Month: August 2021

HCX Enhancement for Azure VMware Solution

Shahrouz

Earlier this month, VMware released a new version of HCX, the powerful multi-cloud migration solution. With the help of HCX, you can easily migrate your virtual workloads between private clouds and, more importantly, to public cloud environments like Azure VMware Solution(AVS). Additionally, when HCX is being used in conjunction with public cloud SDDCs like AVS, cloud migrations would be as easy as running a vMotion internally inside your data center. Sounds great, isn’t it!

""

It is also important to note that many enterprises are using only site-to-site VPN as the connectivity method for on-prem to public cloud infrastructure. Because of this, formal support of HCX over VPN underlay has been asked by many organizations and customers.

Continue reading “HCX Enhancement for Azure VMware Solution” →

NSX-T FQDN/URL Filtering

Sadaf

NSX-T Distributed Firewall (DFW) is one of the most comprehensive solutions to provide micro-segmentation from layer 4 to layer 7. It can monitor all the East-West traffic on your virtual machines and build a Zero-trust model. To leverage the DFW, vNIC of virtual machines need to connect to NSX-overlay segment, NSX VLAN backed segments or vDS port group supported from vSphere 7.0. The benefit of using DFW is that firewall rules apply at the vNIC level of virtual machines. In this way, traffic does not need to traverse to a physical firewall to get identified if the traffic can pass or drop, which is more efficient. This article will focus on using DFW to enforce L7 (FQDN/URLs) filtering.

https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcRZKbXr1N2xyg1LZSgLbAcyotp7o28mhU6gnA&usqp=CAU

You can give internet access to a VM or a user who login to a VM by Identity Based Firewall or even take one step further and control which specific URL/URLs are allowed to get accessed.

Continue reading “NSX-T FQDN/URL Filtering” →

Design and implement name resolution (AZ-700)

Shahrouz

As cloud network engineers, we should ensure that name resolution functions properly both in on-premises environments and public cloud infrastructure. As part of the AZ-700 Study Guide, this blog post will discuss the deployment of DNS service on Azure. It is vital to set up the DNS service because, like Microsoft Azure, we still need to resolve FQDNs to respective IP addresses on public cloud infrastructure. In addition, we might also need to utilize DNS to discover services. Microsoft Azure provides both public and private DNS zone for Internet and internal name resolution. There is also a built-in Azure-provides DNS that works by default on vNets, and if needed, there are custom DNS zones available to use.

Azure DNS in Microsoft Azure
Continue reading “Design and implement name resolution (AZ-700)” →

Design and implement private IP addressing for VNets (AZ-700)

Shahrouz

The previous AZ-700 Study Guide blog posts covered Site-to-Site VPN, Point-to-Site VPN, and Azure ExpressRoute. In this post, we will explore private IP addressing in Azure Virtual Networks(vNets). The fundamental building block of private networking in Azure is based on vNets. This construct is a Layer 3 networking construct and has CIDR-block attached to it. This CIDR-block represents the private IP address space that network components can use on your Azure infrastructure. Proper design and implementation of this private IP addressing are crucial due to its effect on all other networking design decisions and deployment in Azure.

Continue reading “Design and implement private IP addressing for VNets (AZ-700)” →