Nuts & Bolts of Networking in Azure. Pracheta Budhwar Technology Evangelist, Microsoft

Size: px

Start display at page:

Download "Nuts & Bolts of Networking in Azure. Pracheta Budhwar Technology Evangelist, Microsoft"

Christina Higgins
6 years ago
Views:

1 Learn. Connect. Explore.

2 Nuts & Bolts of Networking in Azure Pracheta Budhwar Technology Evangelist, Microsoft

3 Agenda Must know concepts of networking on Azure Scenarios - Most commonly & asked for scenarios Recent announcements Demos Q&A

4 Customer needs Hyper Scale Global presence Global connectivity Scale out Availability Policy Ecosystem Enterprise Grade Hybrid Seamless Performance Security

5 The Big (Network) Picture Virtual Networks Internet Clients Azure Virtual Network Flexible multi-tier topologies Frontend Connectivity Load-balanced and direct IPs ACLs & DDoS protection Traffic Manager & Azure DNS On premises Datacenter Backend Connectivity Secure Internet cross premises VPN connectivity ExpressRoute direct connectivity

6 foo.cloudapp.net VIP

7 IP Addresses There are multiple ways to access a VM by IP address VIP Virtual IP address An internet-facing IP address that is not bound to a specific computer or network interface card. The cloud service that the VM sits within is assigned the VIP. You can have multiple VMs in a cloud service. They share the same VIP. DIP Dynamic IP address This IP address is dynamically assigned (via DHCP) to your virtual machine by Azure. You rely on DHCP Do NOT statically configure your IP address. Even for DCs. The IP address lease directly equates to the lifetime of the VM. If you create a virtual network, the VM will receive its DIP from that range.

8 IP Addresses

9 Protocols and Endpoints

10 DNS Scenarios Internet Open User Access (Website) SharePoint Persistent FrontEnd VM Role SharePoint Persistent FrontEnd VM Role DC DNS Cloud Service Search and Indes Persistent SQL Service VM Role Local DNS SQL Persistent VM Role SQL Persistent VM Role SQL AlwaysOn SQL Reporting Service SQL Analysis Service SQL Service Web Tier UI Process Components AD / DNS SQL Service App Logic Business Components & Entities Azure Virtual Machine(s) Domain joined to On- Premises Network

11 Connecting Cloud Services with VNET

12 S2S VPN P2S VPNs Existing datacenter

13 Microsoft Azure Extend your premises to the cloud securely On-ramp for migrating services to the cloud Use your on-prem resources in Azure (monitoring, AD, ) On-premises HA VPN Gateway <subnet 1> <subnet 2> <subnet 3> Virtual Network DNS Server Hardware VPN or Windows RRAS Your datacenter

15 Traffic Manager: DNS-based Load Balancing Performance - Direct to closest service based on network latency Round-robin - Distribute equally across all services Failover - Direct to backup service if primary fails also included in other policies

16 Traffic Management Fundamentals

17 Announcements in last 6 months.. Internet connectivity Traffic Manager External Endpoints Instance Level Public IP (Preview) IP Reservation for VIPs Intra-region communication Internal Load Balancing In-Region VNet to VNet Cross-premises connectivity Multiple-Site VPN Cross-Region Vnet to Vnet ExpressRoute

18 Before With multi-site Vnet Connectivity VNet1 US West VNet2 East Asia

19 Before With multi-site and cross-region VNet to VNet VNet1 US West VNet2 East Asia

20 Express Route - Customer want Azure on their Network Branch Office 2 Branch office 2 Branch office 1 WAN Branch office 1 WAN Corp HQ Public internet Corp HQ Public internet

21 Announcements in last 1 week.. Internet connectivity Reverse DNS (PTR) Support Traffic Manager Nested Profiles Instance Level Public IP GA Source IP-based Affinity TCP flow idle connection timeout Virtual network Network Security Group Public non-rfc1918 IPs in VNet ILB for SQL Always On Cross-premises connectivity Forced Tunneling for IPsec VPNs ExpressRoute Multi-Subscription Circuit Sharing ExpressRoute Multi-Circuit VNet High Performance VPN gateway VPN/ExpressRoute Operation Logs IPsec VPN NULL encryption & PFS Network Virtual Appliance Multiple NICs per VM MAC persistence

22 Internet Conectivity

23 Traffic Manager Nested Profiles Enable richer profiles with greater flexibility for large/complex deployments Example: Cross-region failover within a Geo, plus in-region flighting Level 2: Route to nearest Region, with cross-region failover within the Geo Level 3: Load-balance within the region, divert 1% for flighting US West US East Europe Europe Cloud Services

24 Instance-Level Public IP GA Internet IP assigned to a single VM Entire port ranges are accessible Support applications with dynamic public ports; e.g., FTP, multi-media Ideal for workloads with heavy outbound connections Internet LB Instance level public IPs Cloud service Reserved VIP VM1 VM2

