Download as PDF, PPTX
More Related Content
Similar to Networking deep dive
Networking deep dive
- 1. Networking Deep Dive Designyour Azure network in a secure way!
- 2.
- 3. Network Journey Basic Virtual Network in Azure Hybrid Connection withVPN Hybrid Connection with Express Route Secure Network
- 5. VNET Basics Design anddeploy your basic VNET
- 6. It all startswith a…. Azure subscription
- 7. Resource group It all startswith a….
- 8. Virtual Network Resource group It allstarts with a….
- 9. Resource group Virtual Network It allstarts with a….
- 10.
- 11. Specify DNS Serversin the Virtual Network • Hosted in an Azure VM • External • On-Premises (with hybrid connection) VMs are assigned specified DNS at boot. TIP: if DNS is added after a virtual machine is running, a reboot is required for assignment. DNS
- 12. Demo Creating A Basic Network DemoCreatinga basic network Demo 1
- 13. • A NetworkSecurity Group (NSG) is used to allow/deny traffic • Source/Traget configurable • Port configurable • Can be applied on a subnet work virtual network interface • No deep package inspection TIP: When deploying a NSG, make sure that you deny all traffic by default. Only allow traffic that is required. Network Security Group
- 14. •Does the followingsituation work? Question FrontEnd VM BackEnd VM Subnet 10.0.0.0/24 NSG 1. Allow port 80 2. Deny Any HTTP Port 80 App Port 8080 No - NSG traffic is always handled on the NIC of a VM.
- 15. Design – PerimeterNetwork
- 16. DEMO Applying Network Security Groups Demo CreatingA Basic Network DemoApplying Network Security Groups Demo 2
- 17. •A Network VirtualAppliance (NVA) can be used to control the flow of network traffic. • Firewall • Load Balancing • (Reverse) Proxy Network Virtual Appliance
- 18. Design – PerimeterNetwork with NVA
- 19. •Used to controltraffic flow • Mostly used to let traffic flow into a network virtual appliance User Defined Routes
- 20. Design – PerimeterNetwork with NVA and UDR
- 21. Service Endpoints •Connect PublicAzure Services to your VNET • More secure, internet access to the public service can now be disabled • At this moment available for: • Azure Cosmos DB • Azure SQL • Azure SQL Data Warehouse • Azure Storage (storage accounts and backup)
- 22.
- 23. DEMO Applying Network Security Groups Demo CreatingA Basic Network DemoService-Endpoints Demo 3
- 24. • Create subnetsfor: • Isolation (for Dev/Test) • Security (DMZ zone) • Create NSGs at least for every subnet (preferred for every network interface) • Only allow traffic to ports that is required for your service to run. • Use a Network Virtual Appliance to control the flow of network traffic Designing your Virtual Network
- 25.
- 26. Hybrid Connection (Hybrid) Connections Your connection toother networks and the on-premise site!
- 27. •Via VNET Peering •Connect at least two Azure Virtual Networks trough the Azure Backbone •Via VPN • Traffic is routed in a secure tunnel (IPSEC) over the internet to Microsoft Azure. • Can be used for site-to-site purposes but also client-to-site purposes. •Via ExpressRoute • Traffic is routed directly from your network to Microsoft Azure • A cloud connect provider/datacenter is required Available connection types
- 28.
- 29. Connection between VNETS •Uses Azure Backbone • Low latency • No need for gateways/NVAs • Does not exchange all routes • Only routes for the two connected VNETs are shared TIP: Global VNET peering is general available, but not for all regions. Check the regions first before deciding to use VNET peering globally.
- 30. Design Hub-Spoke with VNETpeering
- 31. Demo Creating a VPN connection Demo CreatingA Basic Network DemoSetup VNET Peering Demo 4
- 32.
- 33. VPN Connection • Threetypes: • Point-to-Site • Site-to-Site (IPsec) • VNET-to-VNET • Uses VPN gateways to establish connections • High uptimes (99,9%) • Various SKUs available with a different bandwidth, amount connections etc. • Almost no performance guarantees due to latency on the internet
- 34. Design – Multi-tiernetwork + VPN
- 35. Demo Creating a VPN connection Demo CreatingA Basic Network DemoDeploy a VPN connected network with ARM templates Demo 5
- 36.
- 37. •Connection via: • CloudExchange • Service Provider •Connection is secure/private •Performance Your Private Connection to Azure
- 38.
- 39.
- 40. Intranet Internet Azure Private Peering ForcedTunnelling DMZ/Extranet 0.0.0.0/0 xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx Design Forced tunneling with Express Route
- 41. Design Multi-tier network +ER + Fallback VPN
- 42.
- 43. SecuritySecurity Networking is oneof the first lines of defence
- 44. •Security starts inyour design • Assume breach •Use network components • Network Security Groups • Network Virtual Appliances •Security Center Security in your design
- 45. •Analyzes security health •Networkrelated recommendations • Add a next generation firewall • Route traffic through NGFW only • Enable NSGs • Restrict access through Internet facing endpoint Security Center
- 46. Demo Security Center Demo Creating ABasic Network DemoSecurity Center Demo 6
- 47.
- 48. Challenge • Create aHub-Spoke VNET topology • Deploy two VNETs • Connect them by using VNET peering • Deploy one VM in a spoke VNET • Deploy one VM in the hub VNET • Test the connectivity between the two VMs Win a ticket for Experts Live Netherlands 19 June, Cinemec Ede