Category Archives: Azure

#Azure : Data transfer


Cloud has become a prominent option for all kind of organizations. When any medium to large organization moves to the cloud, data transfer becomes a biggest challenge. To address this concern, Microsoft provides different types of data transfer options to the customers. Before you get into the details of data transfer options, answer the following questions:

  • How much data, we need to migrate?
  • What is going to be the frequency of data transfer?
  • Data source and destination locations, and respective data regulations?
  • Find the bottlenecks that may arise at the time of migration?
  • Do the cost, time and effort comparison between possible data migration types?

If you look from the Microsoft point of view, they have divided the data transfer into four major categories:

  • Physical data transfer
  • Data transfer using command line tools and APIs
  • Data transfer using graphical user interface
  • Data pipeline

Let me explain you briefly about each one of the data transfer methodology:

Physical data transfer: Widely used when you have large data sets to migrate. It could be leveraged for either one-time data migration activity or for less frequent data migration activity. For physical data transfer you can choose one data methodology based on the size.

  • Azure Import/Export: The Azure Import/Export can be used to transfer large amount of data using internal SATA HDDs or SSDs. By using this service, you can securely transfer data from on-premises to the cloud blob or file storage and vice-versa. When procuring drives for this service, don’t get confuse between SATA and SAS drives. Order SATA III drives as it is faster than older version of SATA drives and support speed of 6 Gbps.
  • Azure Data Box: Azure Data Box is an option to transfer very large amount of data, it is very similar to Azure Import/Export but avoids the hurdles of procuring, writing and sending multiple data disks. In this service, Microsoft provides you secure and reliable appliance to transfer data between on-premises and cloud blob and file storage. It is much easier than Azure Import/Export service as Microsoft takes the responsibility of end-to-end logistics.

Data transfer using command line tools and APIs: used when you have enough bandwidth available to migrate limited amount of data between on-premises and cloud blob and file storage. There are multiple tools available to perform this activity.

  • AzCopy: It is command line to tool to transfer data to and from Azure blob, file and table storage in fast, secure and reliable manner. You can install this tool on Windows or Linux machine to transfer data. It supports parallelism and the ability to resume copy operation when interrupted.
  • Azure CLI: It is a command line tool to manage Azure services and to upload data to Azure storage. Azure CLI doesn’t need any installation and configuration as it is available through Azure portal itself.
  • PowerShell: PowerShell is an alternative option for windows administrators to transfer data.

Data transfer using graphical user interface: is a most simpler way of transferring data between cloud on-premises. You have two options available to transfer data using graphical tools.

  • Azure Portal: Simplest way of exploring and uploading files to the Azure blob storage and data lake store but it has a limitation of exploring and uploading only file at a time.
  • Azure Storage Explorer: Azure storage explorer is a great option for GUI lovers, it provides a capability to manage, upload and download files through interactive interface for blobs, files, queues, tables and Azure Cosmos DBs objects. It also allows to manage data between blob storage, and between storage accounts.

Data Pipeline: used when you need to transfer data regularly.

  • Azure Data Factory: It is an option to transfer and transform data using data-driven workflows (a.k.a data pipeline) on a regular basis by leveraging orchestration or automation processes. It is a managed service to transfer data between Azure services, on-premises, or a combination of the two. The workflow can be created and scheduled based on your requirements. It can process and transform the data by leveraging compute services such as Azure HDInsight Hadoop, Spark, Azure Data Lake Analytics, and Azure Machine Learning.

Apart from the above core data transfer options, following are the list of tools that can be leveraged to transfer data within specific Azure services.

Advertisements

#Azure : Map your datacenter to the cloud


Cloud has become a disruption in the information technology landscape and many times it looks like buzz word or an operating model. If you look only at the IAAS space, you realize that it is very similar to your datacenter with multiple wrappers around it such as automation, management, cost (pay as you go) etc. If you are an experience professional and have worked in traditional environment, looking an option to start with cloud then my suggestion to you would be to start with IAAS. IAAS is always good to start a journey in the cloud if you are an experienced professional.

This is how your datacenter looks like in Microsoft Azure IAAS from 10,000 ft.

