As you complete your plans for moving IT infrastructure and application workloads to Azure, it’s important to understand what connectivity and security services Microsoft includes by default – and what’s missing. Though Azure comes with baseline capabilities, it’s still up to you to choose judiciously among many Azure-native and third-party options to address unique requirements. This session explores use cases, such as encrypting traffic between VNets holding sensitive data, remote user access to VNets, multi-cloud connectivity, and filtering egress traffic to the Internet. We cover the questions you should be asking: what are the key issues that matter, what does Microsoft provide, and what’s missing? We address these questions for each of the five most common use cases: On-prem to VNet VNet to VNet VNet to Internet (Egress) User to VNet VNet to AWS VPC We then demonstrate how a software-defined approach can deliver simplified and unified control over cloud routing, embracing both Azure-native and third-party services.

1. Five Connectivity and
Security Use Cases
for Azure VNets
Cloud Bootcamp #9 From Aviatrix
October 11, 2018
Sherry Wei, Founder & CTO
Neel Kamal, Head of Field Operations
Frank Cabri, VP Product Marketing

2. © 2017 AVIATRIX SYSTEMS, INC . | 2© 2018 AVIATRIX SYSTEMS, INC . | 2
• Overview: Azure Cloud Networking
• Azure Networking Scenarios
- On-Prem to VNet
- VNet to VNet
- VNet to Internet
- VNet to VPC (Multicloud)
- User to VNet
• Demo
• Live Q & A
Welcome & Agenda
SHERRY WEI
Founder & CTO
NEEL KAMAL
Head of Field Operations
FEATURED SPEAKERS

3. © 2017 AVIATRIX SYSTEMS, INC . | 3© 2017 AVIATRIX SYSTEMS, INC . | 3
SPOKE VNET SPOKE VNET SPOKE VNET
SPOKE VNET SPOKE VNET SPOKE VNET
Overview: Azure Cloud Networking
DatacenterUsers Customers
Internet
GCP
ExpressRoute
Gateway

4. © 2017 AVIATRIX SYSTEMS, INC . | 4© 2018 AVIATRIX SYSTEMS, INC . | 4
Azure Networking Scenarios (Use Cases)
1. On-Prem to VNet
2. VNet to VNet
3. VNet to Internet
(Egress)
4. VNet to VPC (Multi-
Cloud)
5. User to VNet
(Remote Access)

5. © 2017 AVIATRIX SYSTEMS, INC . | 5© 2018 AVIATRIX SYSTEMS, INC . | 5
Why Does It Matter?
• Secure connectivity between on-prem to VNet is critical. Data-in-motion
over the Internet must be encrypted
• Data-in-motion over ExpressRoute might also require encryption
What Does Azure Provide Natively?
• Azure VPN Gateway
• Acts as a termination point for IPsec tunnels or Azure ExpressRoute tunnels
• Scales to 1.25 Gbps VPN
• Has a transit property
• Bandwidth based pricing
What Is Missing?
• Limitations on the type of connectivity
• Static routes: supports only one tunnel
• Dynamic routes: up to 30 ( has a performance limitation beyond 10 tunnels)
• Limitation on a Transit Hub: does not support cross-region spoke VNets
• Limitation on segmentation: does not support isolation
1. On-Prem to VNet
SPOKE VNET SPOKE VNET SPOKE VNET
Datacenter
ExpressRoute
Gateway
TRANSIT HUB

6. © 2017 AVIATRIX SYSTEMS, INC . | 6© 2018 AVIATRIX SYSTEMS, INC . | 6
What Is Missing?
• Requires a Transit HUB for every region
• There is no way to connect the Transit HUB
of one region to another
• Same issue for Shared Services VNet, forces
customer to divide their shared services
architecture into multiple shared services
VNet.
1. On-Prem to VNet | Transit Architecture
SPOKE VNET SPOKE VNET SPOKE VNET
Datacenter
ExpressRoute
Gateway
TRANSIT HUB
SPOKE VNET SPOKE VNET SPOKE VNET
Datacenter
ExpressRoute
Gateway
TRANSIT HUB
X

