Microsoft Azure Training - [11]Azure Virtual Networks -Part 5 -Cross-premises connectivity concepts Video Lecture | Microsoft Azure: A-Z Guide - Database Management

hi everyone this is Shauna smell from
the cloud Ranger and you are viewing the
Microsoft is your training today is the
part 5 of these your virtual networks
and we could talk about a very important
topic in Microsoft Azure or cloud in
general this is the cross-purposes
connectivity concepts unfortunately all
the stuff we have done so far is
important but most organizations who
already have an established
infrastructure may not start off that
way or it might not be applicable for
you where you have everything up in your
cloud so most of the organizations I
believe will start from a hybrid point
or a cross premises point of view where
you are going to have some
infrastructure that's going to be on
premises which is like your data center
or your office and they will have some
sort of connected connectivity to the
cloud and there will be a hybrid
scenario so this happens to very be a
very important topic as well as not only
from practical and work point of view
but as well as your exam so let's get it
started
so cross premises connectivity also is
known as the hybrid network connectivity
or inter site connectivity regardless of
whatever you know term is thrown at this
it will basically mean that there are
going to be different sites that are
going to be connected and momentarily
you will talk about all the technologies
that go with that
but in basic it means that it's
connecting from on-premises network to
it as your virtual network so what we
have seen in the past couple of sessions
is like how we create virtual Nets that
works RV Nets in a 0 so what we are
trying to establish is actually a
connection to a virtual network in Azure
from your on-premises infrastructure so
if you are familiar with side to side
connections VPN tunnels
this might sound sound quite familiar to
you
and not only this cross premises
connectivity is from your own premise it
could be from a from an S your virtual
network to a virtual network think about
this one
you have your subscription where you
have a virtual network and you are
connecting to infrastructure to your
on-premises network however what the
second one here as your veneer to Azure
v-net means is that you could have
multiple subscriptions and you could
connect them as if they are two separate
sites or you might be on the zero cloud
and you are connecting to one of your
clients for example one of the
businesses you serve or another partner
and you could have both of your v-necks
connect to each other as if they are
like a site-to-site and create a tunnel
between them so there are three options
that are available for cross premises
connections and these are very important
to know because this is where the
planning part comes in in is your based
on what you are trying to accomplish
when you're doing an intersect
connectivity or across premises
connectivity so the first one is a point
to site VPN the second one is a
site-to-site VPN the third one is a
private VPN or Express route if you
notice that little gap over there four
four and five I left over there because
one two and three actually depend on
on-premises networks connecting to your
Azure networks but four and five could
be as your networks to as your networks
so there might be nothing on premises at
all or it could be multi-site means
there might be minutes there might be
your on-premises and everything as well
the other thing you have to know is
about the VPN gate gateways you may have
seen this option already when you have
created virtual network that there's an
option over there that actually says you
know add a gateway so we have not so far
explored that but we are going to
explore that in the sessions that are
going to come right now so all you have
to remember is that point to site and
site to site both
setting up a VPN gateway means you are
going to have a V net and you are going
to enable the Gateway if you are trying
to make a point to site or in side to
side and there are two type of gateways
what is the static routing VPN gateway
and there is dynamic routing VPN gateway
we are going to get into the details of
this in the next slide but you have to
remember what are the two scenarios
where you require this gateways and
which type of gateways and this is very
important for your exam because it's
because it's vital to how your design
will be so the VPN gateways so let's
talk about the static routing VPN all
you have to remember it's a policy based
VPN concept
so basically encrypt and encapsulate a
subset of traffic flowing through an
interface so what happens is if you are
on your in your data center on your own
premises so when you want a specific
type of traffic to go through a tunnel
that you'll be craning for side to side
for example you want to establish that
does this traffic go out just to the
internet or is this traffic going to be
called something as an interesting
traffic and this interesting traffic is
going to go on the tunnel so if you are
already familiar with VPN tunnels and
side to side tunnels and things like
split ACL if you're in the Cisco world
or split DNS and things like that what
you have to remember is that this is
exactly what it is you are going to
basically create an ACL access control
list or you are going to basically
create a policy in your in your
on-premises environment where you say if
a specific traffic is directed to a
certain direction is it going to go on
