TechNet Express: [AZURE 70-534 - Cheat Sheet and Exam Notes Part-1] Design Azure Resource Manager (ARM) networking and GLOBAL Infrastructure

Index

Series Index

Azure GLOBAL Infrastructure

AZURE Data Centers Architecture

In order to check latency of data center use http://azurespeedtest.azurewebsites.net/
No All the services are available in all regions and Data Centers use service availability page to verify the same. https://azure.microsoft.com/en-us/regions/services/
Azure uses Blade Server in data center either in compute or storage role
40-50 Blade server per Rack (mounting unit)
Each Rack has Aggregation Switch
Some Racks have a special controller called Fabric Controller responsible for VM Life cycle management
20 Racks together makes a Stamps or Cluster

Azure Availability Architecture

Some region need local billing address for service subscription such as Australia
Each rack works as fault domain
As a customer you need to also design for HA that means your workload must be distributed in availability Sets

Azure Resource Manager

With ASM even a VM has a cloud service.
ARM is pure IaaS, not necessarily cloud service.
Deploy, manage and monitor services as a group; deploy repeatedly throughout the application life cycle; use declarative templates to define deployment; can have dependencies between resources; apply RBAC; organise logically by tagging.
ASM tightly couples to cloud service – VM in subnet, in VNet, in cloud service, in region, with VIP for DNS and public IP.
Choose deployment mode when provisioning resources. Limited inter-operability so choose the right model.
Deploy using
- Portal
- PowerShell: Switch-AzureMode -Name AzureResourceManager
- ARM REST API
- Azure CLI: azure config mode arm
Resource Manager template – JSON document – deploys and provisions all of the related resources in a single, co-ordinated operation.
Tags are key-value pairs of metadata: applied to individual ARM resources or ARM RGs – up to 15 tags per Resource or RG
RBAC – Owner, Reader or Contributor.
ARM is more loosely coupled – can have multiple VIPs, NICs, etc. All in a RG (which can span regions). Attached via reference.

Azure Service Manager (ASM) vs Azure Resource Manger

Azure Service Manager (ASM )

This is an old portal which provides Cloud service for Iaas Workload and few specific Paas Workload
Access over the Url: https://manage.windowsazure.com
which termed as V1 portal
Azure Service Manager are XML driven REST API

Azure Resource Manager (ARM )

They are new portal provides service for all Workload of IaaS and PaaS
Access over the Url: https://portal.azure.com which termed as V2 portal having Blade design Portal View
Azure Service Manager are JSON driven REST API

Azure Static IP Address

IP Address in Azure (Private IP Address) Network are assigned sequentially based on startup order of VM
Public IP address are based on region and allocated from regional pool
Non Static IP Addresses may be reclaimed during service disruption
Internal Static IP address can only be assigned via New Portal or Power Shell
removal of static IP address automatically assign DHCP IP address but VM need to be restarted
Reserve IP Address can only be used with VM and web /worker role
IP address must be reserve before Deployment, it can`t be applied after deployment
IP address can only be reserved via Powershell
Reserve IP address are only applied to service not VM
Max 20 Reserve IP address per subscription
Each Reserve IP address has a name associated
There is special class of public IP address (Instance Public IP Address) that can be applied to instance VM or Role Instance
(Instance Public IP Address) is earlier known as (Public IP) or PIP
Max 5 IL-PIP per subscription
PIP is additional IP address that do not replace virtual IP address

Azure Access Control List ACLs

An endpoint access control list (ACL) is a security enhancement available for your Azure deployment. An ACL provides the ability to selectively permit or deny traffic for a virtual machine endpoint.

Azure ACL (AACL)or Network ACL (NACL) are same thing
It Only applied to inbound traffic
NACL work only IP4 addressing scheme
Up to 50 Rules per VM Endpoints
No NACL applied by default
All traffic denied by default
Each rule have unique order number (Assigned by you) and lower number is process first
ACL are managed by Powershell (only?)
All ACL config are stored in a ACL config Variables
ACL are applied to specific endpoint not whole subnet
If there is no ACL – all traffic is allowed (whatever endpoints are open will allow access);
if there is one or more permit, deny all others; if there is one or more deny, allow all others; Combination of permit and deny to define a specific IP range.
Network ACL affects Incoming traffic only.

