Microsoft Azure Training - [9] Azure Virtual Networks - Part 3 (Exam 70-533) Video Lecture | Microsoft Azure: A-Z Guide - Database Management

hi everyone this is Sean yzma from the
cloud Ranger and you are viewing the
Microsoft as your training today we are
going to watch the part three of the
zero virtual networks and we are going
to talk about the affinity groups as
well as the azure DNS so let's get
started so what are affinity groups you
will see a lot of documents and a lot of
blogs and even certain MSDN articles
where they refer to happen affinity
groups when they talk about resources on
Microsoft to zero so what affinity
groups are is that it's a logical
grouping of resources such as cloud
services or in virtual network virtual
machines storage and takes in a zero and
what it basically does is that whenever
you create something on a zero for
example a virtual network machine cloud
services it tries to put them very close
to each other when it comes to physical
proximity let me elaborate that a little
bit so in our very first videos if you
recall when we are giving an
introduction to Microsoft Azure what we
had talked about was that anytime you
create something Microsoft has several
locations or regions right they have
data centers and you basically choose a
location that's closest to you and you
create your resources on Azure so for
example in my videos I have always been
picking up on East us two as my location
where I create all my resources you
probably are using something that's
closest to you
so we do not know the how many data
centers are there in a single region
depending on wherever it is Microsoft
may place your resource in one data
center in that location and that's how
you have your resources
problem with this is for example if you
create two or three virtual machines you
will find out for example in East us two
it may place these two or three virtual
machines in separate data centers or it
may put it in the same data center far
from each other where the physical
cluster is for creating these resources
or hosting this resources this may
create some latency and very maybe not
that significant but it may be a little
bit more amplified if if we are trying
to attach a storages or if we are trying
to release a to attach a storage means
virtual disk and as such on a single
region or a single location so for
example a virtual machine requires
couple of things right it requires
computing it requires virtual networks
and it obviously requires the storage so
if you are creating these three things
separately so you create the virtual
network and it's created on one node of
a cluster and you create a storage which
is probably on another note offical in
that storage subsystem and you create
the virtual machine it will put them
together but they may not be very close
to each other in physically in the same
data center or maybe they are not even
together in the same data center while
they will work but this is more of an
efficiency concern and performance
concern than anything else so Microsoft
came up with a plan they said that if
you create an affinity group which is
tied to a region what what it will do is
that when you create the virtual machine
or any cloud services or resources it
will physically keep them close to each
other as much as possible so it will try
to put it on the same rack or in the on
the same cluster or close by each other
where they will be very very efficient
performance wise so it was a very good
idea and it was defined at a
subscription level so you will create a
affinity group at a subscription level
and we'll go through this momentarily in
our demonstration and like I said it was
tied to it
so this seems like a good idea the rate
I mean you're keeping things together
and you're going to have great
performance but Microsoft is actually
deprecating this in favor of regional V
nodes what does this mean well what
Microsoft recently did and I did a
little bit of a research on this one
what they recently did is they sort of
overhauled their entire networking
system or their regional networking
systems where it did not matter any
longer
if these resources were close together
or not so if you are going to have
similar performance doesn't matter which
part of the data center you where
physically located for your virtual
machine or a storage it wouldn't matter
to have them together and the other
problem that Microsoft was having was
that they were creating virtual machines
we did not go so much into virtual
machines but they were creating this
virtual machines with hardware
specifications who are not close to each
other in the data center so when you are
trying to mix match a bunch of resources
together with certain virtual machines
this whole affinity group thing was not
working out so Microsoft sort of
overhauled their internet working and
their infrastructure we're being close
to each other or not being close to each
other did not matter performance wise
and that's one of the biggest reasons
they're trying to get away from this
whole affinity groups and this is also
one of the reason I have not been
demonstrating or doing anything with the
affinity groups because it's no longer
mandatory in fact a few months ago when
you created a virtual network you had to
be part of an affinity group but as you
can see when we created virtual network
there was no no place where we went and