When you are going to start with the cloud, make sure you have three thumb rules in your mind. The examples given under these thumb rules might not relevant to you but you can find your use cases to define these thumb rules.

  • Know your boundaries very well: When you look at the cloud, it looks like an ocean. How can you get something useful out of it? Look at your business requirements and see which area of cloud is relevant for you. Start with chalking down services that are relevant for your business and can deliver value. For example, your organization has strategy to use IAAS with Azure native services. Native services mean here that you are going to use Azure default offering, not the vendor offering. One good example could be here load balancer, Azure provide native load balancer with specific set of features but there are many load balancer vendors also provide their product offerings through cloud.
  • Understand the big picture: Knowing the big picture of anything help you to define the long-term strategy. For example, one of your custom application has no future roadmap after next 2 years and it might be replaced by any SaaS offering. If you are not aware of it and move this application to Azure PaaS and invest heavily on time and effort to migrate this application, in this situation it is not worth. You might have chosen Azure IaaS instead of SaaS because Azure IaaS doesn’t require any changes at application level as it is like your on-premises environment.
  • Understand the bottlenecks: Knowing the bottleneck of anything you do, is quite important in cloud era. As cloud leverage agile methodology, therefore changes in cloud environment is obvious on daily basis. May be the services you are looking for, not available right now but you may see that in future. Therefore, to know about the services available at present, the future road map of upcoming services, and the services that are in preview helps you to set your long-term strategy and make you aware about the current and future bottlenecks. For example, at present Azure doesn’t support ACL’s. Therefore, you can’t plan to migrate your file server data to Azure file storage if you want use ACL’s.

Once you know three thumb rules, start sketching your architecture using cloud components. To know more about datacenter big rocks and its mapping, look at the following blogposts:

Map your traditional datacenter compute with cloud VMs

Virtual Machines

Virtual Machine Configuration

Virtual Machines High Availability

Step-by-step Availability Sets

Virtual Machines Scale Sets

Large Virtual Machines Scale Sets

Map your traditional datacenter storage with cloud storage

Storage Accounts

Storage services

Storage replication

Step-by-step Microsoft Azure Storage

Storage Explorer

Map your traditional datacenter network with cloud network

Virtual Networks

Network Peering

VNet-to-VNet Connectivity

Load Balancer

Application Gateway

Traffic Manager

Network Security Group

All about Azure Active Directory

Once you will understand these datacenter big rocks and its details, you will realize that you know cloud IaaS inside out and you know some level of PaaS as well. As SaaS is totally different story and very specific to applications, therefore I am not considering SaaS here.

#Azure : Map your traditional datacenter network with cloud network


Like compute and storage, networking is also an essential part of the cloud. Networking is very broad topic and many network security components also come under this. In cloud, Networking components have been distributed into multiple small components and architecture has become distributed architecture. However, this distributed architecture methodology exists across cloud landscape.

I always suggest having an architecture start from Networking because your network define your boundaries. However, people can have debate that with cloud we are open and we can’t define boundaries. I totally agree with you as you are thinking from end-user’s perspective. In my view, if you can’t define the boundaries then you can’t have appropriate security in place. If you are working with multiple SaaS/PaaS/IaaS vendor, that’s fine but define them in your enterprise architecture so that what, how, where and when, you are sending your data is captured. This debate can’t happen through blogpost, therefore let me explain you key networking components in Azure and their mapping with on-premises networking stuffs.

Once you try to map the networking components of your on-premises with cloud, you observer that most of the things are available but it has slightly different name or functionality.

LAN ßà Virtual Networks

VLAN ßàAddress Space and Subnet

Lag between switches ßà VNet Peering / VNet-to-VNet connectivity

WAN ßà Global VNet Peering / VNet-to-VNet connectivity

MPLS ßà Express Route

L4 load balancer ßà Load balancer

L7 load balancer ßà Application Gateway

Geo-DNS/Global load balancer ßà Traffic Manager

Firewall ßà Network security group / Network virtual appliance

To know about major component and its functionality, read the following blogposts:

Virtual Networks

Network Peering

VNet-to-VNet Connectivity

Load Balancer

Application Gateway

Traffic Manager

Network Security Group

Once you know the boundaries, big picture and bottlenecks, and understand the Azure capabilities as well then you will design a best possible solution.

