AzureBootcamp2023: Azure Networking vNext by Eric Berg

When you are working with Microsoft Azure Services you will come across the topic of Network Integration. But is a classical VPN the right solution? Do I always need ExpressRoute? Should I adopt VirtualWAN? And what about my APIs in the Cloud? This session will help you to understand the available options to build modern Azure Networks. We will figure out how a solution-design could look like and which limitations apply. Also we will have a look into services that do not have options to integrate into a classical network and how you could mitigate this. Let’s figure out how to modernize networking in Azure!
🙂 ERIC BERG ⚡️ Vice President Consulting Expert @ CGI | Microsoft Azure MVP

Transcript

1. - Azure Networking vNext -
   How to build modern connectivity for IaaS,
   PaaS and SaaS
   Eric Berg – Microsoft MVP
   Vice President @ CGI
   

   View Slide

2. Eric Berg
   Vice President Expert @ CGI
   Cloud, Datacenter and Management
   Azure, AWS, GCP
   info@ericberg.de
   @ericberg_de | @GeekZeugs
   www.ericberg.de | www.geekzeugs.de
   

   View Slide

3. Agenda
   Networking Overview
   Networking Recap
   Connectivity
   Integration
   DNS
   Build it
   Q&A
   

   View Slide

4. Networking Overview
   

   View Slide

5. Azure Datacenter Infrastructure
   Azure
   Backup
   Site
   Recovery
   Azure
   Monitor
   Azure
   Policy
   Azure
   Blueprints
   Log
   Analytics
   Azure
   Migrate
   Databox
   Family
   Compute Storage Networking
   Linux
   Virtual
   Machine
   Compute/Containers Web/Mobile DevOps/Developer
   Container
   Instance
   Functions
   Service Fabric
   Integration IoT Data Services
   Service Bus Event Grid
   Logic Apps
   API
   Management
   Management Platform as a Services (PaaS) Security
   Infrastructure as a Services (IaaS)
   Disk
   Storage
   Managed
   Disks
   Virtual
   Machine
   Scale Sets
   Express
   Route
   Load
   Balancer
   Azure
   Firewall
   Virtual
   WAN
   Network
   Watcher
   Virtual
   Network
   VPN
   Gateway
   Media Services
   Content Delivery
   Network
   Media/CDN
   Cognitive
   Services
   IoT Hub
   Stream
   Analytics
   Role- based
   access control
   Azure
   Digital Twins
   Time Series
   Insights
   IoT Central
   IoT Edge
   Bot
   Services
   SQL Data
   Warehouse
   Azure
   Databricks
   Apache
   Spark
   AI
   Machine
   Learning Studio
   Machine
   Learning Service
   Azure
   Search
   Analytics
   Data Lake
   Storage Gen2
   Mobile Apps
   Web Apps Logic Apps API Apps
   Notification
   Hubs
   SignalR
   Service
   Application
   Insights
   Lab
   Services
   Azure DevOps
   SDK
   SQL
   Database
   Data Factory
   Database for
   MySQL Cosmos DB
   Database for
   PostgreSQL
   Database for
   MariaDB
   Database
   Migration Service
   Azure Cache
   for Redis
   Azure AD
   Key Vault
   Security
   Center
   DDoS
   Protection
   Multi-Factor
   Authentication
   Azure ATP
   Azure AD for
   Domain Services
   Azure AD
   B2C
   Cost
   Management
   Video Indexer
   Content
   Protection
   Kubernetes
   Service
   SQL Data
   Warehouse
   Table
   Storage
   

   View Slide

6. 60+Azure
   regions
   165k+ miles of fiber +
   subsea cables
   185+edge
   sites
   500+network
   partners
   20k+peering
   connections
   Region
   Edge
   Network
   