selected an affinity group or even
created one so this brings another
concern some of you may have already
created virtual networks when it was
required to be part of an affinity group
and a lot of these people they might
think that hey now that regional virtual
networks are there can
convert this virtual networks to a
regional virtual network well for now in
2015 so far in the first quarter there
is no way you can do that and in fact
Microsoft says in their msdn site that
they will update at one point everybody
from an affinity group to a regional
virtual network but there has not been
any details so far maybe they'll be
having one in the future and by the way
the term when we say regional virtual
network it basically means a virtual
network that's assigned to a region or a
location which is almost something you
have to do always like anytime you
create a virtual network it has to be
connected to a region so if you see
somewhere it says regional virtual
network just think of it as a virtual
network because it's no different all
the virtual networks that we've created
are by default called a regional virtual
network or just that I mean there is no
other configuration that you have to do
it's just the Microsoft change the
terminology in-between and started
calling this region of virtual networks
okay so let's go ahead and have a
demonstration on how to create one of
this okay I'm on my client computer as
you can see I'm logged into my
subscription this is the management
portal and what we are going to do as I
mentioned in an affinity group is
actually created at the subscription
level so we are going to go to settings
and you can see a tab here called
affinity groups and it actually says
that you have not created any affinity
groups so we are going to add an
affinity group here so I'm going to just
call this C Ranger AG for affinity group
and as you can see this affinity groups
was tied to a region so I'm going to
pick one for myself here go pick the one
that's closest to you obviously and
click click ok and takes like few
seconds to actually create this as you
can see it was relatively quick so go to
click ok so now I'm going to go through
the demonstration of what
we could do with definitely groups and
where it is still required or it's an
option so let's go ahead and create a
network when we create a virtual network
I do not have any you can see it does
not even give you an option to associate
this with an affinity group so if I
create Ranger debt as my Ranger net as
my virtual network I'm going to select
east USA - so I'm associating this to a
region or a location this is exactly
what Microsoft calls a regional v-net or
regional virtual network you are
associating a network with the region
click Next we are going to leave this
all as default there will be no changes
here I'm going to do 192.168.10.0 it's
going to be 16-bit I'm going to do 1.0
and I'm going to make this 24-bit subnet
mask so I get this range give everything
else default keep the name as subnet 1
and we are going to let this vennett get
created so as you can see that for
creating a virtual network you did not
require even an affinity group so let's
go ahead and try something else right
now another resource let's try to create
a virtual machine and I'll show you this
again compute virtual machine if you try
to do a quick create you can see over
here there is a region and affinity
group that you can select from here so
since we have an affinity group created
it's actually allowing you to create a
virtual machine which is associated with
this affinity group and this affinity
group as you know is similar to having
this as in East us - we're just saying
that keep everything together as
physically close to each other as
possible and from the gallery I would
not do a quick rate I'm going to show
from the gallery where we'll be spending
most your time creating virtual machines
let's just call this test 2 p.m.
whatever I'm not going to go that far so
I'm going to pick an image over here
random whatever let's fire in all this
information we are not going to create
this virtual machine but I want to show
you where the Infinity group came in
over here so as you can see over here it
says region affinity group and virtual
network so you could go and put this
virtual machine from this virtual
machine to an affinity group directly
obviously we have been doing this we
have been putting this on the same
virtual network so you could do the
affinity group Association from here as
well so I'm going to cancel this out
let's move to cloud services so I'm
going through all the services that we
have created previously to show you that
what we can do compute cloud service
click create so if you put whatever
cloud services I'm just putting a random
name as you can see it's giving you that
option to put this in an f50 group as
well so these are the places and there
are more places like for example if you
create a storage account we never really
talked about it yet we'll be doing this
in future session you could create a
storage account and put that into an
affinity group as well our we could use
affinity groups a lot for our sessions
over here probably not I'm not going to
put anything in a finiti group if I
don't have to because Microsoft is
getting away from it there's no specific
reason to do this any longer but it is
is still part of the 7533 exam so there
