Microsoft Azure Training - [12] Azure Virtual Networks - Part 6 - Point-to-site VPN (Exam 70-533) Video Lecture | Microsoft Azure: A-Z Guide - Database Management

hi everyone this is Shana spoke from the
cloud Ranger and you are viewing the
Microsoft Azure training today is the
part six of desert virtual networks
session and we are going to discuss
about point to site VPN actually we're
not going to discuss but we are going to
go more hands-on on creating a point to
site VPN in the previous session we have
actually discussed the concepts that go
behind you so this is going to be more
of a hands-on session than anything else
this is how a point to site VPN looks
like as we discussed before so you have
multiple points that connects to a
single site and in our case the single
site is an easier virtual network so you
have multiple clients which are users
who might be in a branch office or who
might be in a coffee shop or at their
home on a laptop or a desktop or even
their handheld devices
and what they do is they create a secure
tunnel to the virtual network directly
so it seems that as if they're in the
virtual network which is the basic
premises of a virtual private network or
VPN anyways but that's what we are going
to try to establish so some details
about the VPN before we get started is
that you will need an individual client
machine that will connected as your
virtual network with a traditional VPN
client so this will be multiple clients
so it could be a desktop or a laptop and
you'll install a piece of software on
there and that will connect or establish
the virtual private network or the VPN
you might already be used to something
like this from your organization if they
provide you with a VPN client something
like an cisco anyconnect or an IPSec
client while you put in your server name
your user name or certificate and you
connect to your work or your data center
and you establish the secret show secret
channel or tunnel it uses this as TP so
it's a secure socket tunnel protocol
that's used by this Vivian tunnel the
authentication is actually done by user
certificate and we'll go into details on
this when we go hands-on you will be
creating certificates self-signed
certificates to make this happen they're
individually configured so if you have
like 10 client computers you will be
configuring this 10 times
you'll be installing that software ten
times on all of these client computers
currently for now there are 128 clients
that can be there per virtual network
that you create on your azure so if you
need more than that for whatever reason
you'll obviously have to do on a
separate virtual network so you'll have
to create a separate v-net and do all of
that
it requires the data be dynamically
routed gateway so we discussed this
before the two types of gateways that
you can make microsoft azure and the one
the point to site VPN uses is a dynamic
leader object gateway there is a
limitation on the bandwidth so the
Gateway bad way it's 80 megabits per
second so if you have a lot of users and
who will require significant amount of
bandwidth then 80 mega bits per second
might not be enough for you so you might
have to create a separate virtual
network with its own gateway so when we
keep saying gateway over here that's
actually your edge device so in your
traditional on-premises this might be a
like a Cisco device or a any device
which will be able to create a VPN
tunnel so in Azure this is just a
gateway that's actually created for you
in the backend what will happen is that
it is pins up couple of roles that that
is completely transparent to you so you
don't have to worry about it and as your
text care of that so these are the
sequence of steps that will create or
will use to stablish the point to site
VPN so the first one is that will create
the virtual network with the point to
site connectivity enabled from the
management portal second one is once the
virtual network is created will actually
create the gateway from the management
portal I'll show you the partial command
for it as well but we'll be doing this
from the management portal then step
three and three and four is related to
the certificate so we will actually
create a root certificate and we will
generate itself science client
certificate from that root certificate
and step five is that we'll export the
client certificate from the certificate
store and this is the certificate that
you'll be distributing to the client
computers so each time you have to
provided one of the certificates to one
of the client computers you have to
generate one then we are going to upload
the route of Education certificate to
Azure so the root certificate that we
created in step three we are going to
upload this to Azure to the management
portal and I have not found a partial
way to upload this so far so I think the
only way you can upload this is from the
management portal and step seven is
going actually to the client machine and
importing that client certificate to
authenticate to the virtual network and
step eight is installing a client VPN
package will be downloading this client
VPN package once we have completed step
three and the package is created for us
and will download it from their zero
portal as well and of course the step
nine is to just establish the VPN and
verify connectivity and the way we are
going to do that is we are going to
create a virtual machine using the
virtual network that's created on a step
one and if everything works out fine we
should be able to connect this
internally with the dip or the internal
IP address from our local machine okay
so the next two things I want to talk
about here is the mixer utility it's a