#Azure : Network Security Group


Network Security Groups provide advanced security protection for the VMs that you create. They control inbound and outbound traffic passing through a Network Interface Card (NIC) (Resource Manage deployment model), a VM (classic deployment), or a subnet (both deployment models).

NSGs contain rules that specify whether the traffic is approved or denied. Each rule is based on a source IP address, a source port, a destination IP address, and a destination port. Based on whether the traffic matches this combination, it either is allowed or denied. Each rule consists of the following properties:

  • Name. This is a unique identifier for the rule.
  • Direction. Direction specifies whether the traffic is inbound or outbound.
  • Priority. If multiple rules match the traffic, rules with higher priority apply.
  • Access. Access specifies whether the traffic is allowed or denied.
  • Source IP address prefix. This identifies from where traffic originates. This prefix can be based on a single IP address, a range of IP addresses in CIDR notation, or the asterisk (*) wildcard character, that must match all possible IP addresses.
  • Source port range. This specifies source ports by using either a single port number from 1-65535, a range of ports (200-400), or the asterisk (*) wildcard character that denotes all possible ports.
  • Destination IP address prefix. This identifies the traffic destination based on a single IP address, a range of IP addresses in CIDR notation, or the asterisk (*) wildcard character, that must match all possible IP addresses.
  • Destination port range. This specifies destination ports by using either a single port number from 1-65535, a range of ports (200-400), or the asterisk (*) wildcard character, that denotes all possible ports.
  • Protocol. Protocol specifies a protocol that matches the rule. It can be UDP, TCP, or the asterisk (*) wildcard character *.

Network security groups are resources that are created in a resource group, but can be shared with other resource groups that exist in your subscription.

Some important things to keep in mind while implementing network security groups include:

  • By default, you can create 100 NSGs per region per subscription. You can raise this limit to 400 by contacting Azure support.
  • You can apply only one NSG to a VM, subnet, or NIC.
  • By default, you can have up to 200 rules in a single NSG. You can raise this limit to 500 by contacting Azure support.
  • You can apply an NSG to multiple resources.

Let me show, how to create and configure network security groups step-by-step.

Login to the Azure Portal and select “+ Create a resource”. Select the “Networking” and then select “Network security group”.

Specify the name of the NSG, select the subscription, select the right resource group from “Use existing” or create a new one, and finally define the location if you are creating a new resource group but if you are using existing resource then location will be selected by default according to the resource group location. Once done, click on “Create” to create a network security group.

Once network security group is created, you look at the default configuration and change the configuration based on your need.

These are the default inbound and outbound security rules.

Click on “Add” to create a new inbound security rule under “Inbound security rules”.

In Inbound security rule, you define following things:

Source:

  • Any: If you select “Any” then it accepts all inbound requests from any source, doesn’t care about the source network or endpoint.
  • IP Addresses: You can define specific IP Address ranges.
  • Service Tag: You can specify the service tags. For example, if you select storage then it allows all the storage categories of IP addresses.

Source port ranges: Specify the multiple ports separating with “‘,” (comma) such as 80, 443 or a series of ports such as 50000-50100.

Destination:

  • Any: If you select “Any” then it accepts all inbound requests for any destination, doesn’t care about the destination network.
  • IP Address: You can define specific IP Address ranges.
  • VirtualNetwork: Any virtual network as a destination network.

Destination port ranges: Specify the multiple ports separating with “‘,” (comma) such as 80, 443 or a series of ports such as 50000-50100.

Protocol: You can select protocols, Any, TCP or UDP.

Action: Allow or Deny.

Priority: Priority can be set between 100 and 4096. Least priority will have highest preference.

Name: Set the name of the NSG rule.

Description: Write description for the NSG rule that best describes the respective rule.

Click on “Add” to create a new outbound security rule under “Outbound security rules”.

In Outbound security rule, you define following things:

Source:

  • Any: If you select “Any” then it accepts all outbound requests for any destination, doesn’t care about the source network.
  • IP Address: You can define specific IP Address ranges.
  • VirtualNetwork: Any virtual network as a source network.