   View Slide

7. Connecting Azure regions to the global network
   Edge
   ExpressRoute
   Internet peers
   Enterprise peering
   P R I V A T E
   Internet peering
   P U B L I C
   Microsoft Wide Area Network
   Regional Gateways
   Availability Zone
   D C
   D C D C
   Availability Zone
   D C
   D C D C
   Availability Zone
   D C
   D C D C
   Azure Region
   

   View Slide

8. Microsoft Global Network (WAN)
   The Azure Network Edge
   Traffic to and between DCs
   WAN
   core routers
   Azure
   ExpressRoute
   Azure Front Door,
   CDN, WAF
   Azure Network Edge
   Internet and private network
   

   View Slide

9. Networking Recap
   

   View Slide

10. Virtual Network
    Isolated, logical network that provides
    connectivity for Azure Resources
    User-defined address space (can be
    one or more IP ranges, not necessarily
    RFC1918)
    • Connectivity for VMs in the same
    VNET
    • Connectivity to external
    networks/on-prem DC’s
    • Internet connectivity
    Name: VNet1
    Address space: 10.57.0.0/16,
    10.66.0.0/24
    Internet
    

    View Slide

11. Subnet
    Provides full layer-3
    semantics and partial layer-
    2 semantics (DHCP
    , ARP
    , no
    broadcast / multicast)
    Subnets can span only one
    range of contigous IP
    addresses
    VMs can be deployed only
    to subnets (not VNETs)
    Name: VNet1
    Address space: 10.57.0.0/16,
    10.66.0.0/24
    Subnet1
    10.57.1.0/24
    Subnet2
    10.66.0.0/24
    

    View Slide

12. Network Interface
    Virtual NIC that connects a VM to
    a Subnet
    One private IP address (private
    == included in the subnet’s IP
    range, not necessarily RFC1918)
    Private IP address always
    assigned via Azure DHCP
    Virtual machine
    IpConfiguration
    

    View Slide

13. Switching/Routing in Azure VNETs
    A VNET provides a switching/routing functionality that allows VMs to talk
    to each other
    Name: VNet2
    Address space: 10.57.0.0/16
    Subnet1
    10.57.1.0/24
    Subnet2
    10.57.2.0/25
    Switch/Routing
    (Azure SDN stack)
    Please note that, in an Azure VNet, packets
    can flow between two different subnets
    without explicitly traversing any layer-3 device.
    Azure’s network virtualization stack effectively
    works as a layer-3 switch
    

    View Slide

14. Connectivity
    

    View Slide

15. Connecting to Azure
    Cloud Customer Characteristics
    Site-to-site
    VPN connectivity
    • High throughput, secure cross-
    premises connectivity
    • BGP, active-active for high
    availability & transit routing
    Remote access point-
    to-site connectivity
    • Remote Access to VNet/On-prem
    • Connect from anywhere
    • Mac, Linux, Windows
    • Radius/AD authentication
    ExpressRoute private
    connectivity
    • Private connectivity to Microsoft
    services
    • Mission critical workloads
    Internet Connectivity
    • Internet facing with public IP
    addresses in Azure
    • VPN connectivity with virtual
    appliances (Marketplace)
    Site-to-site
    VPN connectivity
    • High throughput, secure cross-
    premises connectivity
    • BGP, active-active for high
    availability & transit routing
    Site-to-site
    VPN connectivity
    • High throughput, secure cross-
    premises connectivity
    • BGP, active-active for high
    availability & transit routing
    

    View Slide

16. Connecting in Azure
    16
    Cloud Cloud Characteristics
    VNet-to-VNet via
    Gateways
    • Transitive routing via BGP and VPN
    gateways
    • Secure connectivity via IPsec/IKE
    across Azure WAN links
    VNet Peering
    • Same-/cross-region direct, private
    VM-to-VM connectivity
    • NSG & UDR across VNets
    • GatewayTransit for hub-and-spoke
    VNet-to-VNet via
    ExpressRoute circuit
    • Traverse (“hairpin”) through
    ExpressRoute circuit & gateways
    • Traffic is not encrypted
    