utility that you have that you can
download from Microsoft site or it comes
with the free version of Visual Studio
you might already have that on your
computer so I'll show you nice trick to
see if you already have it if you don't
I am going to put a zip file on the blog
site where you can go and download this
mixer utility if you don't have one and
basically the command here shows I'm
double getting to so much details by the
way with the switches over here but what
this does is that the mixer utility is
creating a root certificate with Ranger
p2s root as the name and the second one
what is it's doing this is taking the
speed range a POS root certificate and
creating a client certificate and saving
that so if you really want to know the
details and you really should at least
once look into the details of what this
command actually does you can go to this
excellent article on the JOA website it
shows how to create self-signed
certificates with a mixer for
development and it's it's a lot into it
goes a lot into detail so you might not
want to all the details
but it's definitely a good read or at
least get some idea as far as reference
is concerned on what the switches do and
it's very well written so if you want
you can go through the whole article and
try things yourself as well I think it's
one of the best articles written there
for it to make certain bility anyway so
that's all we have for slides today what
we are going to do is dip dive into my
client computer and connect to our
subscription and get started on creating
a point to site VPN all right so what
I've done is I've connected to my client
computer here and there's nothing right
down there all items so it's a very
clean slate over here so what I've done
is gone and create it pasted all the
steps that we need for creating a point
to site VPN in this notepad so we can go
through each step and check off each of
them as we complete them and this way we
won't forget it in steps so the first
thing is creating a virtual network with
point to site connectivity enabled from
management portal so we know how to
create a virtual network and this is no
different from what we have been doing
in the past few sessions that you should
be really comfortable with this by now
is that you can create a virtual network
here or create on click on the new over
here and creating a virtual network I'm
going to name mine 1s Ranger net my
location is East us to go ahead and put
the location you are in and in this
screen the DNS server and VPN
connectivity we have been ignoring the
screen so far but what we are going to
do here is this time click on configure
it point to site VPN and as you can see
as soon as you click on that it actually
adds this interesting diagram over here
which shows that you have a bunch of
clients who are going to create a tunnel
to get into the Ranger net virtual
network the other thing I want to show
over here is that when you have a
virtual network you can have multiple
point to site as well as a site to site
so if you actually clicked with this
you'll see the duality here that it will
actually give you a look new local
network and by local network in Azure it
means your on-premise network or the
local on-premise network so what this
means is that you can have multiple
clients who can come outside
their own tunnels as well as you can
have a site-to-site tunnel from your
data center or your office network
directly to the ranger net and this both
are supported in a single scenario here
as well but for now we are not going to
do a site-to-site we are going to just
do a point to site ok so let's click on
next here this is the interesting part
we have not seen this screen before well
we have seen something similar but not
exactly this one so what we are doing
here is providing the information on the
IP range that will be provided out to
your clients what does that mean so
every time one of your clients actually
tried to connect or connects to your
virtual network you will be providing
them a VPN IP address now this IP
address is something that's going to be
that's going to be separate from your
on-premises or your on your transcript
yeutter so you have to make sure that
this addresses don't overlap with any
existing range so we will do some checks
later on to actually demonstrate on what
happened here but you can see that it is
sort of limited on the number of
addresses it can give out so if you do
is slash 29 you can see it will give you
6 addresses 14 addresses 30 62 and you
probably never need 254 because chances
are if you have your entire or all the
clients that can connect to your virtual
network you won't have more than 128 if
you remember from our slides that you
can only have one twenty eight twenty
per v-net so anyway so what are we going
to do is we're going to just keep it on
six so we are going to assume there's
not going to be more than six right and
I'm going to keep this default so it's
going to be a slash twenty nine so this
is only for the point to site
connectivity it is it has nothing to do
with actual addresses face of the
virtual network yet so we are going to
do that over here so over here what I'm
going to do is I'm going to go with a
different scheme for my virtual network
so that way it's easy for me to remember
I would go to 10.10 dot zero and I'm
going to go with this sixteen over here
as usual I will leave
as it is 10 to 1 zero zero so it's not
at sixteen sorry that was not the 16 I
wanted that's the 16 I wanted 4/16 okay
and now you can see obviously that
number of IP addresses that you can
actually have ten that one zero zero I
think that's good enough I'm going to
