Implement Azure Infrastructure

23. Peering Walkthrough

Let's have a walkthrough of actually setting up peering. For this demonstration, we're actually going to do global peering. When we first went through the earlier lectures where we set our machines up, we set our network, our virtual networks, subnets, and virtual machines all in the same location, UK South. And here we have my Windows server that I built, which is winning in the UK South. It's on the Windows network, and it's got an IP address of 10 10 4. In order to simulate global peering, what I've actually done is moved my Linux VM into UK West, a completely different region.

There are different ways we can do this, but I've simply destroyed the virtual machine and the virtual network and recreated them in the UK West location. However, the important point is that we're in a different location, UK West. Our IP address is 100 zero four, which means they are on completely different subnets, and they're also in completely different networks. So this is the next Linux version. Again, as per one of the earlier lectures, I installed Apache on this, and using the public IP address, I confirmed that I could access the web page. So that is just to prove that Apache is running. It proves that our network secured groups are correct to allow all the traffic through. In fact, I've got port ATM four, four, and three allowed from anywhere into it. So now I'm going to log on directly to my Windows server, which is on this network. And just to confirm, we can see the IP address is 101, dot 4.

However, when I try to browse to the Apache server on the Apache website, on the Linux server, which is on 10.4., which is the internal address, I can't actually reach that page. And the reason is because there is currently no connection between the Linux VNet and the Windows VNet. So let's go ahead and create that connection. Now I'm going to go into my virtual networks, I'm going to select my Linux network, and I'm going to go down to peerings. We currently have none. So let's go ahead and click Add and put some basic details in. We'll give this a name: simply Linux to Windows. We selected the subscription, and now we selected the virtual network we wanted to connect to, which in this case was our Windows VNet in the UK South region.

This is going to create a corresponding pairing on the other side. So we will call this one Windows to Linux. I'm going to leave all the other defaults alone and click OK. So once that finishes, it creates our peerings. If we go and look at the other Windows virtual network and go to pairings, we can see there's a corresponding connection back to the Linux VNet. So with that in place, let's go ahead and see if we can now route through. So all I'm going to do is go back to my web page at the same address, which is the IP address of the Linux server. and we'll refresh. And now we have the Linux Ubuntu Paging to prove that the pairing has been successful.

24. Routing Overview

It's important to understand network routing when using Azure. Azure uses system routes to direct traffic between virtual machines on premise networks and the Internet. The following situations are managed by these inbuilt system routes: traffic between virtual machines on the same subnet; between virtual machines in different subnets within the same virtual network; communication between virtual machines using VNet to VNet, VPNs, and Side-by-Side; and express route communication through VPN gateways. For example, consider this network with two subnets. Communication between the subnets and from the frontend to the Internet is all managed by Azure using the default system routes. Information about the route is recorded in a route table. A root table contains a set of rules (called routes) that specifies how packets should be routed in a virtual network. Route tables are associated with subnets, and each packet leaving a subnet is handled based on the associated route table. Packets are matched by route using the destination.

The destination could be an IP address, a virtual network gateway, a virtual appliance, or the Internet. If a matching route can't be found, then the packet is simply dropped. So although Azure automatically handles all network traffic routing by default, there are times when you might want something different. A typical example might be when you have virtual machines that perform a network function such as routing, firewalling, or one optimization. You may want certain traffic from one subnet to be directed to this virtual appliance. For example, you might place an appliance between subnets or a subnet and the Internet, as in this case. In these situations, you can configure and use defined routes. User-defined routes control network traffic by defining routes that specify the next hop in the traffic flow. Each route table can be associated with multiple subnets, but a subnet can only be associated with a single route table. There is no additional charge for creating route tables in macro Azure. Let's have a look at a specific example where we might have a virtual network that includes three subnets: a private subnet, a DMZ, and a public subnet. In the DMZ subnet, there is a network virtual plane.

We want to ensure that all traffic from the public Internet goes through the virtual pipes to the private subnet. In order to implement this scenario, we would do this by creating a route table. Then we will create a route, and then finally, we will associate that route with the subnet. We'll walk through the example in a minute, but before we do, it's important to understand something about routing algorithms. In the preceding example, the routing was fairly straightforward. But what if a destination address matches two routes in a routing table? Azure actually sorts this out in two ways. One of them is called the longest prefix match, and the other is root priorities.

So let's take an example. If we had an address that was 100 five, there were two routes: one that specified a 24 address prefix and another that specified a 16 address prefix. Azure would select the route using the longest prefix match algorithm. In this case, the longest match is 24. Therefore, it would use the next top-type Internet as the next top type. This is where the dress prefixes might actually be the same. In this case, it selects the rank type based on the following priorities: first, BGP routes, then system routes. So for example, again with the address 100 Fiveazure would select the route with the user source. Because defined routes are higher priorities than the system's default ones, Okay, let's have a walkthrough and see how we actually go about creating our own, custom-defined routes.

25. Routing Walkthrough

Okay, let's have a look at how we actually create roots and assign them to root tables. First of all, we want to create a new resource because root tables are objects all on their own. So we'll click Create, then we'll type Route, and we want the route table. Click Create. So first of all, we need to give it a name and give it a resource group. I haven't created one yet for it. So we'll click "Create New." I'll call this an RSG user defined route. Finally, we tell you the location where we want the route table to exist. The final option is this virtual network gateway route for propagation. So this is a standard routing protocol commonly used on the internet to exchange routing and reachability information between two or more networks. Routes are automatically added to the route table along with all subnets. With BGP propagation enabled in many situations, this is what we want, hence why it is enabled by default. If you're happy with all the options, click Create. Once we've clicked Create the route table, open it up, and the first thing we want to do is go ahead and add a root of our own. So click Root and go to Add, give the root name, and give a root prefix.