Source port ranges: Specify the multiple ports separating with “‘,” (comma) such as 80, 443 or a series of ports such as 50000-50100.

Destination:

  • Any: If you select “Any” then it accepts all inbound requests from any source, doesn’t care about the destination network or endpoint.
  • IP Addresses: You can define specific IP Address ranges.
  • Service Tag: You can specify the service tags. For example, if you select storage then it allows all the storage categories of IP addresses.

Destination port ranges: Specify the multiple ports separating with “‘,” (comma) such as 80, 443 or a series of ports such as 50000-50100.

Protocol: You can select protocols, Any, TCP or UDP.

Action: Allow or Deny.

Priority: Priority can be set between 100 and 4096. Least priority will have highest preference.

Name: Set the name of the NSG rule.

Description: Write description for the NSG rule that best describes the respective rule.

You can associate any specific network interface with network security group under “Network interfaces”. Select “+ Associate” to attach network interface with NSG.

Select a specific network interface that needs to be linked with NSG.

You can associate any specific virtual network subnet with network security group under “Subnets”. Select “+ Associate” to attach virtual network subnet with NSG.

Select a specific virtual network subnet that needs to be linked with NSG.

In the properties section, you can look at the resource properties.

Under the locks section, you can create and configure the lock type to prevent changes and protecting the azure resources.

Under the “Automation script” download the script or add to library for reuse.

Under the diagnostic log, you can enable diagnostic for NSG to collect “NetworkSecurityGroupEvent” and “NetworkSecurityGroupRuleCounter” data.

I hope, this article helped you to understand, create, configure and manage Network Security Groups.

#Azure : Traffic Manager


Azure traffic manager is nothing but it is your global DNS load balancer that help you to manage the traffic across multiple datacenter and regions. Traffic manager uses the DNS to direct client requests to the multiple endpoints in most appropriate way. With the help of traffic manager, clients connect directly to the endpoints. Traffic manager can also be leveraged for external, non-Azure endpoints.

Let me show, how to create and configure traffic manager step-by-step.

Login to the Azure Portal and select “+ Create a resource”. Select the “Networking” and then select “Traffic Manager”.

Here you define the name of the traffic manager, routing method, subscription, resource group and location.

Name: you should use unique prefix for your traffic manager profile. For Example, if I use ex-tm as a prefix for my traffic manger profile that will be associated with my global Exchange deployment then complete name of this traffic manager profile would be ex-tm.trafficmanager.net. Make sure this name can’t be changed once created.

Define the routing method that you wish to use for your traffic manager profile. However, you can change your routing method from configuration panel as well.

Once defined all the necessary details, click on “Create” to setup a traffic manager profile.

Once traffic manager profile created, you can see the basic configuration from overview panel.

Go to the Configuration panel under settings to configure your traffic manager profile.

Routing Method: Select routing method based on your need. Azure traffic manager profile provides four different types of routing methodologies.

Priority: Use this routing method when you want to route all the traffic to a primary service endpoint, and based on the configuration, traffic can be routed to backup service endpoints if primary service endpoint fails. In simple words, it is kind of active passive routing methodology.

Weighted: Weighted routing methodology can be leveraged when you want to distribute traffic based on the weight assigned to the specific set of endpoints or multiple set of endpoints based on the weight.

Performance: Performance routing methodology is beneficial when you want to distribute traffic according to performance. Here performance criteria is network latency, therefore the traffic will be redirected based on the lowest network latency. It could be the closest location and in some it will not be the closest location as well.

Geographic: Geographic routing as name suggests, it is based on the location from where the DNS query originates. It helps in redirecting requests to the based on the geographic region to improve user experience, to comply with data regulations etc.

DNS time to live (TTL): As it is based on DNS query, therefore you need to define a response time of the query. By default, it is set to 300 sec.

Endpoint monitor settings:

  • Protocol: Select protocol for endpoint probing to check the health of the service endpoints. You get three protocol, HTTP, HTTPS, and TCP. In case of HTTPS, probe only check the availability of certificate but doesn’t check the validity of certificate.
  • Port: Select the port number based on protocol.
  • Path: Define the path setting for HTTP and HTTPS protocol. Use relative path and name of the webpage name for TCP, forward slash (/) is a valid entry for the relative path.