    View Slide

17. Cross premises connectivity overview
    17
    S2S tunnels
    P2S tunnels
    ExpressRoute
    Virtual Network
    Internet
    Private
    WAN
    Frontend
    Mid-tier
    Backend
    Microsoft
    

    View Slide

18. Azure Virtual WAN
    

    View Slide

19. NextGen Cloud Networking
    

    View Slide

20. Azure Portal
    Remote
    Protocol
    (RDP, SSH)
    TLS
    443,
    Internet
    AzureBastionSubnet
    Port: 3389/22
    “AzureBastionSubnet”
    Target VM Subnet(s)
    Private IP
    Azure VM
    Azure VM
    Azure VM
    Customer’s Virtual Network
    TLS
    Azure Bastion
    Azure Bastion
    Secure and seamless RDP and SSH access
    to your virtual machines
    RDP/SSH to your workload using HTML5
    standards-based web-browser, directly in
    Azure Portal
    Resources can be accessed without public
    IP addresses
    Supported Azure resources include VMs,
    VM Scale Sets, Dev-Test Labs
    

    View Slide

21. Azure Datacenter Infrastructure
    Azure
    Backup
    Site
    Recovery
    Azure
    Monitor
    Azure
    Policy
    Azure
    Blueprints
    Log
    Analytics
    Azure
    Migrate
    Databox
    Family
    Compute Storage Networking
    Linux
    Virtual
    Machine
    Compute/Containers Web/Mobile DevOps/Developer
    Container
    Instance
    Functions
    Service Fabric
    Integration IoT Data Services
    Service Bus Event Grid
    Logic Apps
    API
    Management
    Management Platform as a Services (PaaS) Security
    Infrastructure as a Services (IaaS)
    Disk
    Storage
    Managed
    Disks
    Virtual
    Machine
    Scale Sets
    Express
    Route
    Load
    Balancer
    Azure
    Firewall
    Virtual
    WAN
    Network
    Watcher
    Virtual
    Network
    VPN
    Gateway
    Media Services
    Content Delivery
    Network
    Media/CDN
    Cognitive
    Services
    IoT Hub
    Stream
    Analytics
    Role- based
    access control
    Azure
    Digital Twins
    Time Series
    Insights
    IoT Central
    IoT Edge
    Bot
    Services
    SQL Data
    Warehouse
    Azure
    Databricks
    Apache
    Spark
    AI
    Machine
    Learning Studio
    Machine
    Learning Service
    Azure
    Search
    Analytics
    Data Lake
    Storage Gen2
    Mobile Apps
    Web Apps Logic Apps API Apps
    Notification
    Hubs
    SignalR
    Service
    Application
    Insights
    Lab
    Services
    Azure DevOps
    SDK
    SQL
    Database
    Data Factory
    Database for
    MySQL Cosmos DB
    Database for
    PostgreSQL
    Database for
    MariaDB
    Database
    Migration Service
    Azure Cache
    for Redis
    Azure AD
    Key Vault
    Security
    Center
    DDoS
    Protection
    Multi-Factor
    Authentication
    Azure ATP
    Azure AD for
    Domain Services
    Azure AD
    B2C
    Cost
    Management
    Video Indexer
    Content
    Protection
    Kubernetes
    Service
    SQL Data
    Warehouse
    Table
    Storage
    

