3. Cameras / Alarms
24X7 security staff
Barriers / Fencing
Days of backup power
Two-factor access control
Secure By Design
Operation Security Controls
Compliance Certifications
Forensics
Penetration Testing
Secure and Isolated VNets
Network ACLs
Azure Active Directory
Multiple virtual NICs
Security Appliances
Physical Infrastructure
Network
Anti-Malware
VM Security Extensions
Role-Based Access Controls
Key Vault and Encryption
Logging / Auditing
VM
4. The focus of this section is on Microsoft’s IaaS capabilities, which in large part consist of
storage, networking, backup and recovery, large scale computing and traditional virtual
machine deployments
5.
6. Azure Virtual Machine
C:
OS Disk (127 GB)
E:, F:, etc.
Data Disks (1 TB)
D:
Temporary Disk
(Contents can be lost)Disk Cache
7.
8. Azure Storage Page Blobs, 3 copies
High durability
VHD disks, 1 TB per disk (64 TB total)
500 IOPs per disk
9. West DCEast DC > 400 miles
Defend against regional disasters
Geo replication
Virtual Machine Storage
12. Azure VM
SMB 2.1
Shared settings, diagnostic share
Lift and Shift Applications
Azure VM Azure VM
13. Up to 32 TB of storage per VM
64,000 IOPS per VM
50,000 IOPS per disk
~5 ms read/write (no cache)
less than 1ms read latency (cache)
Great for data warehousing solutions
18. When deploying applications and solutions using Microsoft Azure Virtual
Machines, there are various sizing configurations that are available to
organizations. From a sizing perspective, each sizing series represents
various properties such as:
• Number of CPUs
• Memory allocated to each Virtual Machine
• Temporary Local Storage
• Allocated Bandwidth for the Virtual Machine
• Maximum Data Disks
43. Image Families
• VHDs managed and supported by Microsoft. Some
may include pre-installed software and configuration.
Partner Images
• VHDs uploaded by partners for application
consumption by the Azure customer. VMs deployed
using partner images are not deployed on the same
cluster or clusters as other VM workloads.
Latest Images
• Images are kept as versions in Azure. Typically, you
would want to choose the latest image.
Customized
Images
• Customer uploaded VHDs to leverage their own
images. This is due to internal security, standard costs,
and licensing scenarios.
47. Affinity Groups (v1)
• Not enabled for CSP
subscriptions
• Places compute and storage of
a given VM, always together
close to one another.
• By ensuring the VM’s resources
reside in the same cluster,
latency is reduced and
performance is increased.
Resource Groups (v2)
• Unit of management for
operations like deployments,
updates, and standard lifecycle
operations across a number of
different services, such as VMs.
• Enables the creation of a
reusable deployment templates
to handle infrastructure
configuration as code.
48.
49.
50.
51. Cost
• Size and number of Virtual Machines
• Azure Virtual Machine Storage Requirements
• Azure Virtual Network and VPN services
• Network Traffic out of Azure
Network
• Decide on Name resolution: Azure-based or own DNS solution
• Virtual Network overlay for enhanced security and isolation
• Extension of the on-premises network to the cloud
• Number of persistent private IP addresses required
Limits
• AutoScaling for increased or decreased load is different than PaaS
• VMs are not load balanced by default
• VM density per Vnet (currently 2048)
• Concurrent TCP connections for VMs roles (500K)
52. One of the primary considerations when constructing
solutions
Cost factors
The high level cost model and measurement (e.g. Cost
per hour for virtual machines)
Cost drivers
The unit level costs and design decisions which impact
costs (e.g. The number of active virtual machines
required, or the type of storage utilized.
53. Budgeting consumption vs. traditional IT investment
The shift to consumption budget planning is challenging
Current IT spend does not consider this model
Azure IaaS migration is not always 1:1
Current model is to “over-purchase” for on-premises solutions
Simplistic review of the existing infrastructure does not accurately reflect the
expected Azure footprint “right-size”
Consumption budgeting requires a shift in thinking
Shift thinking towards understanding utilization and scaling
Focus on initial deployment followed by incremental growth
Take advantage of the elasticity of Azure services as part of transition
55. Getting Started with Azure IaaS
Azure IaaS – proper sizing and cost
Deciding between different VM sizes
Architecting Enterprise grade linux solutions on Azure IaaS
Hybrid Networking options on Azure IaaS
Running enterprise applications on Azure
Editor's Notes
Bryon
Let’s talk about the various pieces that makeup Azure Iaas.