just leave it default here so now the
next thing I'm going to do here and
which we have not done before is that
once we have figured out this IP
addresses you need to also ensure that
since you're going to create a tunnel
that you have not overlapped this
addresses with your on premise or your
client computer or whatever so you have
to remember that and put something
unique there so there is some planning
you want to do before you would design
the addresses here okay but the next
thing I'm going to do is actually click
on add gateway subnet so you have a
subnet one that this is what it's going
to be in the range
10100 to 10 to 1 to 31 to 255 so which
is almost like 8,192 IP addresses or
clients that you can have over here so
creating a gateway subnet is just like
creating another submit but it's
actually created for you and what it'll
do is that it will create it will take a
couple of IP addresses from here so the
gateway will be communicating with this
and that's the internal IP address you
don't have to do a whole lot of
configuration over here because it's all
done in the backend for you but you have
to make sure that you add that subject
that's what we dedicated from the
Gateway and this is obviously in the
same range or the addresses space your
update your entire dresses basis but
it's definitely different from the
subnet you have over here because the
gateway in the backend wants to make
sure that nothing conflicts with these
addresses so those are the two things to
remember the first one is that you want
to make sure that you actually have the
point to side connectivity address the
space defined here
the second thing over here you have to
remember is that once everything is done
you actually create at the gateway and
it will add the Gateway for you once you
create that dresser space ok so now that
we have done everything over here let's
go ahead and create ok and we will leave
this virtual network create it doesn't
take more than a minute
okay so our virtual network is created
so let's go ahead and create a virtual
machine which is going to use this
Ranger that virtual network so this is
just something we are going to create so
it's easy for us to test out if we are
doing this right so I'm not going to do
a whole lot over here I'm going to do it
from gallery a custom virtual machine
and we have done this plenty of time so
this is going to be just something that
I will breeze through I'm going to call
this a sea Ranger VM 100 it's going to
be a standard I would do something like
an a3 with the seven gifts of memory
bring them in the password click on next
I'll leave this cloud service and
everything as is except that over here
on the virtual networks I want to make
sure that it's going to use the range of
net as you can see picked up the subnet
everything else is going to be default
here so we are not going to do anything
differently click on next and click OK
and we are going to let this virtual
machine create over here so what we have
done over here is so far done with this
step we create the virtual network so
the next one what we are going to do is
create a network gateway from the
management portal so let's go ahead and
do that so we go to the networks here
and we are going to go into the virtual
network and in configure we can see on
the tab over here
is that you can see all the details of
everything you have here so we would go
back to the dashboard and you can see
that it created this little image over
here it says the Gateway was not created
so your clients this is actually a
visual diagram with the broken with the
tunnel broken over here it shows that
there is no connectivity obviously the
Gateway is not created so what we are
going to do is create on create gateway
click on create gateway I'm sorry
so it says that do you want to create
the Gateway for the virtual network
drains your net and we're going to click
on yes so this gateway and this is
where it gets little interesting is that
this gateway could take up to an hour to
create unfortunately if you're unlucky
it runs for a long time because there's
a lot going on in the back end it's
creating web roles it's a it's it's
creating end points it's assigning
public IP address to the Gateway it does
a lot of it takes a lot of time I have
seen this take as low as 10 minutes but
never less than that and go up to 40
minutes 50 minutes even an hour to
create in the backend so this is the
time you probably have to go and do
something else so I'm going to pause the
video obviously and make this go like in
a super speed for you but do not be
alarmed if you clicked on create a
gateway and you just keep seeing it
going and wondering if it's working in
the backend or not because it is
actually working and it will be over in
if nothing at least 30 minutes or 40
minutes and if you're lucky then maybe
10 minutes so I'm going to pause the
video here and we'll come back once the
Gateway has been created all right so it
wasn't really that bad took about 20
minutes but you can see the Gateway was
created so if we go back to the
dashboard here the message is gone now
there's a delete gateway option here
because obviously the Gateway was
created and you can see the Gateway has
been given a public IP address which
makes sense right so your users our
clients would be actually putting in
this IP address to connect and that's
how basic VPN is so this time the error
message will be here changed because
it's saying the root certificate has not
been uploaded so we discussed this
briefly before saying that there is a
root certificate that we'll be
generating and uploading here which is
going to be what the clients or figures