    View Slide

22. Azure Datacenter Infrastructure
    Azure
    Backup
    Site
    Recovery
    Azure
    Monitor
    Azure
    Policy
    Azure
    Blueprints
    Log
    Analytics
    Azure
    Migrate
    Databox
    Family
    Compute Storage Networking
    Linux
    Virtual
    Machine
    Compute/Containers Web/Mobile DevOps/Developer
    Container
    Instance
    Functions
    Service Fabric
    Integration IoT Data Services
    Service Bus Event Grid
    Logic Apps
    API
    Management
    Management Platform as a Services (PaaS) Security
    Infrastructure as a Services (IaaS)
    Disk
    Storage
    Managed
    Disks
    Virtual
    Machine
    Scale Sets
    Express
    Route
    Load
    Balancer
    Azure
    Firewall
    Virtual
    WAN
    Network
    Watcher
    Virtual
    Network
    VPN
    Gateway
    Media Services
    Content Delivery
    Network
    Media/CDN
    Cognitive
    Services
    IoT Hub
    Stream
    Analytics
    Role- based
    access control
    Azure
    Digital Twins
    Time Series
    Insights
    IoT Central
    IoT Edge
    Bot
    Services
    SQL Data
    Warehouse
    Azure
    Databricks
    Apache
    Spark
    AI
    Machine
    Learning Studio
    Machine
    Learning Service
    Azure
    Search
    Analytics
    Data Lake
    Storage Gen2
    Mobile Apps
    Web Apps Logic Apps API Apps
    Notification
    Hubs
    SignalR
    Service
    Application
    Insights
    Lab
    Services
    Azure DevOps
    SDK
    SQL
    Database
    Data Factory
    Database for
    MySQL Cosmos DB
    Database for
    PostgreSQL
    Database for
    MariaDB
    Database
    Migration Service
    Azure Cache
    for Redis
    Azure AD
    Key Vault
    Security
    Center
    DDoS
    Protection
    Multi-Factor
    Authentication
    Azure ATP
    Azure AD for
    Domain Services
    Azure AD
    B2C
    Cost
    Management
    Video Indexer
    Content
    Protection
    Kubernetes
    Service
    SQL Data
    Warehouse
    Table
    Storage
    

    View Slide

23. Azure Datacenter Infrastructure
    Azure
    Backup
    Site
    Recovery
    Azure
    Monitor
    Azure
    Policy
    Azure
    Blueprints
    Log
    Analytics
    Azure
    Migrate
    Databox
    Family
    Compute Storage Networking
    Linux
    Virtual
    Machine
    Compute/Containers Web/Mobile DevOps/Developer
    Container
    Instance
    Functions
    Service Fabric
    Integration IoT Data Services
    Service Bus Event Grid
    Logic Apps
    API
    Management
    Management Platform as a Services (PaaS) Security
    Infrastructure as a Services (IaaS)
    Disk
    Storage
    Managed
    Disks
    Virtual
    Machine
    Scale Sets
    Express
    Route
    Load
    Balancer
    Azure
    Firewall
    Virtual
    WAN
    Network
    Watcher
    Virtual
    Network
    VPN
    Gateway
    Media Services
    Content Delivery
    Network
    Media/CDN
    Cognitive
    Services
    IoT Hub
    Stream
    Analytics
    Role- based
    access control
    Azure
    Digital Twins
    Time Series
    Insights
    IoT Central
    IoT Edge
    Bot
    Services
    SQL Data
    Warehouse
    Azure
    Databricks
    Apache
    Spark
    AI
    Machine
    Learning Studio
    Machine
    Learning Service
    Azure
    Search
    Analytics
    Data Lake
    Storage Gen2
    Mobile Apps
    Web Apps Logic Apps API Apps
    Notification
    Hubs
    SignalR
    Service
    Application
    Insights
    Lab
    Services
    Azure DevOps
    SDK
    SQL
    Database
    Data Factory
    Database for
    MySQL Cosmos DB
    Database for
    PostgreSQL
    Database for
    MariaDB
    Database
    Migration Service
    Azure Cache
    for Redis
    Azure AD
    Key Vault
    Security
    Center
    DDoS
    Protection
    Multi-Factor
    Authentication
    Azure ATP
    Azure AD for
    Domain Services
    Azure AD
    B2C
    Cost
    Management
    Video Indexer
    Content
    Protection
    Kubernetes
    Service
    SQL Data
    Warehouse
    Table
    Storage
    

    View Slide

24. Azure Load Balancer
    

    View Slide

25. Azure Load Balancer
    Allows you to scale your applications and create high availability and resiliency
    for your services and applications
    Public
    • A public Load Balancer maps the public
    IP address and port number of incoming
    traffic to the private IP address and port
    number of the VM and vice versa.
    Internal
    • An internal Load Balancer directs traffic only
    to resources that are inside a virtual network
    or that use a VPN to access
    Azure infrastructure.
    