So let's go for ten at 100:24. We'll tell you the next hop is a virtual appliance, and then we'll give it the IP address of a virtual appliance. The address we're going to put in doesn't actually exist, but that's fine. We'll simply click OK. Once that's been added, we now associate that route with a subnet. So go to our network table. So for example, we will go to our Windows VNet, go to the subnets, and select one of our subnets. Once we're here, we can then go into the route tables and select our new route table and click Save. Any traffic that goes to an address on the ten-dot knot dot network will instead be routed to ten-dot two dot four instead of the default. And it's that simple, so we continue. I would actually advise deleting this subnet because we will not be using it going forward, as that was just an example of how we set up route tables. We don't actually want to use it. Set the route table to none and save again, and then if you wish; however, it's not required. You could then go back into your route table itself and delete it.

26. Service Endpoints

Another advanced networking feature that we can look at is something called service endpoints. Now, we did briefly cover service endpoints when we were looking at storage. Let's go and look at it again in a little bit more detail. A Virtual Network Service Endpoint provides the identity of your Virtual Network to the Azure service.

Once service endpoints are enabled on your virtual network, you can secure Azure service resources for your virtual network by adding a virtual network rule to the resources assured. Service traffic from a virtual network uses public IP addresses as source IP addresses. So if you wanted to connect to a storage system by default, you would connect to its public IP address. That would even be true if you were trying to connect to it from a virtual machine inside a virtual network. With Service Endpoint, service traffic switches to using the Virtual Network's private addresses as the source IP addresses. When accessing the Azure service from within a virtual network, this switch allows you to access the service without the need for the reserved public IP address used in IP firewalls.

In the diagram, we can see what this basically means: rather than our virtual machine going over and accessing the Azure service via the public internet, use this service endpoint to talk to it internally. It also allows us to then further block all Internet traffic completely. The main benefit of using service endpoints is improved security VNet private address spaces can be overlaid, so they cannot be used to uniquely identify traffic originating from your VNet. Service endpoints provide the ability to secure Azure service resources for your virtual network by extending the VNet identity to the service. Once endpoints are enabled on your virtual network, you can secure these service resources to your virtual network by adding a virtual network rule to those resources.

Service endpoints also provide optimal routing for Azure services. Any routes in your virtual network that force Internet traffic to your premises and/or virtual appliances, known as "force tunneling," also force Azure service traffic to take the same route as Internet traffic. Because of this, endpoints always ensure that traffic goes directly off the Azure backbone. Service endpoints are actually very simple to setup, and we'll go through an example shortly.

It's important to understand, however, that even though this provides you an internal route for virtual machines on your VNETs and subnets within Azure, it does not give you that same route if you were coming over an express route from your on-premises network. In order for that to work, you need to use private IP addressing. Service endpoints can only be used on very specific resources. We can add them to Azure Storage, which is generally available in all Azure regions. We can add them to Azure SQL Databases, which include Azure SQL Data Warehouse. We can use Azure databases for PostgreSQL and MySQL. We can use them for Azure Cosmos DB Azure Key Vault, Azure Service Bus, and Event Host also support Azure Data Lakes or Gen 1. However, generally, the recommendation is often to use GenTwo, which is covered by the General Azure Storage.

27. Service Endpoints Walkthrough

Let's have a walkthrough of setting up a service endpoint on a storage account and what it gives us. So if we go to the storage account that we created earlier, if you remember, we created a container, and in that container we had an upload folder, and then we uploaded a file. For this test, I've changed the Access lab level to Blob, anonymous Access. That's just so that we don't need to worry about providing access tokens and so on. With the excess level changed to "blob," we can go in and get the URL for the actual item. And now what I'm going to do is start up the virtual machine, so this is a remote desktop session on our virtual machine. Through a browser window, we can then access the image. So in a normal scenario, what we might want to do is lock down the storage account so that you can only access it from our internal virtual networks. What we also want to do is force the traffic to go over the Azure backbone rather than the public internet.

And for that, we use the service endpoints. So if we go to firewalls and virtual networks within our storage account and we're going to tell it to only allow access from selected networks, and I'm going to say "add an existing virtual network," I want my VNet Windows and, in particular, the ethnic Windows One virtual subnet. Now, the reason why we want that is because on our virtual machine, which is running on the Venus Windows subnet Windows One), it says this service endpoint status is not enabled. So the first thing we need to do is go ahead and click "Enable." So what that's going to do is enable service endpoints for that virtual network, and then once that's finished adding, we can go ahead and click Add to add the virtual network to the list of allowed virtual networks. If you had an IP range from the earlier session, just go ahead and delete that, and once we've got it set up, we won't go ahead and click Save. So what you should find now is that from your own computer that's going over the public Internet, when you try to access that image, you'll get an authorization failure. If, however, we go inside our VM, which is on that subnet, and hit refresh, we'll see that we can still access the file, and we can be safe in the knowledge that that traffic is now going over the Usura backbone.

Prepared by Top Experts, the top IT Trainers ensure that when it comes to your IT exam prep and you can count on ExamSnap Microsoft Azure Architect Technologies certification video training course that goes in line with the corresponding Microsoft AZ-303 exam dumps, study guide, and practice test questions & answers.