Any QuarantineVMs Any Allow AllowInternetToWeb Internet Web 80,8080 (HTTP) Allow AllowWebToApp Web App 443 (HTTPS) Allow AllowAppToDb App Db 3306 (MySQL) Deny DenyAllOutBound Any Any Any Web App Db QuarantineVMs

60 Enhanced Networking Snapshot for VMs

61 Improved Auditing & Metrics NSG Data plane logs NSG Data plane analytics DDoS metrics and logs WAF Diagnostics logs

62 Availability

63 Outbound Connections in Azure Scenario Method IP protocols Description 1. VM with an Instance Level Public IP address (with or without Load Balancer) SNAT, port masquerading not used TCP, UDP, ICMP, ESP Azure uses the public IP assigned to the IP configuration of the instance's NIC. The instance has all ephemeral ports available. 2. Public Load Balancer associated with a VM (no Instance Level Public IP address on the instance) SNAT with port masquerading (PAT) using the Load Balancer frontends TCP, UDP Azure shares the public IP address of the public Load Balancer frontends with multiple private IP addresses. Azure uses ephemeral ports of the frontends to PAT. 3. Standalone VM (no Load Balancer, no Instance Level Public IP address) SNAT with port masquerading (PAT) TCP, UDP Azure automatically designates a public IP address for SNAT, shares this public IP address with multiple private IP addresses of the availability set, and uses ephemeral ports of this public IP address. This is a fallback scenario for the preceding scenarios. We don't recommend it if you need visibility and control.

64 Why Load Balancing? Load Balancer aka.ms/lbpreview Traffic Manager aka.ms/trafficmanager Application Gateway aka.ms/appgw

65 Load Balancer Public IP Address Private IP Address Public IP Address Part of the Azure SDN stack High performance & low latency for all TCP & UDP applications Flow-based Load Balancing with Health Probing Inbound NAT rules Public Load Balancer Internal Load Balancer Outbound connections Outbound Connections

66 Load balancing scenarios DB DB DB DB DB DB DB DB REGION A REGION B Scalable Redundant Scalable Redundant + Protection

68 Load Balancer SKU Choices Metric Load Balancer Basic Load Balancer Standard Scale Up to 100 Backend instances Up to 1000 backend instances LB Scope Non-zonal Frontend IPs Zone redundant and Zonal Frontend IPs Fault Tolerance Works in a Availability set Works in Availability set and Availability zones Diagnostics Basic NAT and Probe health status Integrated Front end and Backend health metrics NVA - Supports HA Ports Cost Free Charged at GA

69 What s New? Load Balancer New Load Balancer, SKUs Pool up to 1000 instances in VNet, incl instance VMSS Multiple VMSS Zone-redundant data path with single IP Zonal frontends Cross-zone load balancing Cross-zone VMSS HA Ports for NVAs and more Advanced analytics (Traffic Counters, Per Endpoint health probe status, Continuous in-band data plane health, Inbound connection attempts, Outbound connections) Application Gateway Traffic Manager

70 Expands to entire VNet Load Balancer Standard Load Balancer no longer uses Availability Set as a boundary for the backend pool Standalone VMs without Availability Sets Standalone VMs with Availability Sets Virtual machine scale sets with up to 1000 instances Cross-zone VMSS Multiple VMSS Blending VMs and virtual machine scale sets VM scale set VM scale set VM scale set Zone 1 Zone 2 Zone 3 Load Balancer Standard VNet VNet Network Security Groups are required for Public IP and all backend instances VM Scale Set (coming soon) Zone 1 Zone 2 Zone 3

71 SQL SQL SQL DB Subnet VNet Web App Web App Web App Front End Subnet Reference Architecture : Web App with AZs Load Balancer Standard Zone-redundant Load Balancer Standard balances across web frontends with single frontend IP Web frontend across 3 AZs Data layer across 3 AZs SQL on IaaS SQL Azure or CosmosDB NoSQL (Cassandra, MongoDB) Zone 1 Zone 2 Zone 3

72 ARM Template Cross-Zone VMSS and LB

73 ARM Template Zonal VM

74 Takeaways You can use Load Balancer Standard for TCP & UDP scenarios with: Standard Up to 1000 backend instances Zone-redundant frontend Zonal frontend Preview Basic Up to 100 backend instances Non-zonal frontend GA Larger scale Greater flexibility HA Ports New metrics Availability zones Availability Sets not required and Availability Zones Integrated Frontend and Backend health metrics Supports HA Ports NSG required Charged at GA vs. Availability Set (single) Basic NAT and Probe health status - NSG optional Free

75 Network Topology Network Architecture Pattern Virtual Datacenter Best practices vs. Best ideas Scenario dependent designs

76 Thank you! Please do not forget to evaluate the session before you leave!

Microsoft Networking Academy

Microsoft Networking Academy with the C+E Global Black Belts Olivier Martin (@omartin) Networking TSP GBB Jaime Schmidtke (@jaimesc) ExpressRoute Partners GBB Bryan Woodworth (@brwoodwo) Networking TSP