might be questions based on that so
we're just going over that but for our
practical and demonstration purposes
will most likely not be there doing
anything with the affinity groups so
that's all that is to there with
affinity groups I cannot think of
anything else that may come out of that
besides that for
infrastructure-as-a-service
you will not need it I think there are
people who still do the platform
as-a-service so if you're doing a cloud
services with your worker and resource
roles the developers might want to use
the affinity groups for whatever good
reasons they may have but for for our
infrastructure as a service
I'll not be using that too much
okay so let's move on to the next topic
for today the next topic is DNS so when
we talk about DNS and do everything
today we are talking about the internal
DNS these are not the external DNS
servers so when we showed up in the
previous part in part 2 when we talked
about the big picture we talked about
that vibe and the cloud app net the
Public DNS this is not that this is the
internal DNS that is used for hostname
resolution so what is there really to
talk about so a couple of things when
you create a network you are given an
option to put in your own DNS
information if you do not put your own
DNS information as your actually
provides name resolution for you so if
you are used to a network like for
example if you have your own domain you
would have an Active Directory and you
would have a DNS server for Active
Directory obviously so any computer that
you join to a domain is part of the DNS
and all the name resolutions work out in
here so far all the virtual machines we
have created we have not put them or
joined them to any domain so there's no
DNS server that we even put in when we
created a virtual network so as you said
that it is going to provide the network
name resolution for us and that's
exactly what's called as your provided
template solution however there are
certain limitations and that's what this
and this is why this is very important
when you create a virtual network and
you are not providing a DNS and as you
are seeing we are providing the name
resolution it is only providing the name
resolution when you are in the same
cloud service so what do I exactly mean
by that so let me grab a pen real quick
here when you create a virtual machine
and so far the ones we have created
every time we created a virtual machine
it gave us the option to create a cloud
service with that virtual machine so we
know that every virtual machine will
have a cloud service the cloud service
will contain a virtual machine and
looking at our previous lab a previous
session you know that a cloud service
could have multiple virtual machines in
it as well but so far we have just done
that that we have created a virtual
machine and we have always had a
separate cloud service as your does not
provide name resolution between these
two virtual machines if they are part of
the live DEP if they have their own
cloud services so Azure says that we can
only provide name resolution if they're
in the same cloud service so this would
be the scenario there's one cloud
service and there are two virtual
machines in there means these two hosts
will be able to resolve or use the as
your provided name resolution to look
each other up and there was very good
reasons for doing that but that's by
design and in our demonstration that's
exactly what we will do is that we will
try to create these two scenarios and
see the name resolution if it's possible
or not so what do you do well if you
have a scenario like this you'd actually
have to put your own DNS server in here
what that means is that you'd have to
for example create a DNS server and let
this let there be DNS entries in there
which will basically resolve these two
host names to its IP addresses this
would actually be very simple if you
actually have an Active Directory forest
here so you have an Active Directory
domain and you have your DNS server and
you will join this to to the domain
controllers and join the domain
basically and the DNS entry will always
be there for you to resolve each other
by hostname
that one's one way to do this and when
you create the virtual network that's
why it gives you that option to put that
DNS server in there to do that besides
that if they have their own cloud
services they cannot resolve each other
by hostname and if you actually have
them in the same cloud they'll obviously
be able to do this so across the cloud
services you will have to have your own
DNS server in the virtual network for
the name resolution to work so let's go
ahead and work this out in a
demonstration this is the first one I'll
do I'll create a sea Ranger VM one
hundred and two hundred and I'll keep
the same cloud service name for each for
both of them but there will be two cloud
services and what we will see is that
this two will not be able to look each
other up based on their hostname because
the azure provided name resolution is
not going to work in this scenario so
let me go ahead and log get into our
management portal and create two virtual
machines okay we are in our management
portal I do not have anything here
except the virtual network that we had
created so let's go to a virtual machine
here and create a virtual machine and by
now if you have followed most of my
sessions you will be quite used to