    View Slide

26. Public Load Balancer
    A public Load Balancer maps the public IP address and port number of
    incoming traffic to the private IP address and port number of the VM
    Automatic reconfiguration
    • Instantly reconfigures itself as you scale
    instance up or down
    Outbound connections (SNAT)
    • All outbound flows from private IP addresses
    inside your virtual network to public IP
    addresses on the internet can be translated
    to a frontend IP address of the Load Balancer
    Default Distribution Mode
    • Azure Load Balancer distributes traffic
    evenly amongst multiple VM instance
    

    View Slide

27. Internal Load Balancer
    An internal Load Balancer directs traffic only to resources inside a virtual
    network or that use a VPN to access Azure infrastructure
    Within a virtual network
    Cross-premises virtual network
    Multi-tier applications
    Line-of-business applications
    

    View Slide

28. Routing Preference
    Routing via Microsoft-Network
    Routing via Internet
    

    View Slide

29. Cross-Region Load Balancer
    Challenge with Load Balancers
    • Bound to a VNET
    • Bound to a region
    • Global Deployments have different
    Frontend IPs
    • Manual changes required in case of a
    disaster
    Cross-Region Load Balancer
    • Load Balancer of Load Balancers
    • Backends are regional public LBs
    • No private / internal LBs, no UDP
    

    View Slide

30. Gateway Load Balancer
    Gateway Load Balancer allow to easily
    deploy, scale, and manage NVAs
    Benefits
    • integrate NVA transparently
    • Easy add or remove - scaling
    • Improve NVA availability
    • Chain applications across regions
    and subscriptions
    

    View Slide

31. DEMO – LOAD BALANCERS
    

    View Slide

32. Azure Traffic Manager (TM)
    Azure Front Door (AFD)
    

    View Slide

33. Azure Traffic Manager
    Azure Traffic Manager is a DNS-based traffic
    load balancer that enables you to distribute
    traffic optimally to services across global Azure
    regions
    • Global DNS load balancing
    • Automatic failover when an endpoint goes
    down
    • Combine with hybrid applications
    Supports external, non-Azure endpoints so
    that it can be used with hybrid cloud and
    on-premises deployments
    • Distribute traffic for complex deployments
    Use nested Traffic Manager profiles for
    sophisticated, flexible rules for complex
    deployments
    

    View Slide

34. Azure Front Door
    Azure Front Door Service provides a
    scalable and secure entry point
    for fast delivery of your global web
    applications
    • SSL offload and application
    acceleration
    • Global HTTP load balancing with
    instant failover
    • Application Firewall and DDoS
    protection
    • Centralized traffic orchestration
    view
    

    View Slide

35. Single region apps
    Network Edge POP
    Azure region
    www.contoso.com
    Global
    Network
    /*
    /search/*
    Accelerate
    Multi-region apps
    Network Edge POP
    Azure region 1
    www.contoso.com
    Global
    Network
    Accelerate
    Azure region 2
    Fail over
    Azure Front Door
    Single or multi-region app and API
    acceleration
    Improve HTTP performance and
    reduce page load times
    Load balancing at the Edge and fast-
    failover
    Build always-on application
    experiences that fail-fast (safely)
    Integrated SSL, WAF and DDoS
    Protect and scale your application to
    global users, devices, traffic and
    attacks
    