the internet or is it going to go over
the tunnel so this is basically
something which is defined as a policy
based on the kind of device or the H
device you are going to use to create
the site to site tunnel the
the dynamic routing VPN which is like
basically route based VPN so you create
a tunnel interface and you basically say
that anything that's going to hit this
tunnel is going to take this you know
anything is going to this tunnel
interface is placed into the VPN so
basically you are you are not
segregating the traffic all you are
doing is anything that's directed
towards the direction of this interface
is going to go on the VPN so you have to
remember for your exam point of view is
that multi-site VPN and feed it to VIN
it which is a zero virtual network to
virtual network and point to site they
all require dynamic routing VPN gateways
and you may already figure out that why
it might be because multi-site VPN video
to VIN it and point to site they they
are not exactly one of those traffic's
where you have to make a decision
because you already know that those
traffic as long as they hit an interface
will hit the VPN
there's no segregation so there is no
other traffic that you require to send
to the internet for example so anyways
this all will make more sense when we
are going to go through the
demonstrations for creating those
tunnels but you just have to remember
this very much for your exams
and this these are just the concepts and
and the other thing I should have
mentioned earlier is that in this
session today we are not really going to
go through a demonstration we're going
to just run over all the concepts of the
VPN because I want to have a separate
session where we will discuss discuss
each of this topologies separately and
go through an entire demonstration of
how do you bring them up together okay
so those were at the VPN gateways so
let's now talk about the different
topologies you have for this cross
premises connectivity so the first one
we want to explore is point to site so
point to site regardless of its name is
basically something you may already be
doing with your organization where you
have a laptop or you have
like you're working from home and your
systems or network administrator will
provide you like a VPN application so
for example Cisco anyconnect or you may
have Windows 8.1 has it says built-in
VPN connection so did I give you a tool
and say that go ahead and use this
application put in your credentials your
server name and you will be connected to
our internal network and then you will
be able to work on your on your computer
as if you're working from your office so
that's the basic concept of VPN great I
mean it extends your internal network
outside to wherever you are
so technically as long as you run that
application and put in your server and
credential you have extended or tapped
into your work network and you can work
as if you are sitting in your office so
point to site is exactly that you are
basically at a point wherever it might
be it might be a branch office here
where you have a bunch of desktops and a
laptop or you might be at home or it
might be at a coffee shop wherever as
long as you have a piece of software
that's downloaded and you have put in
your credentials you can connect to your
organization or in our case here you are
connecting to the Azure virtual network
so technically all the virtual machines
that you have created on a zero are
sitting here and you are accessing those
virtual machines over a point to site
tunnel and you are working with these
virtual machines as if you're sitting in
that your virtual network and it's
called point to site because you have
multiple points and they all connect to
one single site and here our site is
your virtual network and definitely when
we go to a demonstration a point to site
we'll discuss more about this but that's
the basic concept of a point to site now
you have to also remember that you can
one of these users may connect to
multiple sites right I mean you you
could have multiple as your virtual
networks in a single subscription or you
could have multiple subscription you can
connect to any one of them so even if
your cloud
actually had like for example three
virtual networks of four you will be
able to connect to them separately if
you have two okay so moving on to the
next one site to site some of you who
are already a network administrator or
administration of system administrator
may already know about this where you
may have two sites that are physically
located in different locations and
you're connecting between these two
sites to share the resources and make it
part of one large network if you're an
end-user you may or may not have noticed
this but you're if you are you are
already in a network admin role you
probably do this quite often so
basically for example you could be
somewhere in Toronto and you could be
somewhere in California Los Angeles and
you basically create a tunnel all the
way from an edge device on your Toronto
end to the H divides in Los Angeles and
that one single VPN tunnel acts as an
extension between these two sites so
people in Toronto would access resources
from Los Angeles without even knowing
that it's there because it will elect
and feel like one network obviously
there are much more details there like
you would have to have an edge device on
both ends to make or establish the VPN
tunnel so similarly in s0 what you can
do and this is going to be the most
important technology for you is because
