AzureBootcamp2023: Virtual Network Manager by Marcel Zehner

Having control over you hybrid network is key because many services require rock-solid and secure connectivity. There are multiple options available today to deploy, maintain and extend your network environment. But which one is the best fit for you? The latest service that Microsoft released recently to address this is ‘Azure Virtual Network Manager’ (AVNM). In this session, Marcel introduces you to this new service and gives you a behind-the-scenes view so that you are weaponized to use it out in the wild.
🙂 MARCEL ZEHNER ⚡️ Microsoft Cloud Champion @ SoftwareONE | Microsoft Regional Director & Azure MVP

Transcript

1. Azure Virtual Network Manager:
   The future of network
   management?
   Marcel Zehner | SoftwareONE
   Microsoft RD & MVP
   

   View Slide

2. Marcel Zehner
   SoftwareONE
   4x Microsoft Regional
   Director
   11x Microsoft Azure
   MVP
   IT & Tech Geek
   Community Champion
   Poker Player
   

   View Slide

3. Introduction
   

   View Slide

4. ▪ Secure communications between
   ▪ Azure services
   ▪ Internet services
   ▪ On-premises and Azure services (hybrid)
   ▪ IaaS (e.g. virtual machines)
   ▪ PaaS (e.g. SQL databases)
   ▪ SaaS (e.g. Power BI service)
   Azure Virtual Networks
   

   View Slide

5. ▪ Vnets are bound to a region
   ▪ Vnets are bound to a subscription
   ▪ Vnets are isolated from other virtual
   networks
   ▪ Virtual networks contain subnets
   ▪ Subnets can be protected using
   network security groups (NSGs)
   Azure Virtual Networks
   

   View Slide

6. ▪ Network peerings can be used to
   connect multiple Vnets
   ▪ Strategies
   ▪ Hub-Spoke
   ▪ Mesh
   Peerings
   

   View Slide

7. Mesh
   

   View Slide

8. Hub-Spoke
   

   View Slide

9. ▪ Lots of resources and configurations to
   manage
   ▪ Virtual Networks
   ▪ Peerings
   ▪ Network Security Groups
   ▪ Route Tables
   ▪ Custom Roles
   ▪ Azure Policies
   ▪ Etc.
   ▪ Resources distributed across regions &
   subscriptions
   The Challenges
   

   View Slide

10. AVNM
    ▪ Best of both
    worlds
    ▪ Better than
    manual, easier
    than IaC
    ▪ Great control &
    rollback
    capabilities
    IaC
    ▪ Complex
    coding &
    deployment
    ▪ Best control,
    portability,
    trackability
    ▪ Most secure
    Manual
    ▪ Easiest to learn
    and execute
    ▪ No portability
    ▪ Error prone
    ▪ No testing &
    rollback
    How to tackle this?
    

    View Slide

11. Deployment
    

    View Slide

12. ▪ AVNM must be deployed in Azure
    ▪ Azure resource
    ▪ One or multiple instances
    ▪ Select the management scope
    ▪ Management Groups
    ▪ Subscriptions
    Deployment
    

    View Slide

13. ▪ Select features for the AVNM instance
    ▪ Connectivity
    ▪ Security admin
    Features
    

    View Slide

14. Demo:
    Creation of an AVNM
    Instance
    

    View Slide

15. Connectivity
    

    View Slide

16. ▪ Group Vnets that should be managed
    into Network Groups
    ▪ Static membership
    ▪ Manually added/removed
    ▪ Dynamic membership
    ▪ Added/removed using Azure Policy
    ▪ Existing and future Vnets
    Connectivity
    

    View Slide

17. ▪ Cross-tenant Vnet management
    supported
    ▪ Provider or managed service scenario
    ▪ Customer needs to give access to
    provider
    ▪ Invite user as guest
    ▪ Assign network contributor permissions
    to appropriate scope
    Connectivity
    

    View Slide

18. ▪ Deploy the configuration to one or
    multiple regions & Vnets
    ▪ Check current vs. new state
    ▪ Remove previously applied
    configurations (rollback)
    Configuration & Deployment
    

    View Slide

19. Whiteboard & Demo:
    Creation & Deployment of a
    Connectivity Configuration
    

    View Slide

20. Security Admin Rules
    

    View Slide

21. ▪ Network Security Groups
    ▪ Layer 4 paket filters
    ▪ Create and configure rule set
    ▪ Inbound and outbound traffic
    ▪ Applied at subnet or NIC level
    Network Security Groups (NSG)
    

    View Slide

22. ▪ Security Admin Rules
    ▪ Configured using AVNM
    ▪ Applied at Vnet level
    ▪ Can be used to override or add NSG rules
    ▪ Priority > 1-99 (processes before NSG rules)
    ▪ Deny > Denied, not matter if NSG allows it
    ▪ Allow > Allowed if NSG does not block it
    ▪ AlwaysAllow > NSG is bypassed
    Security Admin Rules
    

    View Slide

23. Security Admin Rules
    Network
    Security
    Group Rules
    Source Target
    

    View Slide

24. Security Admin Rules
    Security
    Admin Rules
    Network
    Security
    Group Rules
    Source Target
    

    View Slide

25. Security Admin Rules: Block
    Security
    Admin Rules
    Network
    Security
    Group Rules
    Source Target
    

    View Slide

26. Security Admin Rules: Allow
    Security
    Admin Rules
    Network
    Security
    Group Rules
    Source Target
    

    View Slide

27. Security Admin Rules: AlwaysAllow
    Security
    Admin Rules
    Network
    Security
    Group Rules
    Source Target
    

    View Slide

28. ▪ Deploy the configuration to one or
    multiple regions & Vnets
    ▪ Check current vs. new state
    ▪ Remove previously applied
    configurations (rollback)
    Configuration & Deployment
    

    View Slide

29. Whiteboard & Demo:
    Creation & Deployment of
    Security Admin Rules
    

    View Slide

30. Takeaways
    

    View Slide

31. 1. New method to manage your
    network in a controlled way
    2. Brand new, more features to expect
    soon
    3. Pricing per subscription with AVNM-
    managed networks
    4. Give it a try!
    Takeaways
    

    View Slide

32. View Slide

33. Azure Virtual Network Manager:
    The future of network
    management?
    Marcel Zehner | SoftwareONE
    Microsoft RD & MVP
    

    View Slide