Microsoft Networking Academy

Transcription

1 Microsoft Networking Academy with the C+E Global Black Belts Olivier Martin Networking TSP GBB Kevin Lopez ER Partner Sales Executive GBB Jaime Schmidtke ER Partner Sales Executive GBB Eddie Villalba Networking and Open Source TSP GBB Bryan Woodworth Networking TSP GBB

2 Before we get started Welcome customers and partners!!! Material is public information No NDA info here. Use the IM window for questions. Agenda is posted at Sessions are recorded and posted here :

3 Microsoft Networking Academy Update Summer time going on hiatus. But you can watch the archive on Channel 9 : Other infos on the Series

4 Agenda for June 9 th, 2017 Introduction New things in Networking this month Deep dive on Application /Web Application Firewall Open Q&A

5 New Virtual Network (VPN) SKUs! Performance : Basic 100 Mbps VpnGw1 500 Mbps VpnGw2 1,000 Mbps VpnGw3 1,250 Mbps

6 New crypto support : Diffie Hellman Group 1, 2, 14, 24, ECP256 & ECP384 IPsec Policy configurations Why to use that? Can connect policy-based device to route-based GW Traffic Selectors for multiple policy-based devices

7

8 Azure Load Balancer hierarchy AZURE SERVICE WHAT EXAMPLE Internet Traffic Manager (TM) Cross-region redirection and availability apac.news.com emea.news.com us.news.com Azure Traffic Manager (DNS load balancer) Azure Load Balancer (SLB, ILB) In-region scalability and availability emea.news.com AppGw1 AppGw2 AppGw2 Azure Application (AppGW) URL/contentbased routing and Load Balancing news.com/top news news.com/sports news.com/images VMs Web servers IIS, Apache, Tomcat Application VM Application VM VM VM Application VM Application VM VM VM

9 Feature Coverage Deployment Traffic Addressing Manager DNS Infrastructure Load Transport Balancer Layer 4 (TCP/UDP) Infrastructure Application Application Layer 7 (HTTP/HTTPS) Dedicated

10

11 Enhanced connectivity options Round robin load distribution Backend comprises of VMs via NICs Internal IP External Public IP VMSS Connect across VMs in same VNet VMs across connected VNets Cloud services On premises VMs HTTPS Application VNET 1 Cloud Service VNET 2 Cloud Service

12 SSL management SSL termination Increased web farm productivity Central SSL management Application Whitelist Backend Pool 1 User configurable SSL policy Allow/block SSL protocols Ciphers HTTPS TLS1.1 Backend Pool 2 End to end SSL encryption Secure backend communication Enable whitelisting

13 URL routing and multi-site support URL based routing Backend pool selection based on request path Configure up to 20 backend pools contoso.com Application fabrikam.com contoso.com/video/* Videos Multi site support Pack up to 20 different domains or subdomains Each domain to its own backend pool SSL offload via Server Name Indication (SNI) fabrikam.com contoso.com/images/* Images

14 Custom probes and Micro-services Cookie based affinity pin HTTP session to same backend Cookie lifecycle managed by Application Backend Pool Custom probes User defined probes Probe configured at HTTPBackendSettings Multiple probes to same VM on different ports Each port running a different service

15 Diagnostics Integrated with Azure Monitor for customer access Access logs Logs each request/response Log frequency every 5 mins Performance logs Logs gateway instance data Log frequency every 1 min Backend health logs WAF logs Metrics data Alerts Webjobs { { } } "instanceid":"applicationrole_in_0", "clientip":" ", "clientport":"12345", "httpmethod":"head", "requesturi":"/xyz/portal", "requestquery":"", "useragent":"-", "httpstatus":"200", "httpversion":"http/1.0", "receivedbytes":"27", "sentbytes":"202", "timetaken":"359", "sslenabled":"off" "instanceid":"applicationrole_in_1", "healthyhostcount":"4", "unhealthyhostcount":"0", "requestcount":"185", "latency":"0", "failedrequestcount":"0", "throughput":"119427"

16 Protect applications from web based intrusions Highly available, fully managed Built using ModSecurity Core Rule Set most popular WAF deployment Wide community support Preconfigured with OWASP core rule set for common top 10 web vulnerabilities protection SQL Injection XSS attacks Application Application XSS attack WAF WAF Valid request SQL Injection L7 LB L7 LB Site 1 Site 2

17 Provisioning WAF SKU for Application with WAF enabled Available in ARM stack only Detection and Prevention modes Real time Monitoring WAF logs integrated with Azure Monitor Azure Security Center Manage Portal, PowerShell, CLI, SDK supported Application WAF L7 LB Azure Security Center Azure Monitor Storage

18 RuleSet Offered CRS CRS 3.0 Protect from SQL Injection Cross site scripting Protocol violations Generic attacks HTTP rate limiting Scanner detection Session fixation LFI/RFI

19 Rule Configurability Change RuleSet CRS or CRS 3.0 Enable or Disable entire RuleGroups Disable individual rules to eliminate false positives Prevention/Detection modes RuleSet Rule Group Rule WAF

20 Enable WAF log via Monitor Realtime logs to monitor attacks Azure Monitor WAF logs integrated with Customer storage account in JSON format Event Hub OMS Log Analytics enabling search WAF

21 Azure Security Center Recommendation Health alerts Application health

22 HTTP to HTTPS redirects Global and path based redirects Cipher suite control Connection draining Integration with Azure Web Apps

23 Open Q&A

24 Thank you! Session recording will be posted shortly here