    View Slide

36. Traffic Manager or Front Door?
    

    View Slide

37. Traffic Manager or Front Door?
    

    View Slide

38. What to use?
    

    View Slide

39. DEMO – LOAD BALANCING
    

    View Slide

40. OK …
    … but that’s only outside networks
    

    View Slide

41. Service Endpoints and Private Link
    

    View Slide

42. PaaS Services and Networking
    PaaS Services are designed to be accessed via public endpoints
    Two main challenges
    • Access “internal” data sources from PaaS (e.g. present SAP data in Azure WebApp)
    • Access PaaS Services from “internal” Systems (e.g. use Azure SQL DB with an app
    running in a VM with no Internet access)
    Ways to integrate PaaS into networks
    

    View Slide

43. PaaS Services and Networking
    

    View Slide

44. Private PaaS
    SERVICE ENDPOINT PRIVATE LINK – PRIVATE ENDPOINT
    • VNet to PaaS service via the Microsoft backbone
    • Destination is still a public IP address. NSG opened to
    Service Tags
    • Need to pass NVA/Firewall for exfiltration protection
    • VNet Paas via the Microsoft backbone
    • PaaS resource mapped to Private IP Address. NSGs
    restricted to VNet space
    • Built-in data exfiltration protection
    Virtual Network (10.0.0.0/16)
    Rule Destination Access
    stg STORAGE Allow
    vnet VNET Allow
    internet INTERNET Deny
    Virtual Network (10.0.0.0/16)
    Rule Destination Access
    vnet VNET Allow
    internet INTERNET Deny
    

    View Slide

45. Data Exfiltration Protection
    • Private Endpoint maps
    specific PaaS resource to an
    IP address, not the entire
    service
    • Access only to mapped
    PaaS resource
    • Data exfiltration protection
    is in-built
    Private
    Endpoint
    10.0.0.1
    Mapped
    Account
    Un-Mapped Accounts
    Deny Internet
    Private Link
    

    View Slide

46. Secure connectivity from on-premises
    Storage SQL
    Good Better Best
    Storage SQL Storage SQL
    On-premises
    On-premises
    On-premises
    • Traffic traverses the Internet
    • Secured using ACLs on Public Ips
    • Corporate firewall open to Azure
    Public IPs
    • Traffic stays within Microsoft and partner
    network
    • MS Peering draws Microsoft Public IP
    traffic
    • Corporate Firewall open to Azure Public
    IPs
    • Traffic is fully private traversing the
    Microsoft network
    • No exposure of public IPs on either side
    • Corporate Firewall open only to private
    Internet
    Internet
    Inter
    MS Peering
    Internet
    Interne
    MS Peering
    PUBLIC IP ACL
    Public
    Internet
    Microsoft
    Network
    PUBLIC IP ACL
    Private Peering Private Link
    

    View Slide

47. Azure Private Link
    Private access from Virtual Network
    resources, peered networks and
    on-premise networks
    In-built Data
    Exfiltration Protection
    Predictable private IP addresses for
    PaaS resources
    Unified experience across PaaS,
    Customer Owned and marketplace
    Services
    Private Link for Azure Storage, SQL DB and customer own service
    Azure PaaS and
    marketplace services
    ER Private
    Peering
    ER Gateway
    Private
    endpoint
    10.0.0.5
    Deny Internet
    On-premises
    Virtual Network (10.0.0.0/16)
    Private
    Link
    Storage SQL DW
    SQL Marketplace
    

    View Slide

48. There is even more …
    

    View Slide

49. Your Own Private Link Service
    • Create or Convert your existing
    services into Private Link Service
    • VNet-VNet Connectivity without
    worrying about overlapping IP
    Space
    • No regional, tenant, subscription
    or RBAC restrictions
    • Easily Scale and manage your
    service
    Private Link
    Service
    

    View Slide

50. Create Private Link Service
    • Application running behind
    Standard Load Balancer can be
    converted into Private Link
    service with one click of a
    button/one API call
    • Private Link Service tied to
    Frontend IP configuration of
    Standard Load Balancer
    • Frontend IP Configuration can be
    either Public or Private
    Subnet
    (10.0.1.0/24)
    Application VMs
    Standard
    Load Balancer
    Private Link
    Service
    Virtual Network
    (10.0.0.0/16)
    