7. © 2017 AVIATRIX SYSTEMS, INC . | 7© 2018 AVIATRIX SYSTEMS, INC . | 7
Why Does It Matter?
• Must comply with data privacy, data security and compliance policies
(ex: data always encrypted in motion)
• You can’t assume applications are encrypted at the app layer
• Because tools like Puppet and Chef are not natively encrypted, you may need
encrypted tunnels from a shared service VNet to spoke VNets
What Does Azure Provide Natively?
• Azure VNet peering
• Azure global VNet peering
What Is Missing?
• Encryption - peerings are not encrypted
• Azure global VNet peering is available only in limited regions.
• Security policy (limitation)
• At the VNet level: cannot do things like L4 firewalling
• At the instance level: policies are limited to 50 entries (extendable to 250 on demand) and they are IP address-based
2. VNet to VNet
SPOKE VNET SPOKE VNET
TRANSIT HUB

8. © 2017 AVIATRIX SYSTEMS, INC . | 8© 2018 AVIATRIX SYSTEMS, INC . | 8
Why Does It Matter?
• Disallowing Internet access from VNets is not going to work
• Access to unwanted Internet sites or programs makes the application vulnerable
• Forcing packets to go on-prem to access the Internet introduces latency and cost
What Does Azure Provide Natively?
• Azure Firewall
• For HTTP/HTTPs: Supports application rules for http/https traffic with FQDN tags; supports
wildcard and source address filtering
• For non HTTP/HTTPS: Supports IP address-based network rules
What Is Missing?
• No FQDN support for non http/https traffic
• No FQDN discovery
• No IDS/IPS
3. VNet to Internet (Egress)
SPOKE VNET
SPOKE VNET
Internet

9. © 2017 AVIATRIX SYSTEMS, INC . | 9© 2018 AVIATRIX SYSTEMS, INC . | 9
Why Does It Matter?
• More organizations are adopting a multicloud strategy for best-of-breed cloud services
• Partners or acquisitions may not be offering their services on VNet
• Pricing optimization leads to multicloud choices
What Does Azure Provide Natively?
• No real options
What are the Challenges?
• No native peering across VNet to VPC
• Trying to route VNet traffic to VPCs via an on-prem datacenter makes connectivity very
complex (and expensive)
• Puts more burden on your cloud engineering team because the networking constructs
on VNets are very different from those on AWS VPCs or Google Cloud
• Many vRouters don’t work in a multicloud environment
4. VNet to AWS VPC (MultiCloud)
SPOKE VNET
TRANSIT HUB

10. © 2017 AVIATRIX SYSTEMS, INC . | 10© 2018 AVIATRIX SYSTEMS, INC . | 10
Why Does It Matter?
• Allowing developers unsecure access to VNet instances leads to data breaches
and significant business risk
• Compliance and regulations that require tracking of data access activities
What Does Azure Provide Natively?
• Azure P2S service
• Azure OpenVPN (preview version only)
What Is Missing?
• P2S works only on Windows clients
• Support for general SSL VPN clients
• Strong authentication: LDAP, SAML, Okta, Duo, MFA, etc.
• Network-level authorization: profile-based authorization
• Audit reporting to track who accessed what, from where, and at what time
5. User to VNet (Remote Access)
SPOKE VNET SPOKE VNET
TRANSIT HUB
Users

11. © 2017 AVIATRIX SYSTEMS, INC . | 11© 2017 AVIATRIX SYSTEMS, INC . | 11
SPOKE VNET SPOKE VNET SPOKE VNET
SPOKE VNET SPOKE VNET SPOKE VNET
DEMO
DatacenterUsers Customers
Internet
GCP
ExpressRoute
Gateway
Aviatrix Controller
Aviatrix Gateway

12. © 2017 AVIATRIX SYSTEMS, INC . | 12© 2018 AVIATRIX SYSTEMS, INC . | 12
• You’ll receive email w/ a
link to a replay and slides
• Take 5 minutes and start a
free 14-day trial ….
https://www.aviatrix.com/trial
• To view other bootcamps:
https://www.aviatrix.com/bootcamps
Next Steps with Aviatrix
Use the Chat widget to talk
live with a Solution Architect