Fast endpoint failover settings:

  • Probing interval: Enter the interval time for probing to check the health of the service endpoint. You can choose between 10 seconds for fast probing and 30 seconds for normal probing.
  • Tolerated number of failures: you can the define number of probing failures between 0 to 9.
  • Probe timeout: Probe timeout should be minimum 5 seconds and maximum should be less than the probing interval.

Generate key from Real user measurements panel under settings. Any measurement, you send and receive any traffic from an application to traffic manager is identified by the RUM Key. To know more about it in detail and how to embed it within the application, click here.

From the Traffic view panel under settings, you can enable the traffic view to view location, volume and latency information for the connections between your users and Traffic Manager endpoints.

From Endpoints panel under settings, add all your service endpoints.

Azure traffic manager supports three types of endpoints.

  • Azure endpoints: Use this type of endpoint to load-balance the traffic of Azure cloud services.
  • External endpoints: Use this type of endpoints if you want to load-balance external services, which are outside the Azure environment.
  • Nested endpoints: Nested endpoints are little advance level configuration in which child traffic manager profile check the health probes and propagate the results to parent traffic manager profile to decide the service endpoints.

Based on the endpoint type selection, fill rest of the required details and then add the endpoints.

In the properties section, you can look at the traffic manager profile properties.

Under the locks section, you can create and configure the lock type to prevent changes and protecting the azure traffic manager profile.

Under the “Automation script” download the script or add to library for reuse.

In the metrics panel, you can monitor the metrics of traffic manager profile by two different parameters:

  • Endpoint Status by Endpoint
  • Queries by Endpoint Returned

I hope, this article helped you to understand, create, configure and manage Azure traffic manager.

#Azure : Application Gateway


Like your layer 7 load balancer in your traditional datacenter, Azure application gateway takes care of your HTTP/HTTPS based requests. It works at application layer (level 7 of OSI model) and works as a reverse-proxy as well. In application gateway, client connections are terminated at gateway and then forwarded to application.

Let me show, how to create and configure application gateway step-by-step.

Login to the Azure Portal and select “+ Create a resource”. Select the “Networking” and then select “Application Gateway”.

In the basic configuration settings:

Enter the name of the application gateway. Always use a name for any components in Azure that fit for purpose and easy to distinguish.

Select the application gateway tier:

  • Standard: As any other layer 7 load balancer, it provides HTTP(S) load balancing, cookie-based session affinity, secure sockets layer (SSL) offload, end-to-end SSL, URL based content routing, multi-site routing, websocket support, health monitoring, SSL policy and ciphers, request redirect, and multi-tenant back-end support etc.
  • WAF: WAF is an advanced version of standard application gateway with application firewall capabilities that supports all standard AG features along with protection of web applications from common web vulnerabilities and exploits. Application gateway WAF comes pre-configured with OWASP (online web application security project) modsecurity core rule set (3.0 or 2.29) that provides baseline security against many of these vulnerabilities. It provides protection against SQL injection, cross site scripting, command injection, HTTP request smuggling, HTTP response splitting, remote file inclusion attack, HTTP protocol violations and anomalies, bots, crawlers, scanners, application misconfiguration and HTTP Denial of Service etc.

Select SKU size based on your requirement. AG sku comes in small, medium and large size.

Select instance count based on your need. The default instant count is 2.

Select subscription, resource group and location.

Once completed all basic configuration settings, click on OK.

In settings panel, complete following application gateway specific configuration settings:

Select virtual network and subnet that is going to associate with this application gateway.

Complete frontend IP configuration based on your application gateway requirements.

Set idle timeout settings and set the DNS name label.

Select the listener configuration protocol and associated port number.

Once completed with the configuration details, click on OK.

If you select HTTPS in listener configuration, upload PFX certificate file and provide credentials. Once completed with the configuration, click on OK.

Review the summary of the configuration and click on OK to create application gateway.

In the overview section, review the basic configuration.

In configuration panel under settings, you can change the application gateway tier, SKU size and instant count based on your requirements.