are going to authenticate against okay
so let's leave it here and see what we
have finished we have finished this
statement as well so let's go ahead and
jump right in in creating the root
certificate oh by the way we will be
showing you how to create this gateway
with a partial command
I'm just going to try to remember that
but let's go ahead and create the root
certificate so in my temp folder I have
actually extracted the utility make cert
see the best way to find out if you
already have the utility or not is just
go to the root I just do di r /s make
cert dot exe subselection search through
and find out if you already have the
utility or not if you don't download it
from the blogger website and I'll have
that in a zip format for you to download
and extract and put somewhere anyways so
we're here at the temp folder this is
where I'm going to create the
self-signed root certificate first
create the self-signed root certificate
ok so let's go ahead and put in the
command we have seen before
it was make cert and scale I change sure
- and put a common name here and this is
going to be the root certificate name so
for me it's going to be Ranger k2s root
just so it's easy to remember and put
this put a length on this to 0 for 8 and
I'm going to screw this in this is
Ranger p2s root certificate so a couple
of things before I go ahead and press
ENTER this one I will show you in my
temp folder I just have make cert here
there's one more thing I'm going to do
over here go to MMC real quick and I'm
going to go ahead add/remove snap-in for
certificates so this is how you're going
to see what certificate comes in so will
be my user account and finish ok so
let's do this
expand this there's no root authoring
these are all the certification
authorities that I have here and in my
personal there's really nothing going on
here anyway so let's go ahead and fire
up this command succeeded if you go to
temp you should see a root certificate
that was created this is the root
certificate that we are going to upload
to as you're later on and that's already
ok so let's go ahead and do a couple of
other things let's go ahead and check
off this guy we will now create a
self-signed quite circuit from the root
certificate
ok so let's actually go to the
certificates here fresh should see the
root certificate here yeah the root
certificate is here so let's go ahead
and create the self-signed client
certificate from the root certificate
and the command for that one is make
cert so we have created the root
certificate and we make it going to make
a client certificate out of this and you
will have to do this for
each of your clients that are going to
get this so it's going to be a similar
command
damaged something that I know is for
client so I'll just call it Ranger video
is client okay
and once again if you know what to know
what this H switches really do please go
ahead and visit that article I've
mentioned earlier in the slides so now
I'm going to go specify the root
certificate we have just P to s root
okay I think so far so good
hmm what did I miss up here too many
parameters I might have done something
twice so let's see alrighty so fixed
there so there was - missing over here
with the is might some of you might have
already noticed but yeah
took a while to figure out that create
self-signed cert from root certificate
so that is done so if we come over here
and do a refresh you should see the
client certificates show up here as well
okay so the next one would be to click
sport the client certificate from the
certificate store so how do we do that
let's come over here to export the
certificate what we are going to do is
come over here create right click on the
POS client and we are going to go to all
tasks and export so now it says that
welcome to the certificate export wizard
so we're going to export the client
certificate so let's click on next we
want to export export the private key so
you want to check that it's not checked
by default and we will check the
defaults here there is going to be a
password that we need to put here so go
ahead and put a password that you can
remember it's really easy go on next and
we are going to store it let's put it in
the temp folder as well so I'll just
call it the client cert and it's going
to export it as a dot pfx next finish
exporter successful and we have put this
in 10 so this was the root certificate
and this is the pfx of the client
certificate with the private key so I
think we have done that as well so check
this out
so let's go ahead and upload the root of
indication certificate to Azure
which is the root certificate and the
way you do that and I couldn't find a
PowerShell so the only way you can
actually do this is from from the
management portal anyways so if we are
here at networks go to your virtual
network here the v-net
and go to certificates and it says a
port site VPN has been configured but
it's missing a root certificate this is
the similar error we are seeing a
dashboard here if you look at the
diagram and it's going to throw that
error till you actually go ahead and
upload it so let's go ahead and upload
it or search it is very simple it's just
a browser so we're going to go this PC
go to C drag go to temp I'm going to
pick the Drude certificate
press open here and click on this and
sup floating the root certificate that's
the thumbprint
it's expiring it really closely amount
20 30 39 just because it's signed and
we're going to just wait for the step
load it takes like few seconds really
okay the root certificate has been
uploaded so click on OK here come over
here and we are done now we have to
install the client certificate on the
