Microsoft Azure Training - [13] Azure Virtual Networks-Part 7-VNet-to-VNet Connectivity (70-533) Video Lecture | Microsoft Azure: A-Z Guide - Database Management

hi everyone this is Sean is Mel from the
cloud Ranger and you're viewing the
Microsoft Azure training today is the
part 7 of the Azure virtual networks
session and we are going to talk about
v-net to v-net connectivity or as your
virtual network to virtual network
connectivity so this is a very important
session for you because not only for the
exam this is something most likely you
are going to do your production right
away if you are going to consider doing
a pilot project or doing something even
in production in Azure for virtual
networks and connectivity and things as
such we need to VIN it connectivity this
is this is a session I'm trying to sort
of fit in to to replace or to sort of
substitute a site-to-site connectivity
that we have discussed about earlier so
the reason behind doing this is a lot of
you who are practicing this in a home
lab scenario might not have the right
VPN device or an aged device with the
correct set of requirements to set up a
tunnel with the azores virtual network
gateway so having said that VIN it to
VIN it which is actually a virtual
network to another as yours virtual
network simulates the same scenario and
this is something you can pretty much
sit at home and do right away and if
you're actually doing this at work and
you do have an edge device or a VPN
device you can obviously fire that up
and make a site-to-site tunnel with the
vers with the Azure virtual network so
let's get into a little bit of details
about this so these are the three
topologies I could think of when it
comes to a site-to-site connectivity so
the first one is where you have to on
premises network and chances are this is
something if you're not in the cloud
at all you may still be used to this
because you may have a branch office or
you may have two head offices or two
data centers who are connected with each
other and the way that happens is that
you basically have two gateways or two
vidiian devices or edge devices or even
routers or firewalls anything that's
capable of bringing up a VPN tunnel
IPSec tunnel and it's possible to make
this site-to-site connectivity so you
could have virtual machines on this side
of this enterprise and they would
complicate with the virtual machines
here through this tunnel and all you
need is these two gateways who are
capable of bringing up that tunnel so
this is one scenario you may be used to
the second one is the most likely
scenario most organizations have when
they are trying to the whole moniker of
talking about extending the data center
to the cloud is exactly what the second
one is so chances are you have all your
serve servers and everything on-premises
or this on-premises will be the data
center where all your servers are
reciting today
let them be physical or virtual it
doesn't matter but this is your own
premises network this is what you have
now extending your network to the cloud
would be something similar like this so
you have your cloud Microsoft Azure here
and it has the virtual machines that you
created over here so all you do is
basically create a virtual network and
create a gateway for that virtual
network and you'd have your own premises
gateway communicate with this gateway of
the virtual network and you'll bring up
the tunnel for the VPN so that way these
virtual machines would communicate which
with each other or based on what VPN
actually does so they would be they'll
be local to each other they'll be
accessing each other locally even though
they're actually they're actually going
over the Internet and this turtle is
established over the internet but it'll
be a virtual private network and VPN so
it's a virtual private tunnel that
you'll be passing the traffic
from and knowing VPN you probably know
about this already so this is second one
is going to be the most likely scenario
that you will just extend your network
now the third one which is what we are
going to do today is actually a
site-to-site in one sense but what we
are doing is we are establishing this
site-to-site connectivity all in the
cloud so what we are going to do is we
are going to create a virtual network
and we're going to create a gateway for
this and we are going to create another
virtual network and going to create a
network for this and have this to
communicate with each other as if there
are two separate sites so this could for
example simulate your cloud and this
could be simulating your own premises
and the only reason behind actually
doing this is to practice a site-to-site
or to establish a site-to-site you'd be
doing the same configurations so you can
almost assume that this part is the
cloud and this part is on your own
premise and you you could you would be
doing the same configurations so this is
a good practice and doing that you don't
have to go now and start looking for a
router to buy or borrow or whatever to
simulate a or I mean not similar to
actually perform it side to side
connectivity hands-on practice so that's
the scenario we'll do and I'll get into
more details of why this scenario
actually works as a site-to-site so
let's get into a little bit more details
about the v-net to veneer connectivity
in particular so in viña to Vinit
connectivity we are basically connecting
two virtual networks in a zero so you
have two one virtual network another
virtual network you create respective
gateways and make a site-to-site
connection between them obviously it
requires the gateway so like in our
previous session we talked about when we
were doing the point to site the only
way you will ever create a tunnel
doesn't matter what kind of tunnel
you're creating is actually by
provisioning a gateway on your
your network and for v-net to v-net
connectivity we need the dynamic routing
enabled on the gateway so we'll be
demonstrating going through that when we
will be going through the demonstration
now the next one is the address space
and I want to absolutely assure you that
this will probably be the most important
task in your production environment
everything else will almost come as a
second nature because it's very easy to
do five six steps and get a site-to-site
tunnel up but the biggest the bigger
planning part will be for the address
space so if you are all very familiar
with VPN concepts you already know this