In Web application firewall panel under settings, you can upgrade to WAF tier if using standard tier and can also “enable/disable” firewall, configure firewall mode “detection/prevention”, configure rule set with OWASP and advanced configuration for your application gateway.

In Backend pools panel under settings, add and configure backend pools for application gateway. Click on add or existing backend pool to define the backend pool settings.

Click on “+ Add target” to define targets either using “IP address or FQDN” or “Virtual machine”. Click on rules to configure redirection if required.

In HTTP settings under settings, add or edit backend HTTP(S) settings such as cookie based affinity, request timeout, protocol and port etc.

In frontend IP configurations panel under settings, review IP configurations, type, status and associated listeners.

In listeners panel under settings, add basic and multi-site listeners.

In rules panel under settings, define basic and path-based rules based on your requirements.

In health probes panel under settings, you can add and edit health probes.

Once you add health probe, you define following parameters:

Name of the health probe.

Protocol either HTTP or HTTPS.

Enter the host name, path, interval in seconds, timeout in seconds and number of unhealthy thresholds.

In the properties section, you can look at the application gateway properties.

Under the locks section, you can create and configure the lock type to prevent changes and protecting the application gateway profile.

Under the “Automation script” download the script or add to library for reuse.

In the metrics panel, you can monitor the metrics of the application gateway by following parameters:

  • Current Connections
  • Failed Requests
  • Healthy Host Count
  • Response Status
  • Throughput
  • Total Requests
  • Unhealthy Host Count

In alert rules panel under settings, you can define conditional rules.

In diagnostics logs panel under settings, you can view the logs of the resources.

In backend health under settings, you can review the status of the backend pool.

I hope, this article helped you to understand, create, configure and manage Azure application gateways.

#Azure : Load Balancer


Like your traditional datacenter load balancer, Azure load balancer provides an ability to scale your application and create high availability for your services. Azure load balancer is layer 4 device and understands TCP and UDP packets. There are two types of azure load balancers are available:

  • Internal Load Balancer
  • Public Load Balancer

Let me show, how to create and configure load balancer step-by-step.

Login to the Azure Portal and select “+ Create a resource”. Select the “Networking” and then select “Load Balancer”.

Enter the name of the load balancer and set the load balancer type to either Internal or Public based on your business requirements.

If you select “Basic” sku for public load balancer then define public ip address, subscription, resource group, and location.

Standard SKU supports many advance features than the basic sku. If you want to know more about the difference between basic and standard sku, read Why use Standard Load Balancer?

If you create an internal load balancer with standard sku, you get an option to select virtual network and subnet.

Azure load balancer with standard sku provides an option to select availability zone.

If you select Internal Azure Load Balancer with SKU, you get two options for IP address assignment i.e. Static and Dynamic.

If you select static ip address assignment then you assign private ip address manually.

In my configuration, I am creating Internal Azure Load Balancer with Basic SKU.

I am using private configuration for my internal load balancer. Once completed the configuration, click on “Create” to deploy load balancer.

Once completed, you can review the basic configuration from overview panel.

In Frontend IP configuration under settings, you can review and add the LoadBalancerFrontEnd Ip addresses.

In Backend pools under settings, you can define add virtual machines that needs to be managed by the load balancer. Click on Add to configure backend pool.

Set the name and associate the backend pool with different types of virtual machines configurations, and click on OK.

In Health probes panel under settings, you get an option to add probes to check the health of your service endpoints. Click on “Add” to configure the health probes.

Configure the Name, Protocol, Port, Interval and Unhealthy threshold options based on your requirements.

In the Load balancing rules panel under settings, click on “Add” to create the load balancing rules.

Define the load balancing rules based on your requirement.

Once completed with the configuration, click on OK to create a rule with defined parameters.

You can also define Inbound NAT rules, click on “Add” to create NAT rules.

Define inbound NAT rules based on your requirement and click on “OK” to create.

In the properties section, you can look at the load balancer properties.

Under the locks section, you can create and configure the lock type to prevent changes and protecting the azure load balancer.

I hope, this article helped you to understand, create, configure and manage Azure load balancers.