client machine so what we have to do is
that since we have exported that we now
have to import it and basically not
reinforce but you any client computer
who's going to have it you could provide
them this certificate and they are going
to install it so it might be looking a
little odd when we are reinstalling this
certificate or installing this
certificate because we generated ourself
and exported it but I just want to show
you this how it will be done so you come
over here to the temp folder and all we
are going to do is double click on the
PFS pfx and it's saying that it's
certificate import wizard so anytime you
double click on that it will be
importing it so what we did was export
before let's import so we are going to
keep the current user and that's
location now it's going to ask for the
key that we have said earlier so it's
something very important that you have
to remember so I'm going to just put in
the password and make sure everything
else is default click on next let this
one automatically select the certificate
store I would keep that default click
Next and finish and it's going to tell
you that you're about to install the
install the certificate and you know you
are going to import this to be the route
from
the circuit was generated from this
route and if you're going to trust it
you're going to actually install it
we're able to say yeah
that's fine yes it says the import was
successful click OK and we go ahead and
get into the MMC console let's go ahead
and refresh that let's go ahead and
refresh this as well
and refreshing we should see the
certificate here I think everything is
in place anyways so that's done so we
have installed the client certificate on
the client machine which is ok now the
next step and the final step left is to
actually install the VPN package so the
way you do that is go to your been--it
here check something really quick you
can see that error is gone it just says
client 0 because you know nobody's
connected obviously so it says client 0
and looks like everything is set in
order here so here in the network in the
dashboard you'll see in a virtual
network is that download the 64-bit
client VPN package of 32 so depending on
the client computer you are on or your
user is going to be on you're going to
download this package and this package
is going to have all information for the
VPN client so it takes a couple of
seconds for this to actually download
the package and it's going to show up as
a download perfect it's got a weird name
I mean it just tries to keep it unique
so obviously you can change that to
whatever you want go to a save as go to
desktop I will save this client on my
desktop ok close this close this here
here here here on the desktop now do a
couple of things the first thing you
want to do this since this came from an
outside so go to properties you want to
make sure that this came from another
computer so you know to unblock that
click on apply I'm actually on Windows
8.1 pro depending on your installation
things might show differently so I'm
going to run this install as an
administrator for whatever reason and I
know
this while I was you know going through
this demonstration few times to make
sure everything was okay I've noticed at
one point when I install this couple of
times obviously different time it was a
different package because based on your
gateway information and everything it
actually generates a specific package
for your virtual network so you are
going to only do this step of
downloading this after all the steps
have been completed to ensure that all
the information that you have over here
is actually stored in you know client
VPN package so anyways I was doing this
multiple times and at one time when I
came over here when I was installing
this and clicking yes nothing was
happening and I was going crazy what
happened I found out that there you know
it actually goes to app data and
installs there so the way what are you
going to do is you're going to come to
this location
based on your user users for me it's on
an app data go to roaming good Microsoft
go to network and go to connections and
this would be CM so this is the path
you're going to go to so once this is
installed the very first time it
actually puts a bunch of files there as
long as before installing the this
folder is all clean and there's nothing
there there should not be any problem
with them strong in general there should
not be any problem with install but I
noticed a couple of times after I
install this few times things are
getting wacky and the client was not
installing but okay we are not going to
have a problem with that let's play kana
yes it will actually install really
really quick and as you can see over
here in my windows 8.1 it actually
created the VPN connection over here a
couple of things happened as well so if
you go to see them you should see there
a couple of entries in that folder so
this is what the folders are talking
about or the file and folders so the
next time you're trying to install this
for a new practice make sure you delete
this so there's no not going to be an
installer problems the other thing I
want to show over here as well is that
it's going to create that adapter called
Ranger net and it does everything for
you so okay that's all the information
really you need to set up point to site
let's see if we have everything over
here so that's the last step we have
completed is downloaded and installed
let's go ahead and establish the VPN and
very try the connectivity so in 8.1 or
how we do it is click on this and click
on connect what you do is it fire up
this Ranger that VPN custom client that
