Hello, Cloud Gurus, and welcome back.
In this lesson, we're going to take a look
at connecting hybrid networks.
Let's take a look at what we're going to cover.
First up, we'll explore the fundamentals
of Azure Networking,
and then we'll take a look at connecting existing networks
with hybrid connectivity,
and then we'll dive a little bit deeper into VPN gateway,
ExpressRoute, and Virtual WAN.
And finally, we'll wrap up with some details
on how you can prevent and resolve IP addressing issues
when you're connecting your networks.
Let's get started.
Before we can cover hybrid network connectivity,
we first need to cover a few Azure Networking fundamentals.
Think of this as a crash course in Azure Networking
because while it's not heavily focused on on the exam,
it's essential to understand
for some of the concepts we'll cover later in this section.
And if these concepts are really new to you,
it might be worth getting some hands-on experience
with some of these technologies before you sit the exam.
The first thing that you need to be aware of
is that all Azure resources exist within a subscription,
and you can deploy resources within an Azure subscription
across multiple regions.
And an Azure Virtual Network is a private network in Azure.
It exists in a single subscription in a single region
and acts as a communication boundary.
And you can have one or more virtual networks
in each Azure region.
Everything within a virtual network
can communicate by default.
And virtual networks can be connected together
to allow communication between the virtual networks
using virtual network peering.
And virtual networks are further broken up into subnets.
Subnets provide a security boundary.
And you'll need subnets for any virtual machines you deploy
and you'll also need dedicated subnets
for a range of Azure services.
Connectivity to a virtual network
is provided by a network interface,
which is associated with two Azure resources.
The first being the resource needing connectivity.
Say, a virtual machine, for example.
And the second being the subnet
the network interface is connected to.
Network interfaces are given one
or more private IP addresses
when they connect to a virtual network subnet,
and Azure can also associate public IP addresses
with private IP addresses to allow access
to a VM from the internet.
And we'll take a closer look at this in the next section.
And virtual networks are secured primarily
by 2 Azure resources.
The first is network security groups,
which are either linked to a subnet or a network interface.
And they control network traffic
to and from either the subnet or the network interface.
You can also deploy Azure Firewall to a virtual network.
And Azure Firewall is a stateful firewall
with advanced network security capabilities,
and can be used to control traffic
within and in and out of your virtual networks.
And Azure Firewall requires a special subnet
with the name Azure Firewall Subnet.
When you deploy Azure Virtual Network resources
you're likely going to want to have private connectivity
between your on-premises locations,
your staff and your virtual network,
and there are a few different options
for providing this type of connectivity.
Let's take a look at them.
The first option is the virtual private network
or VPN gateway.
It allows you to connect your on-premises users,
sites, and other clouds over a VPN connection,
which is an encrypted connection over the internet.
And you'll choose VPN gateway
for low cost encrypted connections
between Azure Virtual Networks and other locations.
And you also have access to ExpressRoute,
and ExpressRoute is a direct private connection
between your on-premises network
and the Microsoft Cloud.
ExpressRoute does not traverse the internet
and it supports either connectivity to virtual networks
or other Microsoft services.
Choose ExpressRoute for dedicated, private,
high-performance connections
from your on-premises locations to the Microsoft Cloud.
And finally, you can combine all of these services together
using Virtual WAN.
And Virtual WAN is a managed hub-and-spoke topology
that provides connectivity between virtual networks,
on-premises networks, and mobile workers.
Virtual WAN combines a number of Azure services
into one solution, including ExpressRoute, VPN gateway,
and Azure Firewall.
And you'll choose Virtual WAN to ease the management
of large distributed networks.
Let's take a closer look at each of these services
in a bit more detail.
Let's take a closer look at VPN gateway.
Let's say you have an Azure Virtual Network
and a subnet with some virtual machines deployed
and you need to provide connectivity
between those virtual machines and your other networks.
And you might have a branch office and some remote workers,
and you need to provide secure connectivity
over the internet.
You can deploy a VPN gateway to provide VPN connectivity
for each of these.
You start by deploying a VPN gateway
to a dedicated subnet in your Azure Virtual Network.
And note the name of the VPN gateway subnet.
It must have the name GatewaySubnet.
And then you can use a site-to-site VPN connection
for the branch office.
And you can connect multiple sites like this
depending on the VPN gateway skew that you select,
and you can use a point-to-site VPN connection
for the remote workers,
so they can connect directly from their device
to the Azure Virtual Network.
And a VPN gateway can be configured
to provide both site-to-site
and point-to-site connections at the same time.
There are 2 VPN configurations to be aware of
for site-to-site VPNs.
The first is policy based, which is based on static routing
and can be used to provide backwards compatibility
with older on-premises VPN devices.
Policy-based VPNs have several limitations,
including only allowing a single site-to-site connection
per VPN gateway.
Alternatively, you can use route-based connections,
which are based on dynamic routing
and are recommended not only because the dynamic routing
reduces the administrative overhead,
but also because they can be used to provide multi-site
and point-to-site connections
and can coexist with ExpressRoute.