    View Slide

51. Consume Private Link Service
    • Create a Private Endpoint in your
    VNet linking to Private Link
    Service.
    • Multiple consumers can connect
    to same service. No RBAC
    restrictions. Subnet
    (10.0.1.0/24)
    Application
    VMs
    Virtual Network
    (10.0.0.0/16)
    Private Endpoint
    10.0.1.5
    

    View Slide

52. Approval Workflow
    Service
    Provider
    Service Consumer
    Subnet
    Application VMs
    Standard ILB
    Create your application
    behind a standard Load
    Balancer.
    1
    2 Create a Private Link
    Service attached to SLB FE
    IP.
    3 Share the private link service ID
    (Alias/ARM URI) with
    consumers. You can either do
    it offline or advertise publicly.
    Create a Private endpoint in any
    subnet by specifying a private
    Link service URI/Alias.
    4
    5 Configure your DNS record
    for easy access using the
    private IP address (CA).
    6 Act on the request –
    Accept/Reject It.
    Connection
    Succeeded/Rejected.
    7
    . .
    .azure.privatelinkservice
    

    View Slide

53. Complete Picture
    Subnet
    (10.0.1.0/24)
    Standard
    Load Balancer
    Private Link
    Service
    Virtual Network
    (10.0.0.0/16)
    Subnet
    (10.0.1.0/24)
    VMs
    Virtual Network
    (10.0.0.0/16)
    Private
    Endpoint
    10.0.1.5
    Service Provider
    Service Consumer
    Application VMs
    Private
    Link
    Microsoft Network
    Deny Internet Deny Internet
    

    View Slide

54. DNS for PaaS?!
    

    View Slide

55. What about DNS?
    Public DNS is “no longer working” when using Azure Private Endpoints!
    E.g. Storage Account:
    https://demostordus2021.blob.core.windows.net
    https://demostordus2021pep.blob.core.windows.net
    

    View Slide

56. Azure Private DNS
    Create Private DNS zones for your services (can be done at creation !!! ATTENTION)
    

    View Slide

57. DEMO – Private Link / Endpoint
    

    View Slide

58. Azure Private DNS at Scale
    Consider Enterprise CAF Solution
    • Prepare central private DNS zones
    • Deny creation of Private DNS zones in spokes via policy
    • Create Azure Policy to “DeployIfNotExisits” a DNS Zone Group
    to Private Endpoints
    Solution will take care of everything
    BUT
    • bound to one tenant, as policy resides in one tenant
    • Only one DNS Zone supported per policy
    

    View Slide

59. How are things built?
    

    View Slide

60. WestUS
    WestEurope
    

    View Slide

61. WestUS
    WestEurope
    RG01 RG03
    RG02
    RGHUB
    

    View Slide

62. WestUS
    WestEurope
    ER
    RG01 RG03
    RG02
    RGHUB
    HUB-VNET01
    VPN
    

    View Slide

63. WEB01
    NICs
    WEB02
    WEB02-NIC
    WEB03
    WEB03-NIC
    WestUS
    WestEurope
    ER
    RG01 RG03
    RG02
    RGHUB
    HUB-VNET01
    VNET01 VNET02 VNET03
    VPN
    

    View Slide

64. WEB01
    NICs
    WEB02
    WEB02-NIC
    WEB03
    WEB03-NIC
    WestUS
    WestEurope
    ER
    VNET-
    Peering
    RG01 RG03
    RG02
    RGHUB
    HUB-VNET01
    VNET01 VNET02 VNET03
    Global VNET-Peering
    VPN
    VPN
    

    View Slide

65. WEB01
    NICs
    WEB02
    WEB02-NIC
    WEB03
    WEB03-NIC
    WestUS
    WestEurope
    ER
    VNET-
    Peering
    RG01 RG03
    RG02
    RGHUB
    HUB-VNET01
    VNET01 VNET02 VNET03
    Global VNET-Peering
    VPN
    VPN
    Azure
    Firewall
    Firewall
    Manager
    NVA01
    