it has done for you and as you notice in
properties there's not a whole lot of
information over here because this is a
certificate based certificate based
authentication so it knows what to go
and get all your information and all the
credentials and all the server or the
gateway IP address and everything so you
don't have to do a whole lot of things
so let's go ahead and click on connect
ok it's saying that it needs an elevated
privilege we say we asked it to continue
and that's it you are connected to the
Ranger net Vinit so how are we going to
verify this so the way we are going to
verify this is few freeways 3 so the
first thing is let's go over here we are
in the range of net v net so let's go in
the range of net V net so let's go back
and let this refresh and what we are
going to do is we are going to go to
configure and we are going to see that
we should have got a range from 10000 so
what I'm going to do is I'm going to go
to the command prompt and actually do an
IP config and see the IP address the VPN
actually gave me so let's go ahead and
do this I'm going to clear the screen
whoops
clear the screen actually even go to the
route clear the screen and let's go
ahead and do that become thick so one
side road IP config I can see all my
interfaces and everything here but what
I'm interested in is actually the PPP
adapter ranger net so this is the this
is the connectivity for the tunnel and I
can see that I got an address 10000 - so
this is the tunnels endpoint address on
my client computer and it took it from
this address space so the more clients
you have they'll probably get 1000 three
1000 four or five of with hours
addresses
a sublet here you can probably give up
to six clients so this diet the address
we know that we have got this IP address
here which is okay now the next thing
I'm going to do is actually try to do
something with this tunnel so to ensure
that we actually do have a VPN
connectivity so let's go on to virtual
machines here I created a virtual
machine and this virtual machine has
let's actually go RDP into it first
because there are a couple of things I
want to do on the virtual machine before
we actually go and test the connectivity
of the VPN out let's go ahead and click
on connect and open up the RDP is the
password we need to put that we have put
in when we were building the VPN yes
let the virtual machine load the first
thing out to do since I'm going to do a
test of the tunnel with a ping what I'm
going to do is first disable the
firewall and obviously should not be
doing this on a production environment
but I'm just doing this to prove the
concept so I'm going to turn the
firewall off let's connect this off
let's fire up the command over here real
quick as well and what we are going to
notice is the dip dynamic IP or the
internal IP so I'm going to an IP config
here so I know that I'm at the IP the
internal IP 10.04 so everything we know
about networks so far we know that an
outside public computer there's no way
should be able to ping this address or
even know that this egg this IP address
exists to this virtual machine but
that's the whole purpose of a VPN it
will directly put us on the virtual
network and we should be able to get to
this VM from our client computer which
obviously is not in the virtual network
but just because we are connected with
the VPN we should be able to do this so
the way we will do this is we are going
to ping the dip right so the dip was 10
got 1.04 if the VPN tunnel is up and
running this is the internal IP address
10 1:04 of the virtual machine we should
be able to ping this so let's see all
right so we can ping this so this
actually shows that we are directly now
tunneled to the virtual network and
anything we can do with this virtual
network right now should be we should be
able to do this locally so instead of
using this RDP client if we go and get a
remote client sorry let's do this we
already have one opened so let's do this
let's do a 10 dot one dot dot 4 so we
don't have to put any ports we don't
have to do anything we should be able to
directly go to this virtual machine with
that IP address because we are connected
to this virtual network with the tunnel
so let's go ahead and put my username
1001 0 4 and this is my client computer
right I mean this is a public computer
for I'm at home right now not even on
the cloud obviously you cannot be in the
cloud but let's see if this connects ok
so it's asking for the password so this
is a good sign that it's connected and
as you can see using 10 1 0 for the
internal address we are here on this
virtual machine so I want to review a
couple of things before we actually end
this session here because I want to go
over the address and spacing I just want
to make sure that you're absolutely
clear what happened here so when we go
to the ranger net there were two
addresses spaces under configure so also
since we are here you cannot actually
see the number of clients connected is 1
and you can see this tunnel has been
established because I am now connected
to Ranger net so it I am that client if
you have more clients they always show
up here and this is the gateway IP
address a little bit of ping and stuff
we did here and there you can see the
data in and out anyway so let's go to
the configure here and the point to site
connectivity this is the address of
space that a VPN gives you so let's do
an IP config once again to go over this
I know I'm repeating myself here but
this is very important so this is the IP
address you get once you have connected
to the VPN so this is your side of the
tunnel so technically if you are on the
server and you do it paying 10 dot sorry
10 dot 0 dot