but if you're not the whole idea is that
you are having your internal subnet or
your internal private network space
accessible to another site through that
tunnel as if these two sites were one
single site overlapping each other so if
you are inside a the private network of
site a will be available to the site B
so site B people or the users will
access site a resources as if there are
the same network that's the whole
essence of having a virtual private
network that you are allowing something
like that ideally which you would not
allow on a public network like you would
you don't want people from the internet
access your internal servers or
resources right so what happens is that
if you have these two sites and they
have an address space for example on
site a something like 192 168 0 0 with a
16-bit 16-bit subnet mask you cannot
have the other site on a 192 168 and
16-bit subnet mask as well the reason
behind that is when the tunnel is
established your users if they want to
connect to a server called 192 168 1 1
they wouldn't know that if this is going
to be on the site a or site B because
both of them have the same address space
both of them could have
this same address because of that
dresser space being same so the plan is
that if you are going to be on premises
with for example 101 6800 with the
16-bit subnet mask you want to ensure
that your virtual machines are not v-net
addresses space is not the same you do
not want them to overlap you want them
to be separate so the machines on each
sides can access resources on the other
side once the tunnel has been up without
any conflict so that's the planning part
of this so in a visit to v-net scenario
where we talked about that hey we are
making this two virtual networks talk by
a site-to-site tunnel we are going to
use one subscription to do this right so
this is just because for ease of
demonstrating this or it's because you
just probably have one subscription
trial subscription you have signed on to
but do remember that v-net to a as your
v-net is absolutely as real as it can
get like a site-to-site the reason
behind this is that these two vignettes
do not have to be on the same
subscription these virtual networks can
be on separate subscriptions it can be
separate accounts it can be separate
organizations right so if you have a
partner organization where you want to
do a site-to-site we have done this on
premises for years where a partner
company would want to create a tunnel
with us so they can access certain
resources so even it on one as your
subscription on one account for one
organization can connect to another
v-net in another subscription another
account and another organization and
they do not even they I mean they can be
arm's length they do not have to even
know each other anyway as far as the
site-to-site tunnel is concerned you are
only going to share certain information
like for a regular tunnel what would you
share you share the Gateway IP address
which is the public IP address and you
would be sharing like a shared
passphrase for creating your IPSec
tunnels and that's all you really need
so these two
networks can be completely separate from
each other but to simulate this and to
keep sting is keep things easy what we
are going to do is we're going to use
the same subscription to do that because
if you remember our virtual network
concepts from few sessions ago to
virtual networks do not talk to each
other they have completely to separate
they're in complete isolation they are
not supposed to a virtual machine in
your subscription in one variant will
not talk to another virtual machine in
the same subscription in another virtual
net or variant so this is as real as it
can get guys when it comes to side to
side and that's why I'm going to do the
entire site-to-site VPN concept based on
envy net to every net connectivity and
it's not very unrealistic at all because
you might have two organizations who now
are completely in cloud want to
communicate with each other right they
want to partner with each other
federated under whatever they want to do
and this is how you'd be doing it if you
are going to do a site to site from your
on-premise to cloud you are still going
to follow the same steps completely so
you're not missing out anything on this
one okay so these visits can be on the
same or different regions so this is
actually almost given if you understood
the previous the previous point this
virtual networks can be anywhere they
can be on any region any part of the
world it doesn't matter because end of
the day you're creating a tunnel between
them so they could be anywhere wherever
they want it to be so in our
subscription will actually do the same
we'll make it
east and west and of course since this
is going to be an IPSec tunnel what
we're going to do is it's going to use a
shared authentication key so this could
be the secret key that you are going to
distribute between this two virtual
networks so you give the key to their
admin their ad may will use that same
key or they will give you the key and
you guys will establish that now the
most important thing to understand for
example int of view as well is a cloud
service cannot spell span a virtual
network so if you created a virtual
machine which is part of a cloud service
as you know by now just because you have
a tunnel up and running
you cannot have a virtual machine on
another site who will be part of the
cloud service your virtual machine is in
I'm going to show you a little diagram
in a bit where we would actually explain
this but this is something you have to
remember that your cloud service is
always local does it matter if you have
a site-to-site connectivity or not and
this is therefore a very good reason so
these are the tasks sequence the first
thing we'll do is we will actually do
the planning of IP addressing you want
to absolutely know what the IP address
is that you're going to have we are
going to create the virtual networks so
I'm going to create both V Nets I'm
gonna use the same subscription like I
said and then I'm going to add something
called as a local network which is
actually the cloud way of saying the
on-premise Network I have a slide coming
up on this to explain this one in more
details then we are going to create a
dynamic routing gateway and we will be
creating the pre shared key and we'll be
setting that up and then we will be
connecting these two VPN gateways to