creating virtual machines from this
portal so the first one we are going to
create is going to be C Ranger VM 100
I'm going to just pick an image for that
let's put in all the counter information
as you can see I'm going to do a create
a cloud service if I do a drop down I do
not have any cloud services created so
it will create one while this virtual
machine is being created and it's going
to name it the same as the virtual
machine name you could actually have a
different name over here as we have
discussed this before but it will be the
same and for our purposes let's leave it
like that we will join the same virtual
as you can see that the affinity group
we had created is still there I did not
delete it so we are going to just use
the Ranger net virtual network that we
had created and we are going to create
that virtual machine let's go ahead
create the second one and if you are
following along follow along and do the
same so we're going to call it sea
Ranger VM to 100 and we'll pick same
image size oops I will create a new
cloud service and algorithm this one sea
range of VM - as you can see that this
already is different right so these are
that they are going to have their own
cloud services that's what I mean okay
so let's do that and that so as you can
see they have their own DNS names here
because it's picking that up from the
cloud service name right so if we go to
cloud services I think one of them is
already created it's you can see that's
deploying
the cloud service you render VM 100 so
I'm going to pause this and come back
when all of this are actually done so I
think I made a mistake over here as you
can see it went and rather than picked
up the virtual network I went and picked
the location so this is not going to
work for us so what I'll do is I'll
actually when this gets provisioned I'm
going to delete this virtual machine and
I'm going to create the C range of VM
200 again and I'm going to make sure
that it's part of the same virtual
network so it actually has it is going
to be on the same location okay so let
me pause that and get back okay so it
took about 10 minutes to actually get
all of this up and running as you can
see I fixed us arranger VM 200 it's now
in the same variant and therefore it's
in East us too and this
VMS and we can see there are two virtual
machines I've been to cloud services
that were created with two separate nips
so this satisfies all our requirements
here this is the network topology is
using right now
so I'm going to RDP into these two
machines and once the desktops come up
it takes a it takes few seconds to
actually for everything to happen so I'm
going to do this offline I'm going to go
ahead and connect to these two virtual
machines and I'll be back once they have
all the desktop access ready okay so I
have our GPD into those two virtual
machines arrange your VM 100 and 200 and
they have opened to the server manager
okay let's see over here alright so we
are ready so let's go ahead and do the
first thing out suggest that you do not
do this in production box because by
default as soon as you created this
virtual machines they are accessible
through certain endpoints from the
public domains or the public internet so
what I'm going to do right now is
actually going to turn off the Windows
Firewall to demonstrate certain things
or ICMP s
that we will send to resolve the host
names another way you could do this is
actually create fire one exceptions but
for the sake of time and ease I'm going
to just go ahead and disable them for
now
and you would need this for the pinks to
happen okay so let's go back to 100 here
okay open up the console so we are now
on see Ranger VM 100 and we are going to
go we have the IP Attis 101 6 8 1.4 so
we are going to try to reach now see
Ranger VM 200 and the way we do that is
ping one nine two one six eight dot one
dot five I believe was the IP address
right when it one six eight 1.5 okay so
let's try one nine two one six eight 1.5
and see if we get it through as expected
the other on the same virtual network so
we can get through let's go ahead and
try now reaching them by their host name
so it will be C Ranger VM two hundred
let's see why what do we see here okay
so ping request could not find the host
C Ranger VM two hundred that's because
if you look into our slide here we
mentioned that there is no way this ping
or this host name resolution would
happen between these two virtual
machines big because they are sitting in
their own cloud service and the only
time as you're provided dem resolution
works is it's when it's within its own
cloud service means these two virtual
machines would be sharing the cloud
service so we cannot resolve the
hostname from this virtual machine to
get to see Ranger VM 200 so similarly
when we go to cm C Ranger VM 200 we are
going to do ping 192 if I can spell
correctly 192 168 1.4 and as you can see
we can reach seed engine VM 100 but when
we do ping si Ranger VM 100 by name
means we are trying to resolve it
you start going to find it so that's by
design and that's what I meant when I
said that for the building as your DNS
twerk they need to be on the same cloud
service and the only way this can
actually be fixed is if you actually
have your own DNS server that you bring
in to this virtual network and it does
the name resolution for you between
these two virtual machines even though