25 Source IP-based Affinity All connections from the same Internet client IP to the same backend server 2-tuple/3-tuple hash Scenarios Applications that require multiple connections to the same server Example: media streaming to establish control and data channel to same backend server Azure Load Balancer

26 Increasing Idle Connection Timeout Configurable connection timeout to VIPs Idle connection timeout as high as 30 minutes Better experience for mobile clients connecting to Azure Traffic to the VIP Client Idle Connection Timeout increased up to 30 minutes Server 1 Server 2

27 Virtual Network & Security

Network Security Groups (NSG) Enables network segmentation & DMZ scenarios Access Control List Filter conditions with allow/deny Individual addresses, address prefixes, wildcards

28 Network Security Groups (NSG) Enables network segmentation & DMZ scenarios Access Control List Filter conditions with allow/deny Individual addresses, address prefixes, wildcards Associate with VMs or subnets ACLs can be updated independent of VMs S2S VPNs On Premises 10.0/16 VPN GW Internet Internet Backend 10.3/16 Mid-tier 10.2/16 Virtual Network Frontend 10.1/16

29 DMZ in a Virtual Network NSG NSG NSG NSG

30 Multiple NICs in Azure VMs Multiple NICs enable virtual appliances in Azure MAC/IP addresses persist through VM life cycle Azure Virtual Machine NIC2 NIC1 Default Separate frontend-backend traffic, and management-data planes VIP: Internet Up to 4 NICs per VM Backend Subnet App Subnet Frontend Subnet

31 Bring Your Appliances to the Cloud Building blocks Multiple NICs MAC address persistence Azure Certified Appliance ecosystem Barracuda NG Firewall Citrix NetScaler Riverbed Steelhead, SteelApp, SteelStore More to come!

32 Hybrid Networking Services

Microsoft Azure hybrid offerings Cloud Customer Segment and workloads Secure point-to-site connectivity Secure site-to-site VPN connectivity Developers POC Efforts Small scale deployments

33 Microsoft Azure hybrid offerings Cloud Customer Segment and workloads Secure point-to-site connectivity Secure site-to-site VPN connectivity Developers POC Efforts Small scale deployments Connect from anywhere SMB, Enterprises Connect to Azure compute ExpressRoute private connectivity SMB & Enterprises Mission critical workloads Backup/DR, media, HPC Connect to all Azure services

34 Forced Tunneling On Premises Force or redirect customer Internet-bound traffic to an onpremises site Auditing & inspecting outbound traffic from Azure S2S VPNs Forced Tunneled via S2S VPN Internet Internet Needed by many scenarios for critical security and IT policy requirements VPN GW Backend 10.3/16 Mid-tier 10.2/16 Virtual Network Frontend 10.1/16

35 Gateway Enhancements High Performance Gateway Better throughput More S2S tunnels Pricing $0.49 per gateway hour Data transfer & VNet traffic rates unchanged Gateway SKU ExpressRoute Throughput* S2S Throughput* Default 500 Mbps 100 Mbps 10 Performance 1000 Mbps 200 Mbps 30 * Subject to traffic conditions and application behavior Max Tunnels No Encryption option Better throughput for Vnet-to- Vnet within Azure Intra-/Inter-region Vnet-to-Vnet traffic stays within Microsoft networks, not Internet PFS Support for IKE Compliance requirements & better security Operations Logs Visibility into critical gateway events

37 US Atlanta Chicago Dallas Los Angeles New York Seattle Silicon Valley, CA Washington D.C. EMEA Amsterdam London, UK APAC Hong Kong Singapore Sydney Tokyo AT&T British Telecom Colt Equinix Internet Initiative Japan (IIJ) Level3 Orange SingTel Tata Communications Telecity Group Telstra Verizon Azure datacenters ExpressRoute Locations (today) New Locations and coming soon

38 North Europe West Europe London Amsterdam

39 Sharing ExpressRoute Connections Share an ExpressRoute circuit across other subscriptions Circuit owner must authorize and can revoke Owner gets billed for usage Microsoft Azure ExpressRoute IT Sales R&D Marketing

40 Q&A

41 Follow us online Twitter: prachetab Facebook facebook.com/microsoftdeveloper.india Twitter twitter.com/msdevindia

42 Your Feedback is Important Fill out evaluation of this session and help shape future events. OPTION 1 OPTION 2 Replace this space with the actual QR Code OPTION 3: Feedback stations outside the hall

Cross premise connectivity with Microsoft Azure & Windows Server. Rasmus Hald

Cross premise connectivity with Microsoft Azure & Windows Server Rasmus Hald [Microsoft] @RasmusHaldDK Unique Azure value It all starts with networking Customer site Azure site S2S Connect. Session Demo