actually establish the tunnel so this is
the task sequence we are basically going
to follow so this is this is what we are
going to do today
so like I said I'll mention the local
network so this is what it is a local
network in cloud terms in Microsoft
Azure is synonymous to on-premise
network so let's think of this as two
sites this is my site which is v-net
east and this is my site which is called
v-net west so think of this as your
on-premises Network the East is our
on-premises Network and think that this
is an extension of your data center to
the cloud and v-net West is actually in
the cloud okay so when you are creating
the tunnel and specifying everything in
the cloud you are going to specify your
local network you are going to say which
network your other site is in so this
local network basically means your
on-premises network so on vennett west
you are going to specify a local network
which is going to be v-net East
and envy noticed just because we have
Avena to win it the local network is
going to be v-net west so basically your
on-premises network is called a local
network and since over here both are
cloud they're going to criss cross each
other to be each other's local network
so v-net East local network will be
Vinit West and v-net West local network
is going to be v-net East so we are
saying this guy in the East that your
on-premises network is this guy we're at
West and on v-net West we are saying
that your local network or your
on-premises network is this one and
Microsoft could have termed this little
better but they are assuming that
whenever you're going to do a
site-to-site title you're going to
always do a tunnel between a cloud
virtual network and physical on-site
on-premises network so they're calling
it local network it's confusing and you
know what I initially started with this
it was confusing to me as well like what
does this virtual network mean when it
says that it wants me to space for the
local network like do i specify the same
v-net network addresses place or what
but anytime you see the term local
network you have to think that it's the
other side or the on-premise network or
in our in our scenario is the other
valent so we'll go through the
demonstration of that and we are going
to actually build this entire thing so
we'll see what we can do over there
during the demonstration for explanation
so I'm going to create the Ranger VM
0:01 in v-net East and it's going to I'm
go to assign or it is going to have a
dip or a dynamic IP address or the
internal IP address and Ranger VM 0:02
will use the V net West and I'm going to
create this and it will have a dynamic
IP address as well the dip they will not
be able to pin each other with their
dips because they are two separate
isolated virtual networks so what we
will do is then we able to create the
gateway and we are going to bring the
tunnel up so this will now become a
site-to-site VPN tunnel and then we
should be able to ping each other with
their dynamic IPS or the private IP
ranges so
we need to make sure that that v-net
created over here has a completely
separate address space than the v-net
created over here this is the part where
we do not want them to overlap otherwise
they are going to be issues and the
other thing we explained was that there
are going to be cloud services and
that's actually a very very confusing a
very very confusing concept is that when
we created this virtual machine there's
going to be a cloud service when able to
create this virtual machine
there's goodway cloud service so which
IP address do you specify on this
gateway to connect the answer to that is
that you do not use any cloud or VIP
addresses for your site-to-site tunnel
your gateways if you remember from our
previous session will have their own
public IP addresses and when you want to
create this site-to-site tunnel you
share that public IP address you do not
share the cloud services or anything to
create this gateway the gateways use
their own endpoints they have their own
public IPs to bring this tunnel up and
having said that the other concept we
said we will explain was that your cloud
service cannot span over here so if you
remember a few sessions ago when we were
talking about cloud service we say that
the cloud service is essentially the
container where the virtual machine or
machines are located so you could have
multiple virtual machines who are part
of the same cloud service so when you
create this tunnel just because these
things are local to each other or these
two networks become local to each other
you will not be able to put Ranger VM
0:02 in this cloud service even though
they are accessible to each other
there's a very good reason to do this
and it's a it's a constraint
specifically put in there to ensure that
this does not happen because you do not
want your cloud service to span across
regions if you remember the basic
concept of cloud service the cloud
service is something that's specific to
a specific region so having a merged
machine here in East and a virtual
machine having over here in West you
not make them part of the same cloud
service because this cloud service
chances are are only associated with the
east us range here and this one only
associated with the West range here so
it's very important to note that for
your exams
okay so let's not waste any time I think
we have done enough of explaining and
concepts over here so we're going to get
into the steps of doing this in our as
your subscription so I'll see you from
there
okay so I am here in my client computer
and as you can see I'm just connected to
my subscription and I do not have
anything in my subscription right now so
this is where you should be at this
point so the first thing we are going to
do is actually create a virtual network
so you probably are very very used to
doing this by now but you know let's go
through these steps together so let's
create a virtual network and the first
virtual network that we are going to
create is going to be v-net East I will
just name that so we it's easy to
remember you in your production you
probably name it whatever you want it to
be just because it's going to be nice so
I'm going to put east us two as my
location click on next in previous
session when we were doing the configure
I'm at the point to site VPN we went and
checked this box over here and it gives
you some additional options when you
