Microsoft Networking Academy

Transcription

1 Microsoft Networking Academy with the C+E Global Black Belts Olivier Martin Networking TSP GBB Kevin Lopez ER Partner Sales Executive GBB Jaime Schmidtke ER Partner Sales Executive GBB Eddie Villalba Networking and Open Source TSP GBB Bryan Woodworth Networking TSP GBB

2 Before we get started Welcome customers and partners!!! Material is public information No NDA info here. Use the IM window for questions. Sessions are recorded and posted here :

3 Microsoft Networking Academy Introductory Sessions (200 level) Quick overview or what s new this week (5-10 minutes) Partner Spotlight of the week (35-45 minutes) Q&A (10 minutes) Deep Dive Sessions ( level) Short introduction (5 minutes) Deeper dive topic of the week (35-45 minutes) Q&A (10 minutes) GBB-ANF@microsoft.com to receive detailed schedules for upcoming sessions! Available on Channel 9!

4 Agenda for May 26 th, 2017 Episode #9 Intro Networking from 0-60 Partner Spotlight Security in the Azure cloud using Palo Alto Network s virtual appliances Ask the Experts Q&A

5

6 Seattle Silicon Valley Los Angeles Dublin Toronto Montreal Chicago Quebec City Chicago New York Newport, Wales New York City Washington DC London Las Vegas Washington DC Dallas Dallas US Atlanta Government Germany Berlin Amsterdam Paris Frankfurt Chennai Beijing China ShanghaiOsaka Hong Kong Tokyo Mumbai Singapore Sao Paulo Sydney Melbourne

7

8 Internet Internet Internet Internet Azure load balancer Azure load balancer Azure load balancer Azure load balancer FW FW FW FW FW FW IIS IIS SQL Azure load balancer Azure load balancer Azure load balancer IIS IIS IIS IIS IIS IIS ExpressRoute SQL SQL ExpressRoute SQL Virtual Network Virtual Network Virtual Network Virtual Network Azure subscription Access Control Azure subscription Access Control Azure Active Directory Azure subscription Access Control

9

10

11 Partner Spotlight Palo Alto Networks

12 PALO ALTO NETWORKS NEXT-GENERATION SECURITY PLATFORM

13 Mission To protect our way of life in the digital age by preventing successful cyber attacks. 14

14 Strategic Direction To be the leading independent security company by building the world s most innovative and effective security platform. 15

15 Q2 FY17 Highlights 15,500+ Wildfire Customers 40, Traps Customers More than 1M Nodes Protected 35,000 30,000 25,000 20,000 2,500+ VM-Series Customers 15,000 10,000 5,000-16

16 What s changed? THE EVOLUTION OF THE ATTACKER CYBERCRIME NOW $445 billion industry CYBER WARFARE 100+ nations , Palo Alto Networks. Confidential and Proprietary.

17 Organizational risk What s changed? THE EVOLUTION OF THE ATTACK Mobility threat Identity compromise Zero-day exploits / vulnerabilities Unknown & polymorphic malware Evasive command-and-control Known threats , Palo Alto Networks. Confidential and Proprietary.

18 Failure of legacy security architectures Limited visibility Lacks correlation Manual response DNS protection for outbound DNS DNS protection cloud Endpoint AV Enterprise Network UTM/Blades Anti-APT for port 25 APTs Anti-APT for port 80 APTs Internet Anti-APT cloud Network AV DNS Alert SMTP Alert Web Alert AV Alert Endpoint Alert DNS Alert SMTP Alert AV Alert Endpoint Alert Web Alert AV Alert DNS Alert Web Alert Vendor 1 Vendor 2 Vendor 3 Vendor 4 Internet Connection Malware Intelligence , Palo Alto Networks. Confidential and Proprietary.

19 Requirements for the future DETECT AND PREVENT THREATS AT EVERY POINT ACROSS THE ORGANIZATION Cloud At the mobile device At the internet edge Between employees and devices within the LAN At the data center edge, and between VM s Within private, public and hybrid clouds , Palo Alto Networks. Confidential and Proprietary.

20 Delivering continuous innovation Aperture WildFire Threat Prevention URL Filtering AutoFocus Traps GlobalProtect , Palo Alto Networks. Confidential and Proprietary.

21 A complete security architecture Public cloud Private Cloud Enterprise network , Palo Alto Networks. Confidential and Proprietary.