10.0.0.0 - you should be able to go and
ping my client computer at home because
they're on the VPN and I guess the only
reason this is not working right now
because I probably have a firewall set
up over here which I need to turn off so
just for the sake of clarity let's go
ahead and turn off that firewall
so this was my client computer the
firewall is off now so let's go to the
virtual machine here let's try this once
again okay so as you can see it
obviously can breach my client computer
from the cloud as well so that this IP
address was my endpoint - for the tunnel
and this is the IP range that will
actually establish that now the IP range
below there and this type a range we are
aware of is the virtual networks IP
address and we know that this starts
from 10100 because as you can see on the
on the virtual machine ten one zero four
is the dip or this is the this the
internal IP address so that's no
different so it took it from this range
the subnet one and the Gateway is on
this range if this is for internal to
Azure they are going to do their thing
in the backyard you don't have to do
anything besides creating this gateway
all you have to remember is that it went
and created the gateway and the gateways
public IP address is this and this
public address is for the Gateway it has
nothing to do with the cloud service and
all those VIPs and stuff we have talked
about because you are now connecting
completely in a different way to the
Gateway and not the cloud service
directly so you can see these all are
different things okay so the last thing
I want to also mention is that this is
cloud and this is the billing model that
anytime you use something you are going
to get charged for it
so you want to absolutely make sure that
you have everything turned off and for
example if I click on yes right now I'm
going to turn off the virtual machine
the only thing I have seen is that when
you have this up and running and you
have a gateway your gateway is actually
built so having this gateway over here
even if you're not doing anything your
virtual machine is turned off
nothing is happening on the network
obviously a VPN is disconnected nothing
is going on you are still going to be
charged for this gateway because this
gateway is up and running it's holding a
public IP address means it's holding a
resource and as your is going to Bill
you for it there are many things I do to
keep my costs low and to make your trial
period as effective as possible you
probably should turn off everything and
possibly delete everything and this is
what I do that's why every every time
you get into one of my sessions you go
up over here and you go to all items
you'll see I have usually nothing over
here because I turn everything off and
delete everything after I'm done with
the session or my lab to ensure that I'm
not built for it so you have to remember
that with the gateway there's no way to
turn off that gateway at least I have
not found a way to turn off the Gateway
and I know for a fact that it doesn't
exist until the Gateway is up and
running you're going to get billed for
it so unfortunately the way to stop
getting billed for it
this is deleting the gateway so this
will ensure that there's no resources
held by your subscription and you're not
built for it this is important if you
are doing a lab or you have an
environment in production which is not
really something that's up and running
24/7 365 so you want to make sure that
you account for this that there will be
few dollars it's not really a whole lot
as few dollars that will be charged to
your subscription and it could go up to
20 $30 per month for just keeping this
gateway up and running this is
regardless of data in a data out rate so
please remember that and as you can see
since I disconnected here it took some
time to refresh but it disconnected here
there's one last thing I did promise
that I was going to do before was that I
was going to talk about creating the
gateway with a script and the way you do
that is create the command it is new as
your v8
Gateway and you give the v-net name
because you you only can create a
gateway in a minute
right so our name was Ranger net for the
V net and all you have to do is specify
the gateway type and if you remember our
gateway has to be a dynamic routing so
that's all you have to do to create this
gateway over here we did it from the
portals we went and just clicked on
create gateway or add gateway and right
now it's obviously not letting us do
that because this is how you have to
delete it so this is how you would have
done the gateway from here
there's one last thing for the exam
purposes I want to also mention is if
you come over here configure should not
in configure let's go back to the ranger
net over here this is your virtual
network range in it if you export the
file if you remember we talked about
that XML file earlier in the session
where you can actually save that and you
can look at all the configurations and
this is very important for the exam
because we went through a very small
config file when we first started off
but I want to show you the different
things that are there right now so as
you can see that a couple of things go
to edit here there was a gateway subnet
that was added here for your
subscription so the subject name so it
was just basically another single subnet
for your range in it so that's all the
information you have here and you have
to remember that when you create things
in your v-net they actually get added to
this file and this is one way to export
it and it's easy to import it if you are
going to work work on it as a backup for
your network configuration files anyway
