This document discusses Microsoft Azure networking features that were announced at Ignite 2016, including the new Ultra Performance Gateway tier for ExpressRoute that provides higher bandwidth connectivity and is available in two US regions. It also summarizes documentation links related to load balancing, virtual networking, and cross-premises connectivity capabilities in Azure.

1. Session ID: CLD006
本情報の内容（添付文書、リンク先などを含む）は、Microsoft Tech Summit 開催日（2016年11月1－2日）時点のものであり、予告なく変更される場合があります。

3. Microsoft Tech Summit

6. Microsoft Tech Summit

8. Microsoft Tech Summit

13. Connecting Azure RegionsInside the Azure Region Geographic Reach and
Internet Ecosystem
National Clouds
CDN
Backbone in 100+ iXP
3500+ peerings with ISPs
ExpressRoute in
35 locations
Private cloud connectivity
Security
Performance
Load
Balancing
Virtual
Networks
Cross-premises
connectivity
Software
Defined
WAN
Optical
Networks
Long-Haul
Optical
Network
Advanced
MPLS
Services
Internet Exchange Provider
Servers

14. Microsoft Tech Summit

17. https://azure.microsoft.com/en-us/documentation/articles/virtual-network-
accelerated-networking-powershell/

24. ARM VNet-A Classic VNet-A
192.168.0.0/24 10.0.0.0/24

25. 仮想ネットワーク
Internet
オンプレミス
DMZ
Backend Workload
Subnets クロスプレミス
接続
インターネット接続
DMZ
Subnet

28. Full Mesh
Redundant Paths
On Premises
Site5
BGP
On Premises
Site4
BGP
BGP
S2S VPN S2S VPN
VNet3
Central US
VNet1
East US
VNet2
West US
ASN 65050ASN 65040
ASN
65030
ASN 65020 ASN 65010

31. 受信規則
VIP1 80 → VM#1 80 / VM#2 80
VIP2 80 → VM#1 8080 / VM#2 8080

32. Valid request
SQL Injection×
XSS attack
× Application
Gateway
WAF
L7 LB
Site 1
Site 2

33. プロビジョニング
アプリケーションゲートウェイの作成
時に選択できます。パブリック、プラ
イベートのエンドポイントに対応。
Detection と Prevention モード
検知、回避モードが存在
リアルタイムモニタリング
WAF のログは Azure Insights に対
応しています。Azure Security
Center も、もうすぐ。
管理
Portal, PowerShell, SDK をサポート
Azure Security Center Azure Insights Storage
Application
Gateway
WAF
L7 LB

35. {
"resourceId": "/SUBSCRIPTIONS/78DE41BF-A912-48BE-B13A-
3C41FFA97DBF/RESOURCEGROUPS/TS2016-
APPGATEWAY/PROVIDERS/MICROSOFT.NETWORK/APPLICATIONGATEWAYS/APPLICATIONGATEWAY1",
"operationName": "ApplicationGatewayFirewall",
"time": "2016-11-01T01:11:19.7307545Z", "category": "ApplicationGatewayFirewallLog",
"properties": {
“instanceId”: “ApplicationGatewayRole_IN_0”, "clientIp": "187.161.16.56",
“clientPort”: 40928, “requestUri": "/command.php",
“ruleId”: “OWASP_981319”, "message": "SQL Injection Attack: SQL Operator Detected",
“action”: “Blocked”, "site": "Global",
"message": "SQL Injection Attack: SQL Operator Detected",
"details": { "message": " Access denied with code 403 (phase 2). Pattern match
"(?i:(!=|&&||||>>|<<|>=|<=|<>|<=>|bxorb|brlikeb|bregexpb|bisnullb)|(?:nots+
betweens+0s+and)|(?:iss+null)|(likes+null)|(?:(?: ^|W)in",
"file":"/owasp_crs/base_rules/modsecurity_crs_41_sql_injection_attacks.conf",
“line”:“70”} }
},

36. Azure Load Balancer Hierarchy
VM
ALB (L4 Load Balancer)
Azure Traffic Manager (DNS Load Balancer)
Internet
VMVM VM VM
ALB (L4 Load Balancer)
VM VM VM
Azure
Service
What Example
Traffic
Manager
Cross-region
redirection &
availability
http://news.com
 apac.news.com
 emea.news.com
 us.news.com
Azure Load
Balancer
In-region
scalability &
availability
emea.news.com
 AppGw1
 AppGw2
 AppGw2
Azure
Application
Gateway
URL/content-
based routing
& load
balancing
news.com/topnews
news.com/sports
news.com/images
VMs Web Servers IIS, Apache, Tomcat
App GW App GW App GW App GW

