Design and implement name resolution (AZ-700)

Shahrouz

As cloud network engineers, we should ensure that name resolution functions properly both in on-premises environments and public cloud infrastructure. As part of the AZ-700 Study Guide, this blog post will discuss the deployment of DNS service on Azure. It is vital to set up the DNS service because, like Microsoft Azure, we still need to resolve FQDNs to respective IP addresses on public cloud infrastructure. In addition, we might also need to utilize DNS to discover services. Microsoft Azure provides both public and private DNS zone for Internet and internal name resolution. There is also a built-in Azure-provides DNS that works by default on vNets, and if needed, there are custom DNS zones available to use.

Azure DNS in Microsoft Azure
Continue reading “Design and implement name resolution (AZ-700)” →

Design and implement private IP addressing for VNets (AZ-700)

Shahrouz

The previous AZ-700 Study Guide blog posts covered Site-to-Site VPN, Point-to-Site VPN, and Azure ExpressRoute. In this post, we will explore private IP addressing in Azure Virtual Networks(vNets). The fundamental building block of private networking in Azure is based on vNets. This construct is a Layer 3 networking construct and has CIDR-block attached to it. This CIDR-block represents the private IP address space that network components can use on your Azure infrastructure. Proper design and implementation of this private IP addressing are crucial due to its effect on all other networking design decisions and deployment in Azure.

Continue reading “Design and implement private IP addressing for VNets (AZ-700)” →

Design, implement and manage Azure ExpressRoute (AZ-700)

Shahrouz

In two previous posts, we covered Azure Site-to-Site VPN and Point-to-Site VPN. The next objective of AZ-700’s Hybrid networking is designing and deploying Azure ExpressRoute. ExpressRoute is a method to extend your On-Premises network into the Microsoft cloud with the help of ExpressRoute service providers. If you need a private/high-speed connection to access Microsoft cloud services like Azure or Office 365, ExpressRoute is the right solution. This connectivity method doesn’t use the public Internet, and thus it provides higher security, more bandwidth, and higher reliability than Site-to-Site VPN. Many organizations want to avoid public Internet for cloud extension in terms of networking, and here is where ExpressROute could shine as the proper solution. The private connection is provided by specific connectivity partners, and based on your location; you have few options to choose from.

Diagram som visar hur ExpressRoute-kretsar ansluter din lokala infrastruktur till Microsoft via en anslutningsleverantör.
Continue reading “Design, implement and manage Azure ExpressRoute (AZ-700)” →

Design, implement and manage a Point-to-site VPN connection (AZ-700)

Shahrouz

In the previous blog post, we covered Azure Site-to-Ste VPN. As part of the Azure AZ-700 Study Guide, this blog post continues with another hybrid networking technology that allows client endpoints to connect to Azure vNet infrastructure. Besides connecting your headquarter and branch office networks to Azure, it is also vital to have an infrastructure to provide connectivity to your mobile users. Using Point-to-Site Virtual Private Network(P2S VPN), client endpoints can connect and use Azure services. You can implement P2S VPN on Route-based Azure VPN gateways and provide a secure connectivity option to your users.

Continue reading “Design, implement and manage a Point-to-site VPN connection (AZ-700)” →

Design, implement and manage a site-to-site VPN connection (AZ-700)

Shahrouz

Design and implement a hybrid networking infrastructure is part of every cloud adoption project. Organizations planning to embrace public cloud services and migrate resources to Azure usually need communication channels between the on-premises environments and Azure. One of the widely used technologies that provide the required communication channel is Site-to-Site Virtual Private Network (S2S VPN). To deploy such a communication channel, you will set up a VPN IPSec tunnel between an On-premise gateway and Azure VPN gateway. As part of the Azure AZ-700 Study Guide, in this blog post, we are going to explorer Azure S2S VPN

Continue reading “Design, implement and manage a site-to-site VPN connection (AZ-700)” →

AZ-700 Azure Network Engineer Study Guide

Shahrouz

A few days ago, Microsoft introduced a brand new certificate titled Azure Network Engineer Associate. Since networking is one of the core elements of any cloud infrastructure, it is crucial to educate the Subject Matter Experts in planning, implementing, and maintaining Azure networking solutions. AZ-700: Designing and Implementing Microsoft Azure Networking Solutions exam should be taken and passed successfully to achieve this certificate. As a firm believer of certification programs and someone who has been working in the IT industry for quite a long time, I would recommend taking the training and AZ-700 exam to those who work with Azure networking. The reason behind believing in the certification programs is you will learn the required concepts based on a proven learning framework.

Continue reading “AZ-700 Azure Network Engineer Study Guide” →

Critical vCenter Server Vulnerability – Patch Immediately!

Sadaf

On May 25, a critical vulnerability reported which affects vCenter Server 6.5, 6.7 and 7.0 and VMware Cloud Foundation 3.x and 4.x. With access to port 443 of vCenter Server, an attacker may exploit this issue to execute commands with unrestricted privileges on the operating system that hosts vCenter Server.  This issue arise because of lack of input validation in vSAN Health Check plug-in.

Continue reading “Critical vCenter Server Vulnerability – Patch Immediately!” →

NSX-T Distributed Firewall – Part 1

Sadaf

Before jumping to NSX-T Distributed Firewall (DFW) concept and rule creation, I want to point out why this solution is important and what security issues can be addressed by using this powerful solution. Building a zero trust model security has been the biggest concern of network and security teams. In traditional data centers, high-level segmentation is built, which could help to prevent various types of the workload from communicating. But the main challenge of the legacy security model is data centers facing a lack of lateral prevention communication system between workloads within a tier. In other words, traffic can traverse freely inside a network segment and access the crucial information until it reaches the physical firewall to get dropped. In addition, implementing different layers of security and firewalls would cause complexity and cost.

NSX-T Distributed Firewall (DFW) is a hypervisor kernel-based firewall that monitors all the East-West traffic and could be applied to individual workloads like VM and enforce zero-Trust security model. Micro-segmentation logically divides department or set of applications into security segments and distribute firewalls to each VM.

Continue reading “NSX-T Distributed Firewall – Part 1” →

vCenter Server 7.0 HTML5 UI error “no healthy upstream”

Sadaf

After upgrading to vCenter 7 Update 1 , when I tried to browse vCenter HTML5 UI, I faced “no healthy upstream” error. I could access to vCenter Management Interface (VAMI) https://vCenter-IPaddress:5480 without any issues. I could also connect to vCenter Server through  SSH but I realized couple of vCenter Server services could not start.

Continue reading “vCenter Server 7.0 HTML5 UI error “no healthy upstream”” →

Site-to-Site VPN between NSX-T and Azure VMware Solution – Part 2

Shahrouz

In the previous blogpost we went through Azure VMware Solution(AVS) IPSec VPN setup and to complete hybrid networking between on-prem and AVS we need to configure NSX-T gateway too. As we discussed the target architecture would look like the following diagram.

Continue reading “Site-to-Site VPN between NSX-T and Azure VMware Solution – Part 2” →