your organization already has everything
the infrastructure and everything in a
data center or on-premises and you are
maybe just trying to run a couple of
virtual machines in Azure and and what
you are going to do is you are going to
create this site-to-site tunnel to your
as your virtual network and basically
add or augment to your infrastructure
and this is the true essence of cloud
guys like we are talking about really
the main core of as your virtual network
extensibility here so
and that's how cloud is sold that you
know most of the sales pitch are that it
will augment or add to your current
infrastructure so if you have five
servers that are sitting on site
on-premises and for some reason you need
to enter ten web servers the although
the easiest thing to do on the cloud is
to spin up another ten web servers now
how about this - going to talk to each
other what if they're going to share a
sequel database in the backend well
that's when you establish this tunnel
and those virtual machines sitting in
Azure
will be directly connecting to your
internal resources over that tunnel so
same here
with side to side this there is going to
be an age device over here so you able
to have a cisco juniper cisco ESA or
router whatever that can create is side
to side tunnel and all you are doing is
creating a tunnel to the cloud virtual
network so you are going to have a
gateway here the beget way we're talking
about earlier which is going to act as
if that's your edge device I must start
even say Act it is going to be your edge
device so you're going to create or
establish a tunnel between this two
users over here we'll be accessing these
virtual machines in the connector to
this v-net in the cloud as if it's
already there on-premise and it's a
basic site-to-site connectivity and the
virtual machines for example if you
create a virtual machine over here and
you have a tunnel let's think that we
are going to put this virtual machine on
the domain all you have to do is go
ahead and join it to the domain it will
look it'll go over this tunnel and look
for a domain controller on-premises and
get it so that's that's really the basic
concept and this happens to the most be
the most important concept because most
organizations go this way because unless
you are a new startup or a small
organization where you have nothing on
premises you can do everything on the
cloud and you can still do everything on
the cloud but if you have already in you
know established infrastructure and
investment on premises chances are you
want to first do this and this also
calls this Travelodge is also the hybrid
or is the hybrid connectivity that you
say that I have stuff on premise and I'm
connected to stuff which are on the
cloud so I have a hybrid network that's
what basically hybrid network really
means in simple terms so it's good to
remember this and we'll go through a
demo for this as well now this is the
most interesting web v-net Tuvan 8
connectivity this is this this concept
extends from a side-to-side connectivity
because you know what end of the day
this cloud with a virtual network 1 and
this cloud with the virtual network 2
are nothing but 2 sites so it's almost
similar to this topology except that
your on-premises is now also a cloud now
a couple of things you have to remember
here it cloud-to-cloud or this is called
AV net to V net connectivity or Vinny -
Vinny tunnel or whatever this could be
in the same subscription so you might
have a virtual network and the location
for this virtual network for example you
have put us East and for whatever
replication dual replication or disaster
recovery you create another virtual
network which is in a totally different
location or data center somewhere I
don't know somewhere in like Hong Kong
or Australia so what will happen is that
within your same account or same
subscripts you may have virtual machines
that are located in u.s. East on the USD
East virtual network and here listings
for example it's in Australia so you
have this virtual machines in the
Australian data center and the cloud
network the virtual network in the
Australian data center as well so what
just happened here you basically created
a totally high availability failed over
scenario disaster recovery scenario
where you have virtual machines in
completely two different continents one
in North America and one in Australia so
how do you connect between this vennett
and v-net will only connect when you
actually put them
with a gateway and create the tunnel
between them so you may have a virtual
machine running here in v-net one in
North America here and all the data
that's written for example to this
virtual machine will go over this tunnel
all the way to Australia in viña - and
be stored in a virtual machine there and
I'm talking about very simplistic terms
here but that's the basic idea to give
you an option to do a minute to Vinit
connectivity or a site-to-site with
respect to v-net not only that disturb
most other important thing how about
this v-net one was your organization and
this veena - is a totally separate
organization it does not have to be on
the same subscription it even does not
have to be on the same account because
as far as your v-net is concerned and
its gateway is concerned as long as you
give this gate with information to this
gateway they can connect with each other
so it doesn't matter where and who this
other v-net - is it could be a totally
different organization and you guys are
creating a tunnel between yourself for
whatever business - business logic or
