ExpressRoute Fridays. with the C+E Black Belts

Transcription

1 ExpressRoute Fridays with the C+E Black Belts Olivier Martin Azure Networking Black Belt Kevin Lopez ER Partner Sales Executive Jaime Schmidtke ExpressRoute Specialist Kevin Sullivan BCDR and ER Black belt

2 Before we get started Welcome customers and partners!!! Material is public information. No NDA info here. Use the IM window for questions. Sessions are recorded. We ll post

3 Agenda for September 16 th, 2016 Azure Network Connectivity from 0 to 60 Deep dive topic of the week: Guest Speaker : Jon Ormond, from Azure Networking Product Group ExpressRoute peering deep dive (Private and Public peering) Azure Networking Partner Spotlight: Check Point Software (vsec) Open Q&A for all customers

4 ExpressRoute from 0 to 60 Internet vs. ExpressRoute analogy Internet is like the free way on the left Drive is less predictable and may need to re-route to another road ExpressRoute is like the toll road on the right Drive is much more predictable. You pay extra, but its sure worth it ExpressRoute has an uptime SLA and customers choose bandwidth!

5 What is ExpressRoute? WAN WAN Public Internet Public Internet

6 ExpressRoute is Dedicated Connectivity ExpressRoute

7 Through a Peering Location! 1.Connectivity to meetup location 2. Aggregation partner s exchange platform 3. Microsoft ER implementation

8

9 Standard Circuit US$ Price Models for ExpressRoute Bandwidth Metered Data - Port Only Egress is $0.025 per GB for Zone 1, $0.05 per GB for Zone 2, and $0.14 per GB for Zone 3 Zone 1 = North America/Europe, Zone 2 = Asia Pacific, Zone 3 = Brazil Office 365 Requires Premium Add-On Circuits Unlimited Data All Zones Zone 1 (US, EMEA) Zone 2 (APAC) Zone 3 (Brazil) 50 Mbps $55 $300 $610 $ Mbps $100 $575 $1,230 $1, Mbps $145 $1,150 $2,300 $3, Mbps $290 $2,750 $5,200 $5,200 1 Gbps $436 $5,700 $8,700 $8,700 2 Gbps $872 $11,400 $17,400 $17,400 5 Gbps $2,180 $25,650 $41,000 $41, Gbps $5,000 $51,300 $82,000 $82,000

10 Premium Circuit Price Models for Azure Workloads Metered Data Plan (Premium) Cicuit Size Zone 1 Zone 2 Zone 3 50 Mbps $ 130 $ 155 $ Mbps $ 200 $ 275 $ Mbps $ 295 $ 445 $ Mbps Data $ Transfer Pricing 690 Zone 1: $ $0.025/GB, 1,090 Zone 2: $0.050/GB, Zone $ 3: $0.140/GB 1,090 1 Gbps $ 1,186 $ 1,886 $ 1,886 2 Gbps $ 2,372 $ 3,122 $ 3,122 5 Gbps $ 5,180 $ 5,180 $ 5, Gbps $ 8,000 $ 8,000 $ 8,000 Unlimited Data Plan (Premium) Circuit Size Zone 1 Zone 2 Zone 3 50 Mbps $ 375 $ 710 $ Mbps $ 675 $ 1,405 $ 1, Mbps $ 1,300 $ 2,600 $ 3, Mbps $ 3,150 $ 6,000 $ 6,000 1 Gbps $ 6,450 $ 10,150 $ 10,150 2 Gbps $ 12,900 $ 19,650 $ 19,650 5 Gbps $ 28,650 $ 44,000 $ 44, Gbps $ 54,300 $ 85,000 $ 85,000 The meter is for egress data. Data that leaves the Microsoft network back to the customer network is considered egress data.

