Microsoft Azure Hybrid NetWorking principles

ADVANCED MICROSOFT
CLOUD INFRASTRUCTURE & AUTOMATION
Week 2 – Virtual Networks
Day 2 – Hybrid Networking

WHAT WE WILL LEARN TODAY
• Understand Azure VPN Gateways
• Azure Point-to-Site Connection
• Azure Virtual Wide Area Network (WAN)
• Network Virtual Appliance (NVA) in a Virtual Hub
• Azure ExpressRoute

VPN GATEWAY
• Azure VPN Gateway is a service that
can be used to send encrypted
traffic between an Azure VNet and
on-premises locations over the
Internet
• It can also be used to send
encrypted traffic between Azure
VNets over Microsoft network
• Multiple connections can be
created to the same VPN gateway,
however, all VPN tunnels share the
available gateway bandwidth
There are 3 configurations for the
VPN Gateway:
1. Site-to-Site (S2S): connections
connect on-premises datacenters
to Azure
virtual networks
2. VNet-to-Vnet: connections
connect Azure virtual networks to
each other
3. Point-to-Site (User VPN):
connections connect individual
devices to Azure virtual networks

VPN GATEWAY
CREATION
• The first step is to create Gateway Subnet to
contain the IP addresses for the VPN tunnels
(preferred CIDR block of /27 or larger)
• Azure will deploy gateway VMs to the gateway
subnet and the required VPN gateway settings
will be automatically configured
• Never deploy other resources (for example,
additional VMs) to the gateway subnet
• The VPN is Route-based, with the gateway
SKU affecting the number of connections it
can have and the aggregate throughput
benchmark
• Create a virtual network that includes the
gateway subnet and provide it with a public IP
address
• It can take up to 45 minutes to provision the
VPN gateway

VPN GATEWAY
LOCAL NETWORK GATEWAY
• The Local Network Gateway
reflects the on-premises
network configuration and enables
Azure to route to your on-premises
network
• Give the site a name by which
Azure can refer to it
• Use a public IP address or Fully
Qualified Domain Name (FQDN)
for the Endpoint
• Specify the IP address prefixes that
will be routed through the gateway
to the VPN device

VPN GATEWAY
ON-PREMISES VPN DEVICE
• Consult the list of supported
VPN devices (Cisco, Juniper,
Ubiquiti, Barracuda Networks) for
how to configure the device
(VPN device configuration script
may be available)
• Specify the public IP address as
setup in Azure (previous slide)
• Create a shared key to use with
the Azure connection (next slide)

VPN GATEWAY
CONNECTING
• Once the VPN Gateway is created
and the on-premises device is
configured, create a connection
object
• Configure a name for
the connection and specify the type
as Site-to-site (IPsec)
• Select the VPN gateway and the
Local Network Gateway
• Enter the shared key (created in
previous slide) for the connection

VPN GATEWAY
S2S CONNECTION
• Take time to carefully plan your network configuration
• On-premises configuration of VPN Device is necessary when
connecting Site-to-Site
• Always verify and test your connections

VPN GATEWAY
VALIDATION & TROUBLESHOOTING
• Validate VPN throughput to a VNet
• Troubleshoot Azure VPN Gateway using diagnostic logs
• Check whether the on-premises VPN device is validated
• Verify the shared key and the VPN peer IPs
• Utilize Network Watcher
• Check UDR and NSGs on the gateway subnet
• Verify the Azure gateway health probe
• Check whether the on-premises VPN device has the perfect forward
secrecy feature enabled

EXERCISE
CREATE A VIRTUAL NETWORK GATEWAY
Configure a virtual network
gateway to connect the Contoso
Core Services VNet and
Manufacturing VNet

POINT-TO-SITE
• OpenVPN® Protocol: an open-source VPN
protocol that creates secure, encrypted
connections over the internet using
SSL/TLS
• Secure Socket Tunneling Protocol (SSTP):
this protocol is developed by Microsoft for
secure, encrypted client / server
connection using SSL/TLS over TCP port
443
• IKEv2 VPN: Internet Key Exchange version
2 is a VPN protocol that establishes secure
connections by authentication processes
within the IPsec suite
• Azure certificate authentication: obtain a
root certificate and upload the public key
information to Azure, so the root
certificate is considered 'trusted' for P2S
connection
• Microsoft Entra authentication: gateway
options using Basic SKUs or a policy-
based VPN type are incompatible with
P2S VPN gateways that use Microsoft
Entra ID authentication
• Active Directory (AD) Domain Server:
requires a RADIUS server that integrates
with the AD server and allow users to sign
in to Azure using their organization
domain credentials
Available Protocols Authentication Methods

POINT-TO-SITE
CONFIGURATION IN AZURE
• Navigate to the Settings section of the
virtual network gateway
• Select Point-to-site configuration and
click Configure now to open the
configuration page
• On the Point-to-site configuration
page, in the Address pool box, add
the private IP address range that you
want to use
• VPN clients dynamically receive an IP
address from the range that you
specify
• The minimum subnet mask is 29 bit for
active/passive and 28 bit for
active/active configuration

VIRTUAL WANS
• Azure Virtual WAN is the service that
Brings together S2S, P2S, and
ExpressRoute
• It implements the integrated
connectivity using Hub-and-Spoke
connectivity model
• Virtual Networks and workloads are
automatically connected to the Azure
hub to enable visualization of the end-
to-end flow within Azure
• There are 2 types of WAN:
• Basic WAN: which only supports S2S
connectivity
• Standard WAN: which support all
connections over the virtual hub