    View Slide

66. WEB01
    NICs
    WEB02
    WEB02-NIC
    WEB03
    WEB03-NIC
    WestUS
    WestEurope
    ER
    VNET-
    Peering
    RG01 RG03
    RG02
    RGHUB
    HUB-VNET01
    VNET01 VNET02 VNET03
    Global VNET-Peering
    VPN
    VPN
    Azure
    Firewall
    Firewall
    Manager
    Bastion
    NVA01
    

    View Slide

67. WEB01
    NICs
    WEB02
    WEB02-NIC
    WEB03
    WEB03-NIC
    WestUS
    WestEurope
    ER
    VNET-
    Peering
    RG01 RG03
    RG02
    RGHUB
    HUB-VNET01
    VNET01 VNET02 VNET03
    Global VNET-Peering
    VPN
    VPN
    Azure
    Firewall
    Firewall
    Manager
    Bastion
    NVA01
    Private
    Endpoint
    STORAGES
    

    View Slide

68. WEB01
    NICs
    WEB02
    WEB02-NIC
    WEB03
    WEB03-NIC
    WestUS
    WestEurope
    ER
    VNET-
    Peering
    RG01 RG03
    RG02
    RGHUB
    HUB-VNET01
    VNET01 VNET02 VNET03
    Global VNET-Peering
    Azure
    DNS
    VPN
    VPN
    Azure
    Firewall
    Firewall
    Manager
    Bastion
    CDN
    NVA01
    Private
    Endpoint
    STORAGES
    

    View Slide

69. WEB01 + 04
    NICs
    WEB02
    WEB02-NIC
    WEB03
    WEB03-NIC
    WestUS
    WestEurope
    ER
    VNET-
    Peering
    RG01 RG03
    RG02
    RGHUB
    HUB-VNET01
    VNET01 VNET02 VNET03
    Global VNET-Peering
    Azure
    DNS
    VPN
    VPN
    Azure
    Firewall
    Firewall
    Manager
    Bastion
    Load
    Balancer
    CDN
    Web
    Application
    Firewall
    NVA01
    Private
    Endpoint
    STORAGES
    

    View Slide

70. WEB01 + 04
    NICs
    WEB02
    WEB02-NIC
    WEB03
    WEB03-NIC
    WestUS
    WestEurope
    ER
    VNET-
    Peering
    RG01 RG03
    RG02
    RGHUB
    HUB-VNET01
    VNET01 VNET02 VNET03
    Global VNET-Peering
    Azure
    DNS
    VPN
    VPN
    Azure
    Firewall
    Firewall
    Manager
    Bastion
    Load
    Balancer
    Traffic
    Manager
    Azure Front
    Door
    CDN
    Web
    Application
    Firewall
    NVA01
    Private
    Endpoint
    STORAGES
    

    View Slide

71. WEB01 + 04
    NICs
    WEB02
    WEB02-NIC
    WEB03
    WEB03-NIC
    WestUS
    WestEurope
    ER
    VNET-
    Peering
    RG01 RG03
    RG02
    RGHUB
    HUB-VNET01
    VNET01 VNET02 VNET03
    Global VNET-Peering
    Azure
    DNS
    VPN
    VPN
    Azure
    Firewall
    Firewall
    Manager
    Bastion
    Load
    Balancer
    Traffic
    Manager
    Azure Front
    Door
    CDN
    Web
    Application
    Firewall
    DDoS
    Protection
    Virtual
    WAN
    Network
    Watcher
    NVA01
    Private
    Endpoint
    STORAGES
    

    View Slide

72. View Slide

73. View Slide

74. Want to dive deeper?!
    Azure PaaS, but as private as possible…
    Stephan Graber – 14:25
    Azure Virtual Network Manager: The future
    of network management?
    Marcel Zehner – 15:40
    

    View Slide