they are across two cloud services and
ideally the easiest way to do that and
in most production what will happen is
that your virtual network will probably
have a Active Directory forest so you
will have a domain controller you'll
have a DNS these virtual machines
currently are not on a domain so they're
standalone computers but you will in
production most likely have your virtual
machines part of a domain and join to a
domain so they will be able to register
their DNS in your DNS server and resolve
each other across the cloud
otherwise the wolly option for doing
this would be being in a single cloud
with two virtual machines that will have
a demonstration for that as well but I
want to show you something interesting
before we go that far let's do I P
config slash all and you can see that
our range is 192 168 0 0 16 or 1.0 to
1.55 but if you look at the default DNS
server that as your has provided us
you'll see it's an S 0 provided DNS
server ok so let's do this some of you
already might know that because what we
do is sometimes in our network
environment if you have an IP address
but you want to know the hostname you'd
use a specific switch to do that so if
you use ping with - a it will take the
IP address and resolve it and give you
the hostname so we know that from here
we can't go to sea ranger vm 200 right
but we could go to its IP address so we
could do one eight oh one six 8.1 or
five it's expected this is the
demonstration we just had what I thought
of doing was ping - a and do 192.168.1.5
and what I found out is that when you
try to look up this address you can
actually look it up and you can find out
that it is picking up the host name
entry associated with this IP address
here which is interesting because when I
do ping si Ranger VM 200 by name it's
not finding it but when I take the IP
address and do it resolving it's finding
that I have no idea of why it's doing
that I could not find any document
regarding that if you know do let me
know if you find out somehow that why
this behavior happens leave it on the
comments and let everybody know but for
now I do not know why it's doing that it
seems like it can look up that when you
look up through an IP address but the
other way it just can't so by name to an
IP address it's not doing that it may be
a limitation that has been put by
Microsoft Azure to make sure that you
know the DNS resolution does not happen
between two cloud services across cloud
services for a very good reason but I'm
just not aware of why this but otherwise
just for your exam purposes and knowing
it you just have to remember when they
are part of not part of the same cloud
service they will not be able to resolve
each other by name so what I'm going to
do is now set up this environment here
where these two virtual machines will be
part of the same cloud service I'm going
to go ahead and delete all the stuff
that we just created so let's let's get
out of this article session because we
will be creating new ones I'm going to
pause mostly through this creation here
just to save some time but basically
what I do is I go and delete
everything that is associated with this
virtual machine so by the time we come
back accept the virtual network there
will be nothing so I go manually and
delete all of this so if you are going
to do that please go ahead and do that
as well and if you are running on a
trial like I mentioned you want to save
resources as much as possible so you
want to make sure that there's nothing
here except the virtual network for the
next for the next demonstration or for
all the demonstrations actually there is
a script that you can run to do this I
might post that scrape some time I'm
still fixing tweaking couple of things
on the script what it will do is after
every time we do one of these
demonstrations you can run that script
and it will clear everything for you and
bring it on a clean slate as if it's a
new subscription obviously do not run
that in your production because it will
most likely build everything in the
production as well but then I'm
expecting that when you are doing this
demonstrations you are doing this on a
trial account or a personal account
which is not on your production so I
will be right back after all this is
cleaned up okay so I have mostly deleted
everything except the virtual network
that we had here so the scenario that we
are going to follow is this one right
now so I'm going to create a cloud
service with C Ranger cloud as the name
this would be a little different from
what we did in previously where we would
create a virtual machine and we would
automatically allow it to create a cloud
service while it was creating the
virtual machine but since we are going
to have both virtual machines in a
single cloud service I would click
create the cloud service first so if you
go to the cloud service here create a
cloud service I'm going to create one
and if I can remember the name C Ranger
cloud see you Ranger cloud okay it's
publicly available and we know that a
cloud service always has to be
associated with your location or region
I'm going to just do this one create
cloud service see that it doesn't take
too long to create but then it might
pick up two couple of minutes sometimes
okay so a cloud service has been created
let's go to virtual machine create a
virtual machine I said that I was going
to do this a lot in the back end but I