VIRTUAL WANS
CREATION
• The minimum address space to
create a hub is /24
• No need to explicitly plan the
subnet address space for the
services in the virtual hub
• Azure Virtual WAN is a managed
service: it creates the appropriate
subnets in the virtual hub for the
different gateways / services

EXERCISE
CREATE A VIRTUAL WAN
• Task 1: Create a Virtual WAN
• Task 2: Create a hub
• Task 3: Connect a VNet to the
Virtual Hub

NVA IN VIRTUAL HUB
• Network Virtual Appliances
(NVAs) can be deployed within
an Azure Virtual WAN hub to
enhance security and
connectivity features
• NVAs act as 3rd party gateways,
providing functionalities like SD-
WAN, firewalls, or a combination
of both, and enabling traffic
inspection and control between
different network segments
• Deployed NVAs are provided as
a solution jointly managed by
Microsoft Azure and the 3rd party
NVA vendors
• Not all NVAs can be deployed
into a Virtual WAN hub (even if
listed in Azure Marketplace) but
only NVAs from trusted partners
• List of partners can be found in:
https://learn.microsoft.com/en-
us/azure/virtual-wan/about-nva-
hub#partners

NVA IN VIRTUAL HUB
DEPLOYMENT
• From inside the Virtual WAN hub, go to
Network Virtual Appliances tile and click
on Create link
• Select the NVA provider from the
available list, then click the Create button
• NVA Infrastructure Units indicates the
number of connections this NVA will use
of the hub bandwidth capacity
(aggregated across all the branch sites
that will be connecting to this hub
through this NVA)
• Token: some providers (such as
Barracuda) require an authentication
token to be provided to identify the Azure
admin as a registered user of the NVA
(tokens are obtained from the provider)

AZURE EXPRESSROUTE
NETWORK LAYER 3
• The Open Systems Interconnection Model
(OSI Model) is a conceptual model
created by ISO to enable diverse systems
communication using standard protocols
• It is the universal computer networking
concept that splits the communication
system into seven abstract layers, each
one stacked upon the last
• The Network layer (layer 3 of OSI Model)
provides the routing and switching
technologies that create logical paths
known as Virtual Circuits (VC), which are
used for the transmission of data between
network nodes
• The main functions of the Network layer
include routing and forwarding

AZURE EXPRESSROUTE
• Azure ExpressRoute provides layer
3 connectivity with high
redundancy across all regions
within a specific geography
• Admins utilize global connectivity
with ExpressRoute premium add-on
by enabling it across on-premises
connectivity and benefit from
ExpressRoute Global Reach
• Azure ExpressRoute provides:
• Bandwidth options from 50 Mbps
upto 100 Gbps
• Billing models: Unlimited or Metered

AZURE EXPRESSROUTE
• Predictable, reliable, and high-
throughput connections
• Up to 100 Gbps bandwidth - supports
dynamic scaling of bandwidth and
direct access to national clouds
• Built in redundant circuits
• Integrates with existing Multiprotocol
Label Switching (MPLS)
• Up to 99.95% availability SLA across
the entire connection.
• Working with a third-party
connectivity provider
• Requires high-bandwidth routers
on-premises
Benefits Challenges

AZURE EXPRESSROUTE
CONNECTIVITY MODELS

AZURE EXPRESSROUTE
DESIGN CONSIDERATIONS

AZURE EXPRESSROUTE
BFD
• Bidirectional Forwarding Detection
(BFD) is a network protocol
designed for rapid detection of
failures in the forwarding path
between two network devices
• BFD is configured by default on the
Microsoft Edge, so admins only
need to configure it on both
primary and secondary devices
• Once configured on the devices
interface, it can then be linked it to
the BGP session

AZURE EXPRESSROUTE
ENCRYPTION
• To enable encryption for Azure
ExpressRoute, the on-premise VPN
is utilized
• The admin establish ExpressRoute
connectivity with an ExpressRoute
circuit and private peering
• Then the VPN connectivity is
established over ExpressRoute
• Encrypted routing then occur
between the on-premises networks
and Azure across the ExpressRoute
and VPN paths

AZURE EXPRESSROUTE
COEXISTING S2S
• When Site-to-Site (S2S)
connectivity exist, the S2S VPN
should be used as a secure
failover path for ExpressRoute
• That way, the S2S VPNs are used
to connect to sites that are not
connected with ExpressRoute
• This is enabled by creating two
VNet Gateways for the same
virtual network

EXERCISE
IDENTIFY THE EXPRESS ROUTE COMPONENTS

AZURE EXPRESSROUTE
GLOBAL REACH
• Designed to complement the service provider’s WAN implementation and connect an
organization branch offices across the world
• Admins can link ExpressRoute circuits together to make a private network between their
organization on-premises networks

AZURE EXPRESSROUTE
FURTHER INFORMATION
• Simulation: https://mslabs.cloudguides.com/guides/AZ-
700%20Lab%20Simulation%20-
%20Configure%20an%20ExpressRoute%20gateway
• Simulation: https://mslabs.cloudguides.com/guides/AZ-
700%20Lab%20Simulation%20-
%20Provision%20an%20ExpressRoute%20circuit
• Reference: https://learn.microsoft.com/azure/expressroute/expressrou
te-howto-circuit-portal-resource-manager
• Reference: https://learn.microsoft.com/azure/expressroute/configure-
expressroute-private-peering

Microsoft Azure Hybrid NetWorking principles

More Related Content

Similar to Microsoft Azure Hybrid NetWorking principles

More from KamelAbouSaleh1

Recently uploaded

Microsoft Azure Hybrid NetWorking principles