Azure Network Security Groups (NSG)

A network security group (NSG) contains a list of security rules that allow or deny network traffic to resources connected to Azure Virtual Networks (VNet). NSGs can be associated to subnets, individual VMs (classic), or individual network interfaces (NIC) attached to VMs (Resource Manager)

NSG has both inbound and outbound rules. Key factor are Traffic Direction , Protocol , Source /Destination address and port
Traffic must match an allow rule to pass through
Each NSG has unique name, NSG rules can be altered and changes takes effect immediately
NSG can only be used in regional VMs i.e. they are regional
NACL and NSG can not be applied on same VM instance
Now NSG are recommended way over NACL that is actually old way of access control
NSG can be applied to whole subnet
Default Tags can be used at place of actual address (eg INTERNET)
Each NSG contains default rules that can not be deleted
NSGs can be assigned to a subnet or a NIC. It cannot be assigned to an entire virtual network, nor any other resource in Azure.
Network Security Groups (NSGs) are attached to a VM or a subnet and act on both inbound and outbound traffic.
- By default all inbound access is blocked inbound rules (allow inbound within VNet and from Azure LB; deny all other inbound – rules 65000/65001/65500).
- Outbound defaults allow outbound within VNet outbound, Internet outbound (0.0.0.0/0) and deny all others – rules 65000/65001/65500.
- Default rules can’t be edited but can be overridden with higher priority rules.
Can only use Network ACLs or NSGs – not both together.
VMs can have multiple NICs in different subnets – i.e. dual-homed machine.
The lowest priority level is evaluated first, and the first rule that matches is the one that applies.
Default NSG rule has lowest possible priority so that they can be easily overwritten

Default NSG all inbound/Ouboud connection is allowed within VNET
ALL inbound load balancer traffic is allowed by default
other than VNET and LOAD_BALANCER all inbound is denied.
All INTERNET outbound traffic is allowed by default
Other then VNET and INTERNET all other traffic is denied by default

NSG Association

Three Pobbible association

NSG to VM
NSG to NIC
NSG to Subnet

Only one NSG per VM/NIC/Subnet
Same NSG can be assigned to multiple resources
100 NSG per Region
200 Rule per NSG

Port 168.63.129.16 (By default allowed) must be allowed because it represent

Azure DHCP Relay ,
DNS Resolver,
Load Balancer ,
VM Health Probe

Outbound TCP/UDP 1688 must be open (By default allowed) because it KMS server to renew licencees
NSG is created via Powershell

Azure NSG vs ACL (NACL)

NSG	ACL
Control all inbound and outbound traffic to VM	Works only for inbound traffic exposed via an endpoint
Works on one or more VM instances	Works on Endpoint applied to VM
More Detailed You can specify Source / Destination IP/Port and protocol	Port and protocol are defined by end point

User-defined routes (UDR)

By default system routes facilitates traffic automatically for your deployment but there are cases in which you want to control the routing of packets through a virtual appliance.

here is some key notes

Most Common Use-cases

Monitoring traffic with an intrusion detection system (IDS)
Controlling traffic with a firewall

User-defined routes are applied to traffic leaving a subnet from any resource (such as network interfaces attached to VMs) in the subnet.
You cannot create routes to specify how traffic enters a subnet from the Internet, for instance.
The appliance you are forwarding traffic to cannot be in the same subnet where the traffic originates. Always create a separate subnet for your appliances.
User defined routes are only applied to Azure VMs and cloud services.

Azure VM (IAAS VM)

Virtual machines per cloud service1(ASM Model) 50/50 (Default /Max)
Input endpoints per cloud service2 (ASM Model) 150/150 (Default /Max)
Virtual machines per availability set 200
Maximum number of VMs in a scale set 1000/1000 (Default /Max)
Maximum number of VMs based on a custom VM image in a scale set 300/300 (Default /Max)
Maximum number of scale sets in a region 2000/2000 (Default /Max)
Subscription limits https://docs.microsoft.com/en-us/azure/azure-subscription-service-limits
Azure VM Tier

https://docs.microsoft.com/en-us/azure/virtual-machines/windows/sizes

Azure Availability Sets, Fault Domains, and Update Domains

Fault Domain -

Any single point of failure is called fault rack usually Rack.
Always places resource in separate fault domain
Microsoft automatically assigns Virtual Machines across 3 fault domains (physical servers) and 5 update domains to maximize up-time during planned and unplanned outages.

Update Domain

Collection of resources that can be updated at same time
Resources must be distributed across multiple update domain

Availability Set

configure two things Fault domain and Update Domain
VM in Availability set must of identical type
VM can be assigned to Availability Set at the time of creation or later
Moving VM to availability set after create will cause reboot.