22 Security: A Shared Responsibility Customer content Platform, Applications, Identity & Access Management Operating System, Network & Firewall Configuration Customers are responsible for their security IN the cloud Encryption Key Management Client & Server Encryption Network Traffic Protection Cloud Infrastructure & Services Compute Storage Database Networking Azure looks after security OF the cloud

23 VM-Series for Microsoft Azure

24 Deployment Use Cases Protect your Azure deployment just as you would your data center Hybrid Segmentation Internet Gateway Remote Access Securely deploy applications in your data center or in the cloud Separate data and applications for compliance and security Protect Internet facing applications Security consistency for your network, your cloud, and your devices

25 Licensing Models: BYOL or PAYG Subscription? Bring your own license (BYOL) Pay as you go (PAYG) Best suited for: Long running, steady-state deployments that may scale over time Comparable to: Buy Rent Costs? CapEx (initial purchase in year 1) Opex (annual renewal after that) Supported environments Licensing, Subscription, Support options? US Gov. Support? All hypervisors supported - move licenses between any supported hypervisor or public cloud Use any combination of capacity SKU (VM- 100, -200, -300, HV), subscriptions and support Yes. Federal Agencies can purchase USG support for the VM-Series On-demand, utility-style, elastic deployments Fixed rate for duration of use, initial annual license and subsequent renewal. OPEX Azure only Bundle 1 or Bundle 2 with no option to mix and match licenses, subscriptions or support programs No. Premium support is included with both bundles; no option to purchase USG Pricing flexibility? High volume purchase discounts apply Fixed pricing in Azure Marketplace: Azure - hourly subscription for Bundle 1 or Bundle 2. No annual option , Palo Alto Networks. Confidential and Proprietary.

26 The VM-Series ELA The VM-Series ELA is an unbounded subscription based model that includes a specific VM-Series model, VM Panorama, subscriptions and support into a single, easy to order and easy to deploy bundle Term VM-Series Support and updates VM-Panorama Subscriptions Launched worldwide in November 2016 Based on existing and projected use of VM-Series firewalls One ELA per model Designed to incent fast adoption Unbounded with no true up within term Designed to account for customer ramp 1 and 3 Year term options Works in all supported environments ~$150k list price is target minimum* New *Minimum still being finalized , Palo Alto Networks. Confidential and Proprietary.

27 What are the benefits of the VM-Series ELA? Consistent security on all supported platforms Cost savings as more of the platform is utilized Predictable opex even if deployments happen faster than planned No true ups and ability to reset plan at term end Greatly simplifies operations with single auth code (vs. 100 s to 1,000 s) , Palo Alto Networks. Confidential and Proprietary.

28 in VNET / User Defined Routes Introduction

29 Zero Trust Assume that no user, interface, application, etc. is automatically trusted Segment the network and force all traffic through a control point for inspection. The cloud makes this easier to do at scale

30 MGMT Private IP: MGMT Subnet: /24 VNET setup in Azure Untrust Private IP: Untrust Subnet: /24 Trust Private IP: Trust Subnet: /24 DMZ Private IP: DMZ Subnet: /24 NAT Private IP: NAT Subnet: /24 Internal-LB Private IP: Internal-LB Subnet: /24 WEB Private IP: WEB Subnet: /24

31 MGMT Private IP: MGMT Subnet: /24 How new VNETers think VNETs work Untrust Private IP: Untrust Subnet: /24 MGMT Subnet: /24 Untrust Subnet: /24 Trust Private IP: Trust Subnet: /24 DMZ Subnet: /24 Trust Subnet: /24 DMZ Subnet: /24 DMZ Private IP: NAT Private IP: NAT Subnet: /24 NAT Subnet: /24 WEB Subnet: /24 Internal-LB Subnet: /24 Internal-LB Private IP: WEB Subnet: /24 NAT Private IP: Internal-LB Subnet: /24 WEB Private IP: WEB Private IP:

32 How new VNETers think VNETs work MGMT Subnet: /24 Untrust Subnet: /24 Trust Subnet: / DMZ Subnet: / NAT Subnet: /24 WEB Subnet: /24 NAT Private IP: Internal-LB Subnet: /24 WEB Private IP:

33 How new VNETers think VNETs work MGMT Subnet: /24 Untrust Subnet: /24 Trust Subnet: / DMZ Subnet: / NAT Subnet: /24 WEB Subnet: /24 NAT Private IP: Internal-LB Subnet: /24 WEB Private IP:

34 How new VNETers think VNETs work MGMT Subnet: /24 Untrust Subnet: /24 Trust Subnet: / DMZ Subnet: / NAT Subnet: /24 WEB Subnet: /24 NAT Private IP: Internal-LB Subnet: /24 WEB Private IP:

35 How VNETs ACTUALLY work MGMT Subnet: /24 Untrust Subnet: /24 Trust Subnet: /24 DMZ Subnet: /24 NAT Subnet: /24 WEB Subnet: /24 Internal-LB Subnet: /24 NAT Private IP: WEB Private IP:

36 User Defined Routes- UDRs.4.4 MGMT Subnet: /24 Trust Subnet: /24 Untrust Subnet: /24 DMZ Subnet: /24 NAT Subnet: /24 WEB Subnet: /24 Internal-LB Subnet: /24 NAT Private IP: WEB Private IP:

37 User Defined Routes- UDRs.4.4 MGMT Subnet: /24 Trust Subnet: /24 Untrust Subnet: /24 DMZ Subnet: /24 NAT Subnet: /24 WEB Subnet: /24 Internal-LB Subnet: /24 NAT Private IP: WEB Private IP:

38 Basic Three-Tier Application

39 Typical Deployment Model Web Subnet: /24 Web Private IP: eth2 -> ethernet1/2 Private IP: Trust Subnet: /24 UDR: /0 -> Untrust Subnet: /24 Internet APP Subnet: /24 APP Private IP: DB Subnet: /24 eth1 -> ethernet1/1 Private IP: Public IP: User IP: DB Private IP: Customer DC Subnet: /16 Express Route Gateway Subnet: /28 Express Route / VPN Tunnel Private Peering

40 Web Private IP: Web Subnet: /24 UDR: /24 -> UDR: /24 -> UDR: /16 -> UDR: /0 -> APP Subnet: /24 UDR: /24 -> UDR: /24 -> UDR: /16 -> UDR: /0 -> eth2 -> ethernet1/2 Private IP: Trust Subnet: /24 UDR: /0 -> ,4 eth1 -> ethernet1/1 Private IP: Public IP: Typical Deployment Model UDRs Untrust Subnet: /24 UDR: /0 -> Internet UDR: /24 -> UDR: /24 -> UDR: /24 -> UDR: /24 -> UDR: /16 -> Express Route. Internet APP Private IP: DB Private IP: DB Subnet: /24 UDR: /24 -> UDR: /24 -> UDR: /16 -> UDR: /0 -> Routing Table /0 -> /24-> /24-> /24-> /16 -> Express Route UDR Subnet: /24 UDR: /24 -> UDR: /24 -> UDR: /24 -> UDR: /24 -> UDR: /24-> User IP: Customer DC Subnet: /16 Express Route Gateway Subnet: /28 Express Route / VPN Tunnel Private Peering

41 Web Private IP: Web Subnet: /24 UDR: /24 -> UDR: /24 -> UDR: /16 -> UDR: /0 -> APP Subnet: /24 UDR: /24 -> UDR: /24 -> UDR: /16 -> UDR: /0 -> eth2 -> ethernet1/2 Private IP: Trust Subnet: /24 UDR: /0 -> ,4 eth1 -> ethernet1/1 Private IP: Public IP: Typical Deployment Model Express Route Connection Untrust Subnet: /24 UDR: /0 -> Internet UDR: /24 -> UDR: /24 -> UDR: /24 -> UDR: /24 -> UDR: /16 -> Express Route. Internet APP Private IP: DB Subnet: /24 UDR: /24 -> UDR: /24 -> UDR: /16 -> UDR: /0 -> Routing Table /0 -> /24-> /24-> /24-> /16 -> eth1 -> ethernet1/1 Private IP: Express Route Gateway Subnet: /28 Express Route UDR Subnet: /24 UDR: /24 -> UDR: /24 -> UDR: /24 -> UDR: /24 -> UDR: /24-> DB Private IP: Routing Table /0 -> /24-> /24-> /24-> /24-> /16 -> eth2 -> ethernet1/2 Private IP: Domain Trust Subnet: /24 UDR: /0 -> Express Route Private Peering Customer DC Subnet: /16

42 Multi-IP Recommended Architectures

43 Base Infrastructure Egress /24 LB-Egress Untrust /24 Trust / AS-FW-Untrust AS-FW-Trust TCP/22 LB-Public INT-FW1-Untrust /24 AS-FW VM-FW1 INT-FW1-Trust /24 AS-FW-Trust IP-LB-Public User Internet TCP/22 AS-FW-Untrust IP-FW1-Egress IP-FW2-Egress Web /24 RT-Web LB-Web AS-Web INT-FW2-Untrust /24 VM-FW2 INT-FW2-Trust / /0 > /16 > /24 > Virtual Network /24 > Virtual Network /32 > Virtual Network HTTP/80 AS-Web INT-Web /2 VM-Web1 SNAT: INT-FWX-Trust DNAT: INT-Web /24 VM-Web2