38. IPv4 Clients and Services
Azure VMs (IaaS)
Azure
Services &
Storage
Azure
Load
Balancer
Internet
Inbound
&
Outbound
IPv6 IPv4
IPv6
VIP
IPv4
VIP
Azure
VM
IPv6 Clients & Services
VMVM

41. C:Usersazureuser>ipconfig
Windows IP Configuration
Ethernet adapter Ethernet:
Connection-specific DNS Suffix . :
rhaznsxodwhubhh21falwftemb.mx.internal.cl
oudapp.net
IPv6 Address. . . . . . . . . . . : 2603:1090:d05:f4::644b:3e21
Link-local IPv6 Address . . . . . : fe80::703e:ed75:457:339d%12
IPv4 Address. . . . . . . . . . . : 10.0.0.4
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : fe80::662:73ff:fe57:e8b9%12
10.0.0.1
Tunnel adapter
isatap.rhaznsxodwhubhh21falwftemb.mx.internal.cloudapp.net:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
rhaznsxodwhubhh21falwftemb.mx.internal.cl
oudapp.net
Tunnel adapter Teredo Tunneling Pseudo-Interface:
Connection-specific DNS Suffix . :
IPv6 Address. . . . . . . . . . . : 2001:0:5ef5:79fb:c9:1fc4:f5ff:fffb
Link-local IPv6 Address . . . . . : fe80::c9:1fc4:f5ff:fffb%23
Default Gateway . . . . . . . . . :

44. 



48. Microsoft Tech Summit

49. 既存の Basic ゲートウェイでのER接続は 99.9%のSLAをサポートします。
なお、VPNはなくなりません。

50. ニュース抜粋
“ExpressRoute UltraPerformance Gateway is currently available in
the West Central US and Central US regions. It can be linked to
ExpressRoute circuits located in Chicago, Illinois and Dallas,
Texas.”
利用できるのは10/14現在で”米国中西部”及び”米国中央部”です。
ここにはシカゴ、イリノイ、ダラス、テキサスからの接続で利用できま
す。
https://azure.microsoft.com/ja-jp/updates/general-availability-
ultraperformance-gateway-tier-for-azure-expressroute/

51. ルートサマリ

52. Microsoft Tech Summit

58.  現時点では運用性の向上が大きな方向性。
 でも気を付けて。

60. Microsoft Tech Summit

61. https://azure.microsoft.com/ja-jp/blog/azure-networking-announcements-for-
ignite-2016/
https://azure.microsoft.com/ja-jp/documentation/articles/application-gateway-
create-gateway-arm-template/
https://github.com/Azure/azure-quickstart-
templates/tree/master/application-gateway-demo-setup

62. https://azure.microsoft.com/ja-jp/documentation/articles/load-balancer-ipv6-
overview/
https://azure.microsoft.com/ja-jp/documentation/articles/load-balancer-ipv6-
internet-ps/
https://azure.microsoft.com/ja-jp/documentation/articles/load-balancer-
multivip-overview/
https://azure.microsoft.com/ja-jp/documentation/articles/load-balancer-
multiple-ip/
https://azure.microsoft.com/ja-jp/documentation/articles/load-balancer-multiple-ip/

63. https://azure.microsoft.com/ja-jp/documentation/articles/virtual-network-
peering-overview/
https://azure.microsoft.com/ja-jp/documentation/articles/virtual-network-
accelerated-networking-powershell/
https://azure.microsoft.com/ja-jp/documentation/articles/virtual-network-
multiple-ip-addresses-powershell/
https://azure.microsoft.com/ja-jp/documentation/articles/virtual-network-
multiple-ip-addresses-portal/
https://azure.microsoft.com/ja-jp/documentation/articles/vpn-gateway-
highlyavailable/

64. https://azure.microsoft.com/ja-jp/documentation/articles/traffic-manager-load-
balancing-azure/
https://azure.microsoft.com/ja-jp/documentation/articles/load-balancer-
outbound-connections/
https://azure.microsoft.com/ja-jp/documentation/articles/guidance-ra-hybrid-
networking/