check that box so similarly in the site
to site VPN you would actually click
this and as soon as you click this you
see that something like a new local
network showed up over here so if you
remember our slides the local network
here means your on-premises site right
so this is your cloud it's using the
Gateway and the VPN tunnel to connect to
your local network which is nonnamous to
your on-premises network in our case
this one is a virtual network or envy
net and our local network is also going
to be a virtual network but this is what
I meant by saying that it's the same
side-to-side configuration so we are
really not going to touch anything here
because
Vina to Veneto site to site is going to
be the same thing so we will check the
same box having said that this is going
to be a little different because some of
the information that we need are still
missing some of you might have already
guessed that but I'll just show you what
I mean by saying that some of the
information is missing so configure a
site-to-site VPN okay I click Next
so now we are talking about the side to
side connectivity so means that here you
are supposed to put your on-prem server
information so as soon as we put on Prem
here you can see it came over here or it
is your data center so name something
sensible like I could say Toronto DC
data center so basically your v-net is
connecting to toronto DC with the tunnel
this is where you put your VPN device IP
address this is a public IP address that
is actually the IP address of your VPN
device on the premise on premise side
right because you are going to say your
virtual network that hey you need to
connect to this VPN device to bring the
tunnel up so what is the problem here if
this was a side to side connection your
data center already probably has the
Gateway up and running and let that be a
firewall gateway or letter B router or a
VPN appliance or a VPN virtual appliance
whatever it is it's probably already up
and running
it's provisioned and you have an IP
address that's available to share to
your V net on the cloud but do we have
it no we don't because what we are doing
is we are doing a virtual network to a
virtual network and we are doing the
side to side between these two virtual
networks we do not even have the other
virtual network over here created let
alone have its gateways so we do not
even have the VPN device IP address yet
for the other side so we can't do this
at this
so what we are going to do is that we
are going to go back and we are going to
say forget doing the site to site VPN
for now let's actually create the
virtual network first so which is which
is what we have been doing all this time
so this is not going to be a brainer so
all we are going to do over here is
going to go give it a dresser space I'm
going to make sure that it's an address
space that's going to be something
unique so I'm going to actually note
that I'm going to do a 16-bit mask just
for my purposes here I will leave
everything else default we know how to
create a virtual network and that's all
we'll do to create this virtual network
v-net East now we are also going to
connect it to another virtual network
and like I said that another virtual
network could be anywhere else it could
be some other subscription it could be
some other company other account
whatever but for our purposes we are
going to use the same subscription
because this is the most handy thing we
can do and it is it is still following
the same steps so let's go to new
network services virtual network custom
create so we are just creating another
virtual network and we are going to call
this vennett West ok and just because
this is West is West us technically even
if it's the same subscription just by
telling this this is going to be West
USA you are actually physically on
totally different space or data center
when it comes to this V nodes but it's
just that it's so transparent to you
that you don't realize that we are not
going to do the side to side here and
this addresses space like I said you
cannot overlap so we want to make sure
that these are not overlapping so 192
168 so if this was your on-site Network
you'll be putting your on-site network
over here so I'm glad there's a space
for your on site so you need to make
sure that when you are creating the
v-net in cloud it's different so we are
going to do this as well so for our
purposes and I keep reiterating this
just to make sure that you completely
understand what we are doing here for
our purposes
are doing these to v-necks here but
these to v-necks are completely
physically located in two separate data
centers so it come it properly simulates
or it properly I should have used the
word simulates it properly does it side
to side tunnel okay so I think both our
sides are done now this is the same if
you are doing the v-net east and this is
the only virtual network you would have
and you want to connect to another site
you have to provide that site
information correct so in here you'll
see a tab called local networks this
local networks is actually your
on-premises networks or with perspective
of v-net East this local network means
the other side okay so in local networks
over here at a local network so we would
put your on-premises information here in
our case the on-premises what in our
case the on premise is the v-net west or
the other side so here what we are going
to do is we would ideally put the name
of that on premises and the VPN IP
address right this VPN IP address was
the same thing which when we were
creating the v-net and we're checking
the box was asking the VPN IP address of
the other side so this is some summary
you can come and do this manually so we
will call this on-prem west since we are
talking about each right now the on-prem
is going to be west and like i mentioned
we do not have this gateway information
yet because we have not really created
the gateway so for now we just do
something like this as a place holder so
this is just something random a place
holder to just create this and I'll show
you why it's important to create this
now if the specific the address of space
so we know that West address of space
was 192 168 that's 0 0 and it was 16
right so the address of space we had put
for the West Network was this one so we
are going to put that address the space
in there click OK now that was for v-net
East and chances are if you're doing
this in production and you're not doing