11 How to get started workflow Azure Subscription selected and available Network plan/design and prerequisites done Install latest PowerShell Install ARM modules for Azure and Network Create Resource Group for the circuit Create the circuit via PowerShell or via GUI Send your ExpressRoute partner the Service Key and any other needed info Complete physical circuits/contracts with your Layer 2/Layer3 ER partner Install Azure PowerShell modules Install ASM Modules for ExpressRoute ExpressRoute partner provisions connectivity General Azure ER partner work Legend ARM specific ASM specific Retiring due to ASM/ARM coexistence Configure peerings* O365/CRMOL Azure PaaS Link VNETs for IaaS Test connectivity

12 Creating a circuit via portal.azure.com When creating ER gateway with GUI, it creates a BASIC SKU, 500Mbps max For higher speeds, use the PowerShell commands.

13 Olivier s ExpressRoute Cheat Sheet Basic Info Circuit 1 Bandwidth 500 Peering Location Silicon Valley i.e. AT&T, ExpressRoute Partner Name Verizon, Level3, Equinix, etc. Customer Resource Group Name & Location defined Billing type Metered or unmetered SKU Type Standard or Premium Legend Customer Specific information - adapt to specific requirements ER Partner specific info Variables needed VLAN ID Customer routing subnets /29 or 2* /30 (public IPs) Customer routing subnet /29 or 2*/30 (private or public IPs) Microsoft ASN ASN Registrar Peering ASN Customer ASN Advertised Prefix List (for outbound) NAT pool (for inbound) VNET info Private Peer (IAAS) 100 N/A A.B.C.D/30 E.F.G.H/ N/A 100 priv. or pub ASN (e.g., or pub. ASN) /8, /0, etc. N/A Gateway name & /27 or /26 subnet Public Peer (PaaS) Microsoft Peer (O365, CRMOL) I.J.K.L/30 M.N.O.P/30 Q.R.S.T/30 U.V.W.X/30 N/A N/A i.e. ARIN i.e. ARIN priv. or pub ASN (e.g., or pub. ASN) priv. or pub ASN (e.g., or pub. ASN) Customer SNAT prefixes (NAT Pool) Customer SNAT prefixes (NAT Pool) N/A NAT pool used for MS IPs N/A N/A

14 Partner Contacts Nimbo ExpressRoute SI Partner Perficient ExpressRoute SI Partner Project Leadership ExpressRoute SI Partner Aryaka ExpressRoute Connectivity Partner AT&T AT&T Information Request Form ExpressRoute Connectivity Partner Comcast ExpressRoute Connectivity Partner CoreSite ExpressRoute Connectivity Partner Equinix ExpressRoute Connectivity Partner Level 3 ExpressRoute Connectivity Partner Megaport ExpressRoute@megaport.com ExpressRoute Connectivity Partner Orange galerie.contact@orange.com ExpressRoute Connectivity Partner Tata CommunicatioER@TataCommuniccations.com ExpressRoute Connectivity Partner Verizon Microsoft.SCILeads@verizonwireless.com ExpressRoute Connectivity Partner Zayo azureleads@zayo.com ExpressRoute Connectivity Partner Riverbed msftcloudsales@riverbed.com Network Virtual Appliance Partner Barracuda azure_support@barracuda.com Network Virtual Appliance Partner Check Point Network Virtual Appliance Partner

15 ExpressRoute Checklist & Updated O365 Guidance PDF version to be available Updated Office365

16 Technical Deep Dive with Jon Ormond

17 Customer s network Partner Edge Primary circuit Secondary circuit Microsoft Edge Traffic to Office 365 Services Traffic to public IP addresses in Azure Traffic to Virtual Networks (VNets)

18

19 Range AS Path From Virtual Network / LA / NY Virtual Network West US /24 Gateway / NY / LA Gateway East US /24 ExpressRoute ExpressRoute Los Angeles Microsoft s backbone network ExpressRoute New York ExpressRoute Network carrier s IP VPN or Customers backbone network Range AS Path Range AS Path Office in Los Angeles /16 AS / / / / Office in New York /16 AS 64496