44 Inbound Request Untrust /24 Trust /24 AS-FW-Untrust AS-FW-Trust LB-Public INT-FW1-Untrust /24 AS-FW VM-FW1 INT-FW1-Trust /24 IP-LB-Public User Internet TCP/22 AS-FW-Untrust IP-FW1-Egress IP-FW2-Egress Web /24 RT-Web LB-Web AS-Web Enable Floating IP INT-FW2-Untrust /24 VM-FW2 INT-FW2-Trust / /0 > /16 > /24 > Virtual Network /24 > Virtual Network /32 > Virtual Network HTTP/80 AS-Web INT-Web /2 VM-Web1 SNAT: INT-FWX-Trust DNAT: INT-Web /24 VM-Web2

45 Inbound Response Untrust /24 Trust /24 AS-FW-Untrust AS-FW-Trust LB-Public INT-FW1-Untrust /24 AS-FW VM-FW1 INT-FW1-Trust /24 IP-LB-Public User Internet TCP/22 AS-FW-Untrust IP-FW1-Egress IP-FW2-Egress Web /24 RT-Web LB-Web AS-Web Enable Floating IP The load balancer will transparently SNAT the outbound response to IP-LB-Public INT-FW2-Untrust /24 VM-FW2 INT-FW2-Trust / /0 > /16 > /24 > Virtual Network /24 > Virtual Network /32 > Virtual Network HTTP/80 AS-Web INT-Web /2 VM-Web1 SNAT: INT-FWX-Trust DNAT: INT-Web /24 VM-Web2

46 Outbound Request Egress /24 LB-Egress Untrust /24 Trust / AS-FW-Untrust AS-FW-Trust TCP/22 INT-FW1-Untrust /24 AS-FW VM-FW1 INT-FW1-Trust /24 AS-FW-Trust Enable Floating IP User Internet IP-FW1-Egress IP-FW2-Egress Web /24 RT-Web AS-Web INT-FW2-Untrust /24 VM-FW2 INT-FW2-Trust / /0 > /16 > /24 > Virtual Network /24 > Virtual Network /32 > Virtual Network INT-Web /2 VM-Web1 SNAT: INT-FWX-Untrust INT-Web /24 VM-Web2

47 Outbound Response Egress /24 LB-Egress Untrust /24 Trust / AS-FW-Untrust AS-FW-Trust TCP/22 INT-FW1-Untrust /24 AS-FW VM-FW1 INT-FW1-Trust /24 AS-FW-Trust User Internet IP-FW1-Egress IP-FW2-Egress Web /24 RT-Web AS-Web INT-FW2-Untrust /24 VM-FW2 INT-FW2-Trust / /0 > /16 > /24 > Virtual Network /24 > Virtual Network /32 > Virtual Network INT-Web /2 VM-Web1 SNAT: INT-FWX-Untrust INT-Web /24 VM-Web2

48 Health Probes Untrust /24 Trust /24 AS-FW-Untrust AS-FW-Trust LB-Public INT-FW1-Untrust /24 AS-FW VM-FW1 INT-FW1-Trust /24 LB-Egress IP-LB-Public TCP/22 AS-FW-Untrust TCP/22 AS-FW-Trust INT-FW2-Untrust /24 VM-FW2 INT-FW2-Trust /24 The Problem: Health checks always source from A virtual router can only route an IP address one direction

49 High Availability Notes

50 Challenges - Speed - Connectivity

51 Solutions (Hint: Think Cloudy ) - Use services with high reliability and redundancy - Scale out instead of up - Spread the risk

52 Templates

53 ARM template Two JSON files Build the entire resource group, or create specific resources You can use more to separate resources and make it modular ResGp1.parameters.json: User needs to fill in: VM size, username, password ResGp1.json: Main resources file { "$schema": " "contentversion": "", "parameters": { }, "variables": { }, "resources": [ ], "outputs": { } // user-assigned label or version number of the template file // declare stuff from the.parameters.json file // define static values you use repeatedly in the file // this is where you ask for stuff: VM, NIC, IP... can configure their properties // output of this deployment request sent to Azure } For more see:

54 Overview Review ARM template for deploying VM-Series vmseries.json and vmseries.parameters.json Deploy via Azure CLI azure group deployment create -g <ResourceGroup> -n <DeploymentName> \ f vmseries.json \ -e vmseries.parameters.json -v Monitor progress of deployment in Azure web portal and on CLI Play around the Azure portal: resource group, VNET, subnets, VM s Connect into VM-Series, configure DHCP on dataplane interfaces Review UDR route tables in Azure portal Learn basic debugging in Azure portal

55 Miscellaneous

56 Features Not Supported (Yet) (native) VM Monitoring Customers can create Azure PowerShell scripts to feed in DAGs for this VM Monitoring will be available in future as an addon component (scripts) similar to support for KVM/OpenStack

57 Questions?

58 Resources

59 Open Q&A

60 Thank you! Session recording will be posted shortly here