a v-net to V net connectivity you are
done so you put your local networks you
put your own premises so we are telling
v-net East you're going to connect to
your on-premises network the other side
with this public IP address over here
and you're good to go we should have
been fine but since this is a minute to
v-net and we are simulating this entire
thing in this one subscription we need
to also specify the on-premises network
for v-net west so we go back to local
network and we will add another local
network add local network and this time
it will be the on-premises East so it's
on prayer East do we know the VPN
gateway IP address yet no so we'll just
put out of the placeholder do we know
the IP range absolutely
we know type a rage for our East which
was ten dot one dot and it was a 16 bit
mask as well which is 255 255 0 0 so do
this and that's it so you have specified
both the sides for both these V Nets it
initially seems a little confusing but
you just have to remember it has to
crisscross so if your v-net East goes to
on-prem west and you're on / on your V
net waste goes to on-prem East to
actually create that tunnel so going
back to our slide we created the v-net
East that we are saying that go to the
on-prem to get information for the other
gateway and we're telling v-net West go
to
to the on-prem at East or just calling
it on print but you're going to East and
yet this gateway information the reason
we put a placeholder here called one dot
one dot one dot one and 2.2 2.2 is
because we did not create this gateway
and we do not have that IP address yet
once we create that gate where we get
the IP address we are going to go back
and put that in but unfortunately when
we are creating the site it looks for
the on-prem and it's one of those loops
we need to get off so we are just doing
a placeholder so let's go back to our
machine so so far so good
we have created the on prep now let's go
ahead and create the gateway for H so
let's go to V net east and I want to
actually go to configure here and what
I'm going to do is that I'm going to
actually say that who is going to be the
local network to this guy so this is the
V net East I want to tell this network
that go connect to an on-premises
network or the other site and your local
network or the on-premises network or
the other side whichever terminology you
want to use is going to be on Prem West
so V nearest is connecting to on Prem
West and doing so you can see it created
a gateway so when you uncheck this
there's no Gateway but just because we
are saying connect to a local network
which means do it side to side it's
actually going and creating this get
something ok so we are okay over here
we need East connecting to on Prem West
let's go ahead and save that when you
save that it actually starts creating up
I mean it creates the virtual network
settings for that let's go back now and
we're going to go to V net West and envy
net West when we go under configure we
are saying
that you also need to connect to another
site and that's going to be on print
East okay and it did not create the
subnet but that's okay I mean it did not
create the subject for the gateway so we
click on this and it will will take the
default settings it will create that it
will create the gateway over here get
read something go into the dashboard
oops sorry
forgot to save this go into the
dashboard over here for v-net east or to
show you something interesting
look at this so your Vinit East is now
trying to connect to on-prem West so
this site is trying to establish a
tunnel with this site the tunnel is not
yet created or established because the
Gateway was not created we just so far
have provided the topology in the cloud
saying that hey you are connecting to
this guy but we have not actually done
anything to connect to this so this V
Nets get where now needs to be created
we faked this site gateway right so if
you go back over here we are faking the
on-prem West Gate Way by one dot one dot
one dot one and your virtual network is
thinking that okay that site is already
set up but it's not but we are just
going to do that in a bit but for now
you need a gate rail on this site to
connect to your own premises get wet so
let's go ahead and create the Gateway
and here you need to choose dynamic
routing because for site to site you
need dynamic routing click on yes and it
will try to create the gateway now for
v-net East this is similar to what we
did last time when we're doing the point
to site
similarly for V net West we are
connected to one prime East we affect
the site but this side you still need
the Gateway and we are creating the
Gateway now with the dynamic routing
okay once these gateways are created so
the V net East's gateway is created and
v-net West gateway is created we are
going to come back to the local network
and we are going to change that with the
VPN gateway address so if you have
already like drawn this picture down you
can understand that those two public IP
s for each gateways are required to
setup this this gateways take some time
up to fifteen twenty-five minutes fifty
to twenty five minutes or even more in
some instances to bring this gateway so
I will pause the video but just while
this is happening I'm going to go back
over here and create a new network to
show the steps you would be taking for
the site to site on-premise because now
it's going to make it a little bit more
sense so what we are going to do
is we go to custom create a network so
this would be your cloud network or
cloud v-net and do whatever central us
you would actually do a configure
site-to-site and look we already have a
local network is specified that's why it
came over here or we could have done a
specified local network so if you did
not have any local network this would
what it would be click on next this is
where you would actually put your
on-prem Gateway information you would
already know this IP address because
your on-premises firewall or edge device
already has that capability so you just
take that information from there and
this address over here would be your
on-premise networks address space and
which is already known so if you are
using tender 3.00 in your own premises
for your inside network you would
actually put that over here so just
because we are doing envy net to v-net
we did not have the gateways already
created it's just the limitation of how
the gateway has recreated later on we