20 Range AS Path From Virtual Network / LA / NY Virtual Network West US /24 Gateway / NY / LA Gateway East US /24 ExpressRoute ExpressRoute Los Angeles Microsoft s backbone network ExpressRoute New York ExpressRoute Network carrier s IP VPN or Customers backbone network Range AS Path Range AS Path Office in Los Angeles /16 AS / / / / Office in New York /16 AS 64496

21 Partner Spotlight : Check Point

22 vsec for Azure Advanced Threat Prevention Security for Public and Hybrid Clouds 2016 Check Point Software Technologies Ltd. [Protected] Non-confidential content

23 NEW IT DEMANDS: CLOUD Enable business agility, streamline processes, enhance competitive advantages, and lower IT costs

24 Cloud Myth: Network Security solutions don t fit in Public / Hybrid Cloud architectures Perception: Too dynamic (rapid adding/removing of VMs, subnets etc.) while network security tools fail to make the needed modifications Network security solutions becomes a single point of failure and don t support HA configuration

25 Reality: Network Security FITS in Hybrid Cloud Arch. Deployed in VMs within VNETs Single or multiple NICs Private or Public IPs Operate in HA mode in cloud Within VNET (HA-cluster) Across availability-set Security policies updated automatically Auto-discovery of cloud assets (new VMs, subnets, etc) reflected in automated policy updates

26 Cloud Myth: Advanced Security models can t be used in Public / Hybrid Clouds Perception: Micro-Segmentation can only be achieved in private cloud not in public cloud

27 Reality: Advanced Security Seamlessly Deployed in Hybrid Clouds. Advanced security methods in Hybrid Clouds: Micro-Segmentation with Advanced Threat Prevention: Fine-tuned network segmentation, popular in privatecloud (SDN based) network Achieved inside VNET s using network firewall and User-Defined Route (UDR) configurations Prevent lateral movement of threats within Hybrid Clouds

28 Check Point vsec for Microsoft Azure Advanced Threat Prevention Security for Hybrid Clouds vsec GATEWAY Comprehensive protections including: Firewall, IPS, AntiBot, AntiVirus, VPN, DLP and SandBlast Zero-Day Protections Secure traffic between applications in the hybrid cloud vsec CONTROLLER Automated security with unified management Context-aware policies leveraging Azure defined objects Consolidated logging and reporting across private, public and hybrid clouds

29 Prevent Lateral Movement of Threats Advanced Threat Prevention Security vsec Gateway prevent lateral threat movement between applications inside hybrid clouds

30 Context-Aware Security Policies Check Point Access Policy Rule From To Application Action 3 4 Finance_App1 (vcenter Object) HR_App2 (Open StackObject) 5 User_ID Database_Group (NSX SecGroup) Finance_Group (ACI EndPoint Group) SAP_App (Azure Object) MSSQL CRM SAP Allow Allow Allow Security policy with application identity tied to SDN and Cloud platforms

31 Flexible Delivery Models BYOL PAYG BYOL requires an open server license. This offering gives you the flexibility to select the software blades you want as well as the level of support. PAYG license means you pay an hourly-based fee depending on how long you use the image.

32 Quickly Enable vsec Advanced Security Enable a Check Point Virtual Gateway in the Azure Cloud Selected Desired Protection Levels

33 One Console to Manage Everything Cisco ACI Enterprise ONE CONSOLE ONE POLICY

34 Network Security Deployed in Azure VNET

35 Protecting the Enterprise Cloud ADVANCED SECURITY FOR ALL DATACENTER TRAFFIC ACI AUTOMATED SECURITY FOR THE HYBRID CLOUD

36 THANK YOU 2016 Check Point Software Technologies Ltd. [Protected] Non-confidential content

37 Advanced Security in Hybrid-Cloud [Restricted] ONLY for designated groups and individuals

38 Open Q&A

39 Thank you! Session recording will be posted shortly here :