Azure VPNs

Azure provide three mechanism four mechanism of connecting on-premise to cloud network Point to Site , Site to Site , Express Route , VNet-VNet
Virtual networks (VNets) are used to manage networking in Azure. Can only exist in one Azure region.
CIDR notation is used to describe networks and subnet.
All virtual machines (VMs) in a VNet can communicate (by default) but anything outside cannot talk (by default) – so VNet is default network boundary.
In ASM, every VM has an associated cloud service (with its own name @cloudapp.net). Without subnets the VMs can only communicate via a public IP. If multiple cloud services are on same VNet then VMs can communicate using private IP.
Endpoints are used to manage connections: internal (private) endpoint listening on a given port (e.g. for RDP on 3389); external (public) endpoint on defined port number – therefore go to a particular server, rather than just to the cloud service.
Dynamic IP (DIP) is the private IP associated with a VM; only resolvable inside the VNet – external access needs a public IP. Can chose an IP address to use – and will be reserved.
Virtual IP (VIP) – assigned to a cloud service – static public IP for as long as at least one VM running inside the cloud service.
Instance Level Public IP (ILPIP) – for direct connection to Azure VM from Internet (not via the cloud service); public IP attached to a VM. In this configuration, whatever ports open on the VM are open to the Internet – effectively bypassing the security of the VNet.
Point to Site VPN

PC to Azure connection , Required client install on every on-premise machine that want to access Azure
Azure address space must not overlap with on Premise address

Site to Site VPN

Suitable for large corporate
it can connect one Azure Subscription to Other
Can be use to Extent on premise network
Required On Premise router to be configured
Azure address space must not overlap with on Premise address
Site to Site is IPSec VPN

Use a VNet-to-VNet VPN to create a tunnel between VNets in different regions. This extends VNets to appear as if they were one.
Multi-site VPN is a combination of the other methods, combined.

Express Route

High bandwidth (up to 10 GBPS) Direct link in between on-premise to Azure Data Centers
Service may or may not be available locally
Two way to connect

Connect via Exchange Provider Data Center facility
Direct Connection using supported Network service provider

ExpressRoute Providers provide point-to-point Ethernet of connect via a cloud exchange. BGP sessions with edge routers on customer site. 200Mbps/500Mbps/1Gbps/10Gbps.
Can use for Azure computing (IaaS); Azure public services (web apps, etc. – PaaS) or Office 365 (SaaS).

Azure Load Balancing and Traffic Manager

Azure Load Balancer

works at the transport layer (Layer 4 in the OSI network reference stack). It provides network-level distribution of traffic across instances of an application running in the same Azure data center.
There are two types of load Balancers , Internal and Internet Facing
All load Balancers work at regional level not cross region.
Internet Facing Load Balancer

You need to create a load Balancer end point on first VM
All VMs must be in same cloud service
Health probe must be configured

Internal Load Balancers

Internal traffic only
VMs must be in same cloud service or virtual network with a regional scope
First step to create a Internal Load Balancer is to create Internal Load Balancing endpoint

Then add endpoint to internal VM to accept traffic
configure all Front end server to send traffic to 'Internal Load Balancing endpoint"

Only Powershell can be used for creating and configuring Internal Load Balancers.

Azure Application Gateway

works at the application layer (Layer 7 in the OSI network reference stack). It acts as a reverse-proxy service, terminating the client connection and forwarding requests to back-end endpoints.

Azure Traffic manager

works at the DNS level. It uses DNS responses to direct end-user traffic to globally distributed endpoints. Clients then connect to those endpoints directly.
Thinks this as highest level of load Balancers work cross region
Support any IP endpoint
Controls distribution of user traffic across multiple enpoint including cloud services , external sites etc.
It work by modifying DNS settings
Uses Four load balancing (Routing) methods

Priority: Select Priority when you want to use a primary service endpoint for all traffic, and provide backups in case the primary or the backup endpoints are unavailable.
Weighted: Select Weighted when you want to distribute traffic across a set of endpoints, either evenly or according to weights, which you define.
Performance: Select Performance when you have endpoints in different geographic locations and you want end users to use the "closest" endpoint in terms of the lowest network latency.
Geographic: Select Geographic so that users are directed to specific endpoints (Azure, External, or Nested) based on which geographic location their DNS query originates from. This empowers Traffic Manager customers to enable scenarios where knowing a user’s geographic region and routing them based on that is important. Examples include complying with data sovereignty mandates, localization of content & user experience and measuring traffic from different regions.