ended up doing this so let's cross that
because we are not going to really do
this and I'm going to pause the video
and come back when this both gateways
are created for both ends okay so the
gateways have been created so if I go to
the V net East right now took about like
30 minutes by the way for the whole
thing to do you can see that there's no
error for the Gateway and the Gateway IP
addresses have shown up so the V net
East Gateway IP is this one and V net
West the Gateway IP a it's going to show
up momentarily here so that was the
information that was missing earlier and
this is why when we are doing the local
networks we couldn't do this so let's
take this IP addresses so if we are
going to do the V net East first so I
need to change the v-net East local
network as well with this IP address so
let's copy this this is what
it's going to be the Gateway for the
West you know on premises you don't
actually have all this information like
I mentioned before so let's go to the
local networks so for on-prem East where
we had two two two two as a placeholder
let's edit that and let's change that
with 23 101 one forty five to fifty to
twenty three dot 101 dot one forty five
to fifty two you want to absolutely make
sure that this address is right so it's
going to cause a lot of grief later on
okay remains - everything else is - it's
the same now for on-prem West we're
going to do the same thing as well
this was the placeholder but we are
going to change this with this IP
address that I just realized you can
just take this enter a copy and paste
okay
okay so as you can see the Gateway
addresses now have showed up in the
local network so before we actually go
and start establishing the tunnel I want
to first create the virtual machine so
let's go to the slides over here this is
where we are we just created the gateway
and we put the gateway information on
the on premises for each side but we
have not really established the
connection yet and we have not created
or assigned the pre shared key yet so
those are the two steps we have left
before that I want to create these
virtual machines in their respective
virtual network and show you that there
is no connectivity between those two so
let's go ahead and do that I'm not going
to take too much time explaining this
one because we have two done this down
so many times so Ranger VM is reserved
one I will just give it a second seven
gigs putting my username and password
and this is going to be actually the VM
that's going to be associated with the
v-neck East so everything over here is
fine it's going to be associated with
v-net East this is the subnet everything
else here remains default you go to next
we are going to create the second VM and
this is going to be in v-net West the
name for this VM is going to be Ranger
VM 0:02 ok make it similar
information this is where we want to
make sure that it's convenient West
default subnet addresses space
everything else looks the same icon this
okay
so let's pause this and I'll be back
when these virtual machines are up and
running and I'll already be into both of
them as well okay so the virtual
machines were created and I have RDP
into both Ranger VM 0 0 1 and range your
VM 0 0 to range your VM 0 0 1 belonging
to the east
v-net so that's the East USO - and range
of VM 0 0 - is in the West us ok and
they they completely belong to separate
networks so Vienna D is then Venus quest
so these are the IP address so these are
the dips so given the range of the east
10100 it went and picked up 10 1 0 4 and
this one is in the West it picked up
totally different range 192 168 0.4 so
what I'm trying to demonstrate right now
is that these are two separate v-net or
technically these are two separate
environments so this could be your on
premise for example and this is your
cloud so when you go over here and do
peeing 192 168 0.4 technically nothing
is going to reply and I just also want
to let you know while I'm doing this is
that I did enable the Windows Firewall
because the whole pinging doesn't work
that the firewall is being disabled so I
just want to ensure that you you
actually do this well before you
actually practice our go through this
demonstration you want to make sure the
firewalls are turned off so it's you're
not getting the time box because of the
firewall ok so as you can see it cannot
reach this side and this side 10.1 dot
it's not going to reach the other side
as well
ok so what have we done so far
we created the virtual machines in the
virtual networks the virtual networks
were created we have established the
local network we went we went ahead and
edit the VPN gateways
we got the public IP addresses and in
all of this when you go to configure
envy net in configure you can actually
go and see that they are configured to
side to side connectivity right so we
have done all of this as well so there
are two things that are left to be done
the first thing that's left is to add
any you can see that it's actually
trying to connect and it cannot
establish the connection it's disconnect
data still and it says it's its previous
state was initializing but it's not
connected and the reason it cannot
connect yet is because we have not
created the pre-shared keys that is
vital for an IPSec VPN tunnel so the way
you are going to create a pre shared key
is you can come over here in v-net East
and you can see that there is a managed
key over here
great so you can take this and put it in
both locations in the manage key and
that's how you'll be sharing the key
the other thing I want to want to let
you know over here and this is more
important when you are doing this with
your own premise network so and not only
for your exams but your on-premise
network because you are extending your
data center right there is something
over here once you create the gateway
it's called download the VPN device
script so let's click on this what Azure
has done is that when you click on this
it asks you that what is your on-premise
device so Microsoft has this list of
supported and compatible H devices that
you can have on your own premises which
can create or or establish a tunnel with
your virtual networks and based on
whichever device you have if you come
and choose for example you are doing
something from Cisco and you choose the
platform so you pick like an essay
device which is a very popular firewall
and H device for Cisco then you can put