so that concludes our session for point
to site VPN let's go back to our slides
now if you remember that this is how we
created the self sign root certificate
self-signed client certificate from the
certificate please go to this website
and get the reference on the switches
because I hate the fact that we do
something and you do not know what you
are doing because when you are doing
this in production obviously every
single switch over here will matter to
you
so it's definitely worthwhile
understanding what it does ok so that
concludes our session and as usual our
training site is that Club ranger net
forward slash as your - training YouTube
channel is that cloud Ranger Network
Twitter is that club ranger blog and you
can email me at Shawn at cloud range of
net feel free to put comments on the
YouTube videos or ask any questions
recently somebody someone actually put a
comment and had a query this is this is
something obviously I can discuss
because this is a comment right on the
YouTube channel usually the emails that
I get directly are the ones I do not try
to respond on the video for everyone
because those are I'm assuming the user
wanted that message to be private and
did not want to post it on the YouTube
channel but Mike my suggestion is always
put a comment on the YouTube video so
everyone can you know be benefited from
the answer to the question you may have
right so recently one question came up
was that if I was going to cover as your
websites and as you as your storage and
things like that to answer that question
is absolutely I'm going to I'm going
through the course curriculum that is
provided by Microsoft on the website and
I did throw up a link before to that
where you can actually go and see all
the different topics Microsoft wants you
to go to learn the 7533 to attempt that
exam I'm going to go through all of that
I'm going to go through as your websites
I'm going to go through a zero storage
virtual machines everything everything
that's there so by looking at these
videos you should be able to go and
attempt of course with further study you
should be able to go and attempt for
your exam the reason I'm following the
sequence is because I feel that this is
how I learned the best and I came from a
background where I was already working
on infrastructure cloud is not something
you can jump into if you don't know
to have some experience with
infrastructure in general so I felt that
this is the best sequence now I've gone
through the Microsoft official
curriculum MLC and what I found out that
you know Microsoft themselves and a lot
of you know vendors and trainers they're
going through their own sequence so
somebody started with as your websites
someone started with 20 virtual machines
and start from there
hey Ivan saw someone just started with
the networking first so I feel that this
is the best sequence for us and I'm
going to follow the sequence I have and
obviously if you are just viewing this
in 2015 that's what it is right now
I'm actually building the videos as I'm
publishing this so it's probably it
takes few days at least three days I try
to at least keep it three days before I
publish a new session so you have to
have a little patience till I actually
get there and if you are viewing this
later you probably are not going to have
this issue all the videos will probably
be done by now so you can probably jump
into one session which are interest to
you like for example as your storage and
you might be able to view that but
having said that these videos are
following a sequence which also means
that they are not exactly always
self-contained so in some of these
videos I do assume that you have watched
the previous video and watched one of
the previous concepts and hands on to go
and view the session you are viewing for
example the session today on point to
site VPN I did not get into too much
concepts because I'm assuming you have
watched as your virtual networks part
five which actually explained everything
so if you're just going and viewing this
video by itself if you're just looking
for the steps you're perfectly fine but
if you are looking for some concepts and
some context to get onto it it might not
be as easy
so anyways feel free to actually go
through the entire course that are
available right now and they're going to
come and you will be ok with the 7533 of
course some I cannot provide you the
guarantee on if I'm going to cover every
single thing that's going to be one and
7532 exam that's almost breaking down
the a
and that's something even I can't
predict or anybody can predict even
Microsoft trainers who are training you
proficiently won't be able to predict
what's going to be on your exam but this
will give you a very good head start and
MSDN is your that's where you need to go
to go and read about everything it's a
lot boring details it's a little bit
it's more of a manual than a training
even though MSDN has become better over
the day years I've seen but yeah it's a
lot of information to absorb from there
but that's your ultimate guide if you
were to go and read up on something so
yeah so have no worries we'll have all
the videos here for you and it's just
there's just so much that happens in a
day for me it takes some time to
actually prepare and before all the
demos and everything I actually make
sure that I do this few times myself to
ensure I'm giving you the most accurate
information and I actually also go
through a review process where I make
sure that everything that I have said is
actually as accurate as possible so yeah
anyways thank you for viewing and I'll
be seeing you in the next session and
bye till then