We’ll start with storage.
Bryon
When you look at the deployment of storage. A normal VM that gets deployed gets 2 disks right off the bat. For Windows you get your c:\ which has a cache attached to it and a d:\ drive which is temporary. You do not want to put anything critical or stateful on the d-drive – it is ment to be temporary and not designed for persistent storage.
The C-Drive end up being backed by Azure blobs. These are just your standard blobs in Azure. If you attach any additional data disks – these are also backed by Azure blobs.
Up to 64 1TB disks attached to a single system
Because these are backed by Azure storage. We end up doing triplicate copies of everything. So every write that is made to the storage is triplicate copied onto the machines before we come back and say its done. This gives you that high durability that Azure storage promises.
1TB per disk and we allow for up to 64 disk. Striped.
500 IOPS – 32,000 IOPS total
This is for standard spinning disk. You may have also heard that we are now offering premium storage which is based on SSD disks. Premium storage bumps up the maximum IOPS quite a bit and we’ll be talking about that in a few minutes.
Bryon
So another aspect that you get free out of Azure storage is Geo-replication. Just by flipping this on, you can actually geo-replicate across regions to help safeguard against regional disasters.
What’s also interesting is that the geo-replicas can be read-accessed. So you can get access to the replicated data, to validate the data, make sure they look right. You can even pull them aside and do testing against them and you can even do BI against the data without disrupting the content. This is all possible using the geo-replication feature in Azure Storage.
______________________
Additionally, data is asynchronously copied to another datacenter that’s at least 400 miles away.
So you can be sure that every piece of data that you store in the Azure Blob is available as well as protected against regional disasters (we call this geo-replication).
Geo replication is a unique feature, that differentiates us from competition.
Here is a map that shows the geo-replicated regions. One of our goals is to keep the data within geo-political zone of the datacenter that you’re deployed to. So you can see, for example that in Europe, the data that is replicated stays in Europe. There is no replication back to the United States or anywhere else. This can be very important for legal and governmental requirements as well as compliance requirement for certain industries or businesses.
1 other thing that is very cool that you can use on these virtual machines is just attaching an SMB Share. So you can go ahead and add an SMB Share that you created using using Azure Files which gives you the ability to have even more disks.
This is using SMB File System 2.1. And with SMB File share, it allows you to connect multiple VMs to the same file share. So any use case where you need multiple VMs to gain access to the same data applies here which could include a single location for diagnostics, shared settings, or an application installation repository. A location where you store data to be used by lots of different VMs. For a lot of cases it can also be that you just want to add more disks. So as your developing your applications and you need shared storage across multiple VMs, this provides you that functionality all built-in.
So as I alluded to earlier and as you’ve likely heard, we’ve announced Premium Storage.
This allows up to 64TB of storage per VM
When using the read-cache, you will see less than 1ms read latency. For writes or reads that are not using the read-cache, we are seeing latency of less than 5ms.
So to do this, it uses local SSDs that are in the physical box for caching. We built a very sophisticated caching system to try to speed up the reads you have for your virtual machines.
This has been a big request by lots of customers who have high I/O requirements and for you developers who need the fastest storage possible – Premium storage is now available. A lot of people wanting to do large data wharehousing solutions where you have lots of reads with maybe fewer writes. It enables much better performance on those type of solutiosn.
Bryon Surace
Newer generation CPU
Other than 19, the a-series VMs goes up to 56, and the d-series goes up 112
Local SSD for cache- not for persistent data
Bryon Surace
So when you’re creating and deploying your application, you want to consider High Availability.
SQL is the example but it works on Linux as well
Bryon Surace
The biggest points of failure are
Physical Machine
Power Unit & Network Switch
Bryon Surace
High Availability Sets are great – it protects you against physical hardware failure
However, it doesn’t do a lot of good if you can’t control the networking traffic across those virtual machines.
Run what you run in your data center…
At the scale you never thought possible.
With Hybrid connectivity and trusting our Enterprise Grade Security and Compliance, for those workloads that make sense, take off the shackles.
Bryon Surace
Client Affinity – isn’t a full layer7 swtich
Bryon Surace
Bryon Surace
Bryon Surace
Auto-Update
Avoids security implications of “reaching out”
Allows trusted and maintained partner packages
Enables partners to support ALL platform images
Creates partner and customer consistency, on-prem and in the cloud.