the software version and you click OK
what Microsoft will do is that it will
generate a script file that you can
follow so it's a configuration file CFG
so let's actually save this and put it
on the desktop so we can actually open
this up and I can show you what it does
so let's take this and open it for
example notepad and you can see that
Microsoft has created the commands and
are the the configuration that you
actually have to put in your age device
to have the tunnel up and running so
it's actually giving you all the pure
addresses for the gateway so technically
you should be able to take this
configuration and put it in Cisco and
say and you aged device will have the
tunnel created to do this in for for our
case that's that's really not the
scenario because we are actually doing
v-net to v-net where the configuration
for each other is already done so
technically all we have to do is put the
shared key and click on connect over
here and we should be good to go but
this is a very interesting thing because
my stuff is adding more and more devices
so you can actually see right now it's
supporting juniper and it's also
supporting Microsoft the reason it's
supporting Microsoft because you can use
Ras for creating an H device which
supports VPN and it will tell you
exactly what to do once you have done
that so it's it's a very interesting
tool to actually find that configuration
I have not years use this tool directly
and applied the configuration directly
but what I have done is that you know
when I was connecting a Cisco device to
to the Microsoft Azure cloud v-net I
actually took this configuration and
actually tweaked through it look through
it and you know created the connection
so it's something you have to keep in
mind when you are doing your own
premises that you can actually take
Microsoft's assistance in generating the
configuration on your H device in our
case we don't need that because we are
our both gateways are already configured
because as your created them for us so
I could perform the last step of
creating the bandage key you could do
the manage key over here but I don't
want to do it over here I'll show you
how to do that in PowerShell because
this might be important for you exam so
we will be doing both the gateways from
here ideally if it's like is on previous
to cloud you probably just do the one
for the cloud over here and with the
configuration script you do it on your H
device but since both of our vinnitsa in
the same subscription we are going to
pass both commands over here so the
command later is set as your v-net
gateway it's actually getting a key so
we're creating the passphrase of the key
so this is where you put the V net name
so the name we have for our first Vinit
is V net East's we are creating the key
for variant east and we are telling that
you are going to connect to your
on-premises or to the other side or
microsoft azure calls it local network
site name and we are going to put it on
v-net waste
okay and the shared key would be
something simple 1 2 3 4 60
so this is for our gateway on the v-net
east so the v-net east and we are saying
your site is on the local settlers
network site name is vini quest with the
shared key let's hit enter on that takes
a little time to actually do that and I
think I messed up somewhere sorry this
is where I made mistake our local
network site name is actually not called
v-net West it was called local networks
it was called on-prem West good it
happened over here so we are saying the
v-net the Vinit
East is connecting to the local network
site name which is on-prem West and a
shared key three one two three four ABCD
okay I ended up putting both video names
up here so which is obviously not going
to work because technically v-net East
does not know what vedette West is all
it knows is that the other side is
called on-prem West so it takes a little
time to generate that and set that up on
the Gateway okay so it's saying that
it's successful said it's it set it up
we're going to do the same for the other
way round right because so you'd be
doing this on the other subscription or
the other v-net on another organization
or you'd probably not do that at all
because your on-premises device is like
an AAS a from Cisco or some other device
but since we are doing VIN it to VIN it
we are going to do this here so it's the
same command set as your v-net get wakey
this time the V nickname is going to be
V net West and the local network site
name is going to be on prime because
it's from East from West this time so
it's going to be on prim East and the
shared key is going to be the same so
you have to have absolutely the same
shared key otherwise this is not going
to work
CD let's say to interpret that and we
are going to wait okay so the other side
is done as well so if we go to v-net
East right now and we could manage key
you can see that it will actually bring
up the manage key that was there so you
can set this up here as well but I
wanted to show you how to do that in
PowerShell
okay so let's go to our slide and see
what we have done so
far so we have planned the IP addresses
we created the virtual networks on both
sides we added that load local networks
which is the on-premise network we
created the dynamic routing gateways and
we went and change the dynamic routing
gateways IP addresses because we had a
placeholder and we have set the pre
shared key and now all that's left is to
connect the VPN gateways so the way we
do that is that you come over here and
each minute and click on connect go to
veena quest scroll down
correct what I have seen is that even
when it says it's successfully enabled
the connection for for whatever reason
it might not show that it's connected
right away so it might take few minutes
for the image over here to update and
show it's actually connected so in this
scenario you can see it shows now it's
connected so the tunnel is up and
running and a good reads
good way to check that is that we can
see some data is actually flowing
between this two tunnel this tunnel over
here so right now it actually came up
like within few seconds but I have seen
this take up to a couple of a couple of
minutes to show that it has been
connected but when you see this diagram
right now it means that this site has
connected to this side this side has
connected to this side essentially
establishing a VPN tunnel so the only
thing left right now since this is a