you know something you're trying to
accomplish doing that so we will go over
details on this as well check and this
is a demo will go hands-on so we will be
creating one you you could practice this
on one single subscription creating two
virtual networks or you could completely
for just the kicks create another trial
subscription and try to do this and do
it how you do this in a production
environment okay this is the multi-site
VPN topology and this happens to bring
everything together and makes the most
interesting of them all so you have a
combination of on-premise sites as well
as cloud virtual networks and with a
multi-site VPN topology basically
everybody is connected to everybody so
there's no single point of failure
and this does not have to be your
organization this could be so for
example this is maybe your on premise
and you have your virtual network here
as well and I should have put cloud
finit one over here looks like there is
a typo but anyways so let's assume that
this is your organization and this part
is some other organization so you could
do that or this could be completely your
organization you could just be one site
and everybody else could be everything
so this is a cross over with everything
together it's a it's a V net to VIN it
as you can see over here this is side to
side V not to V net
this is a side to side this is a side to
your V net site to your V net so this is
a very interesting concept where
everybody connects together and they
will talk to each other as if it's one
large network and this is also something
that will be going through a
demonstration to make this as clear as
possible okay so this happens to be a
very short summary of the cross premises
or the hybrid connectivity network
connectivity concepts I just wanted to
make sure that we are on board with
understanding the basics before we jump
into the theory
I mean jump into the demonstration this
happens to be a very important topic for
your exam you have to remember the
different topologies and their
limitations you have to remember if they
require a gateway or not and if they do
what kind of gateway do they require and
so far by now you might have understood
that all of these endpoints will be a
gateway so most of them will require a
gateway it's just that you have to
remember it's going to be a static
routing gateway or not or a dynamic
routing gateway you have to also
remember the limitations so for example
the limitation comes in with the Gateway
bandwidth for example so we can talk
about this more when we are doing the
demonstration but then you can have a
certain amount of tunnels total amount
of bandwidth and stuff like that the
only one thing I left out of this
session really was the Express route
because there's no way for me to
actually provide a demonstration on
Express route but for your production it
might be one of the most vital part
because your organization might think of
using express route to do whatever
they're trying to accomplish
unfortunately creating an Express route
is not something you'll be able to do
from a home because it requires a
significant amount of investment and not
only that but set up so basically your
Express route and I'm good up and I'm
sorry to do this at the end of this
session but I just did not want to get
into it so much because I won't be able
to demonstrate this and I said that I
want to only go over things that I can
really demonstrate to you and go
practical for setting up but since this
you might be viewing this totally for
just an example of view then it is very
important for you to learn on the exam
so Express route is basically your
private virtual private network so it's
a private VPN so rather than using a
site-to-site or point to site and go
over the internet you'll have a
dedicated VPN connectivity I'm not going
to say tunnel because the tunnel is
dedicated but it's going to be dedicated
so something like an MPLS something like
you'd be using something like BGP to
make the connections happen so you'll
have a very dedicated bandwidth to one
of the azure data centers which will be
connected to your virtual network so you
can only imagine the possibilities and
the kind of power you might have that
you are actually partnering with one of
the azure data center network
connectivity there so you could have
speed up to 10 gigabits per second which
is insane for having having the
connection between you and a zero data
center or your virtual network this may
be something if you're a very large
organization and you require that kind
of bandwidth maybe you are transferring
large video content or media and things
like that that might be an option you
may be able to go to so there are there
are ISPs who are actually providing this
for you so if you are interested in
something like an Express route you have
to let your IC know that I want to do
something like that and if they're a
provider who can connect
because to my knowledge not every ISP
can do that for you so that's something
you will need to look into but as you
can imagine since I won't be able to do
office from from a lab set up here or
you may not be able to do this from your
home it's not something that we'll be
able to do hands-on but definitely
important for exam anyway so that
concludes our decision thank you for
viewing and as usual of training sites
is at cloud range of net /a zero debt
training our YouTube channel is cloud
Ranger Network Twitter is at cloud
Ranger blog we are on Google+ as well as
you can email me at Shawn at cloud
Ranger day thank you