thought that I'll show you what happens
when a cloud service has already been
created so see Ranger VM 100 we know the
name I'm going to just pick up this size
as you can see this is what we have
always done that we used to have a
create a cloud service and wish to have
the same name or whatever and we still
have the cloud service created while the
virtual machine is being created but now
that a virtual machine a cloud service
has already been created we can do a
drop down and we can do the sea Ranger
cloud cloud service here as you can see
it went and blocked the cloud service
DNS name because it already had a DNS
name when you recreate it
this is the interesting thing though if
you recall the sea Ranger cloud service
was tied to East us 2 or it was
associated with East us to region so
what this does is it says that hey if
this VM is going to be created and
you're going to put it in the in my
cloud service I'm not going to let you
pick any other regions because you will
have to be in the same region where I am
so this VM going into this sea Ranger
cloud will have to only be in East us
two and it cannot be in any other
regions so the cloud service and the VM
they need to be on the same regions
however it doesn't matter for us we are
going to just put this as virtual
network so Ranger net is our virtual
networks we'll put it in this V net
click next and next and since they're
going to be part of the same cloud what
I'm going to do is I'm going to wait for
this virtual machine to be created
before I go and create the other virtual
machine
not going to let them both run at the
same time because I've noticed sometimes
sharing the cloud service there might be
some conflicts so I'll pause this and
I'll come back again and I'll create the
other virtual machine and I'll come back
and it's going to be a similar thing
that we're going to create see Ranger VM
200 and we're going to make sure from
the drop-down that it goes to the same
cloud service so I'll be right back ok
as you can see here that I'm creating
this you Ranger VM 200 now putting in
all the information the virtual machine
name is sea Ranger VM 200 let's click on
next and what we can see here is that
it's try to create a new cloud service
obviously we want to put it back in to
see Rangers cloud I want to see put it
back I just want to put it in sea Ranger
cloud so what we are doing is right now
having two virtual machines this one is
already in sea ranger cloud and putting
this one in sea ranger cloud right now
so it's in sea Ranger net ok and
everything else it's going to be the
default and we will be back once I have
already paid into both this virtual
machines just like the previous one
ok so both virtual machines have been
created and let's go ahead and connect
and RDP into these two virtual machine
ok I have already paid to both servers
and just like last time we have to make
sure that we disable firewall on this
both servers as well so we can let that
ping or the ICMP traffic come through
for our purposes so let me go ahead and
do that on both the server's real quick
ok now that the firewalls are turned off
on both servers I will go to see Ranger
VM one let's fire up the PowerShell just
like the previous one let's look at the
hostname see Ranger VM 100 and the IP
address is 101 6 8 1.4 and this one is
when it once exceed 1.5 and the host
name of this one is C Ranger VM 200 okay
so we are expecting this this time this
is the scenario once again these two
virtual machines in one cloud service so
let's go ahead and ping 192 168 1.5
which is the IP address of C Ranger VM
200 and the difference is this time we
are on C Ranger VM 100 but we are going
to go ping the Ranger VM 200 and since
they're on the same cloud service that
work out yep as expected they are
working out so what we have established
from this demonstration is that as long
as you are on the same cloud service you
can ping by hosting and as you're
building DNS will support that and if
you are running across two separate
cloud services you will need your own
DNS server for the host name resolution
okay I think this brings us to the end
of our session the part 3 as usual the
training site URL is at www.weiu.net /a
zero training we are on youtube at cloud
ranger network and twitter at cloud
ranger blog and google plus as well as
email you can email me for anything you
want or to know regarding Microsoft
Azure at Shawn at cloud ranger net feel
free to leave comments on the videos and
like the videos recently I have received
a bunch of emails in my email account
here shown at cloud Ranger net and I
have replied to those emails but I just
wish some of their work
technical questions and I just wish that
those questions were actually there on
YouTube comments so I could have replied
to those comments on the YouTube channel
or on my blog and there will be others
would be beneficial so while I
appreciate the emails
if you can leave comments on the YouTube
videos where you ask the questions that
would be beneficial for everybody and
and do like like the videos on YouTube
this definitely helps as an
encouragement to keep doing this for you
so I'd like to thank you for viewing and
I'll be seeing you in the next sessions
we do have another few parts that are
there for des your virtual networks
where we'll be talking about VPN and all
sort of things like those so thank you