site-to-site connection means you are
connected with your cloud to your
on-premise and everything the only thing
left is to actually verify if that
worked so let's do an IP config here on
range of vm 0 to i click configure so we
can actually get this IP addresses if
you recall the last time when we try to
ping each other this did not work
because obviously they're on to secluded
Network two sites one is 10 years to USA
and others in West USA to separate data
centers so these two sites are not
connected there was no way they will
access each other through the tips
because you know they are not sharing
the same space but now that the tunnel
is up and running
this guy is 10 1 0 4 so I should be
pinging the other guy 192 168 ranger VM
0 0 2 which is in West USA and the IP
address for that is 192 168 0.4 so if
everything worked out the tunnel is up
and running and everything we should be
able to ping them and that's right we
can ping this on this side as well
paying 10.1 dot 0 dot 4 absolutely we
can ping this because we
reach each other on a separate network
separate a dresser space just because
the tunnel has been created between
these two sites so if your Ranger VM
0:02 was on site on premises and this
was on the cloud Ranger VM zr1 you have
just extended your data center to the
cloud and this is one of the most
important cloud concepts that you learn
which is extending your existing data
center to the cloud if you will keep
hearing that for sales page for
technical aspects everything and we have
just accomplished that yes we cheated a
little bit by creating this on a little
V net but this is something that you can
do right away you can do this on your on
your subscription trial subscription and
get this thing up and running it is the
same steps you do side to side for on
premises and your own cloud and you are
capable of practicing this for your
exams as well as production using the
same subscription I could very well be
doing this on two separate subscriptions
or you know anything as long as these
two virtual networks have the Gateway up
and running so if you go to over here
you can see that it actually has the
Gateway and you have done the pre shared
key and you have made sure that you have
described each other's local network you
are good to go
so that's all there is to site to site
or VIN it to v-net vida to VIN it
connectivity and the let me see I think
we covered pretty much everything when
you do this just make sure that you do
not forget to turn the firewall off the
first time I did this you know the side
was up and running but I couldn't ping
it just then I realized that you know
the firewall was not not not deactivated
either production chances are you
probably don't want to do this or you
want to actually go and make the proper
configuration to allow that in firewall
rather than turning them off
now one thing came up that I want to
talk to you about is that on premises
you will have a device you'll have a
Cisco device you'll have a I don't know
any any even Microsoft adder AAS or
whatever to create your VPN the Aged
device you do not need an edge device in
or as your subscription so do not think
that you have to go over here and create
an appliance or create a virtual machine
and enable Ras to create a tunnel or
anything as long as you have the Gateway
the Gateway is the appliance or the
Gateway is the edge device that you need
so to make things very simple Microsoft
actually provides you this so this
actually creates web roles in the
backend and Microsoft spins a bunch of
stuff to make sure that you actually
have a gateway it's not as simple as
this that's why when you create the
Gateway it takes so much time because
it's doing a lot of things at the back
end to ensure that you actually have an
edge device attached to your v-net so
you do not need any virtual appliance or
anything to create this tunnel it's
provided to you as long as you have this
gateway ok and that's one important
thing of course for your on-premises you
could have a virtual appliance or you
could have Microsoft router as you could
have Cisco I don't know Netgear or
lynxes whatever can create an IPSec
tunnel so it should be able to do the i
ke protocols and everything so you'll be
ok so that's all there is to it so let's
go back to our slides this is a link I
want you to visit it's the VPN devices
for virtual network connectivity so
Microsoft has this entire list of all
the virtual appliances or not virtual
appliances just get where devices like
routers Cisco f5 or you know Citrix and
all these devices that Microsoft
supports so it's a very interesting
place to actually make sure that you
have a device which supports the tunnel
creating the tunnel side to side tunnel
with the v-net or if you're planning to
purchase one this is where you should be
really going to ensure you have the
right device to do that chances are your
current edge device already supports
this and even if it's not on the list so
once I try to do this in my home lab so
I'll try to extend my home lab to the
cloud and I have a lynx as device
supports IPSec VPN and I was able to use
the configuration downloaded from
Microsoft site and just put in that
information and do the pre shared key
and I was good to go okay so it's a very
important site for your production to
refer before you go and invest in a
device alright so that concludes our
site to site or vignette to vennett
connectivity as usual our training site
is at cloud ranger net forward slash as
your training YouTube with that cloud
ranger network Twitter and cloud ranger
blog email at shown at cloud ranger
to.net please go ahead and ask your
questions on youtube videos comment
section or by blog comment section
that's the easiest place to reply to
your questions keeping in mind that
other people may have the same questions
and and they will benefit from the calm
your comment being there do not forget
to like the videos it works as an
encouragement and for anything else and
even if you have questions I will try to
reply if you email me at Red Cloud
Ranger dotnet but obviously time
permitting it might take some time to
get back to you I try to respond to most
emails that are sent to me so but like I
mentioned it's better if you have
questions to ask on the comment sections
for both blog at the YouTube video
alright so that's it for this session
thank you for viewing and I'll be seeing
you in the next session