Now, let's take a closer look at ExpressRoute.
Let's say again, you have a virtual network
with some subnets and resources deployed
and you need to provide connectivity
between those resources and your other networks.
You might have a colocation datacenter
with hundreds of thousands of servers
and you might have a fiber connection
between your datacenter and your head office.
For high speed, reliable connectivity
between your datacenter and your Azure Virtual Networks,
you might decide to deploy a point-to-point ExpressRoute
between Azure and your datacenter.
To deploy ExpressRoute,
there are a few important steps you need to take.
Firstly, you need to deploy a gateway subnet
and an ExpressRoute gateway,
which is a virtual network gateway
that has been configured for ExpressRoute.
Then you need to configure an ExpressRoute circuit
with the help of your service provider.
And then finally,
you need to configure a peering connection.
There are 2 types of peering connections.
The first is private peering,
which is used to provide connectivity to a virtual network,
like what we're demonstrating here.
And the second is public peering
which is used to connect to the broader Microsoft Cloud
and things like Microsoft 365 and Microsoft Dynamics.
All right, now let's take a closer look
at Azure Virtual WAN.
Azure Virtual WAN can be used
to bring together multiple Azure services
into one easy to manage resource.
And there are a number of ways
to configure Azure Virtual WAN.
So let's just take a look at some of the basic steps
to configure Virtual WAN with a site-to-site VPN connection.
You start by creating a Virtual WAN resource
and this is used to house all of the resources
that are associated with your Virtual WAN.
And then you create one or more hubs in your Virtual WAN.
And a hub is a Microsoft managed virtual network
and it acts as a concentration point
for your connectivity to your Virtual WAN.
And you can configure one hub per region
and you can expand across multiple regions
by deploying multiple connected hubs.
The next step is to create a VPN site.
And VPN sites represent your remote networks,
such as your branch offices.
And then you connect your site to your hub
using a site-to-site VPN connection.
And then you might connect additional networks and resources
starting with your virtual networks,
so that your remote networks can access the resources
in your virtual network, but you don't need to stop there.
If you create a standard Virtual WAN
instead of a basic Virtual WAN,
you can connect ExpressRoute circuits,
say, for your head office,
and you can also connect point-to-site connections
for say, your remote workers.
And you can secure your virtual networks
with Azure Firewall.
And you can even deploy third-party
network virtual appliances.
And all of the routing to allow each of these resources
to communicate with each other
is managed by Azure Virtual WAN.
All right, let's jump over to the Azure Portal
and take a look at Azure Virtual WAN.
All right, so here we are on the Azure Portal.
Let's go ahead and take a look at Azure Virtual WAN,
and we're just going to search for Azure Virtual WAN
and then we'll select Create Virtual WAN.
We'll go ahead and select a resource group
for our Virtual WAN.
And we're okay with the default location
for our Virtual WAN,
and now we're just going to provide a name.
And the types of connectivity
you can use for your Virtual WAN
will depend on the type of Virtual WAN you create.
Standard Virtual WANs provide support for ExpressRoute,
site-to-site VPN connections,
and point-to-site VPN connections.
If you choose a basic Virtual WAN,
you're only going to be able to use
site-to-site VPN connections.
Let's go ahead and create the Virtual WAN.
We'll wait for this to validate and then we'll hit Create.
This will just take a moment,
so we'll come back when this is done.
All right, with our Virtual WAN created,
let's go ahead and navigate to our Virtual WAN.
And the first step is to create a hub,
and you can create one hub per Azure region
and then you connect your other networks to the hub.
So we'll navigate to Hubs, we'll select New Hub,
and we'll provide a name for our new hub.
And because a hub is a virtual network managed by Microsoft,
we need to provide an address space for our hub.
And the hub should have an address space
that doesn't overlap with any of our existing networks.
We're just going to use 10.0.0.0/16,
and you can see that when you create your hub
you can configure it for site-to-site VPN connections,
point-to-site VPN connections, and ExpressRoute connections.
We're going to go ahead and just create it
without any of this connectivity for now,
and then we'll go ahead and click Create.
This will just take a moment to deploy
so we'll come back when this is done.
All right, with our Virtual WAN hub now created,
we now need to create a site
to represent one of our remote networks,
say, one of our branch offices.
So we'll going to navigate back to our Virtual WAN.
And then we'll navigate to VPN sites
and we'll click Create Site.
And we need to provide a region for our site
and then we need to provide a name.
I'm just going to call this branchoffice.
And then we need to provide a device vendor,
which represents the remote VPN device
that's being used at that office.
I'm going to going to type in Cisco for this,
but it could be any of the device vendors
that are available for VPN devices.
And we'll go ahead and select Next for Links.
Now, a link represents the connectivity to your office.
And an office might have, say, a primary internet link
and then a backup internet link.
So let's go ahead and create a link for this office.
I'm going to call this link name Primary
and then I'm going to specify a link speed,
and this is the speed in megabits per second.
And then you need to provide the link provider name
and this is your internet service provider.
So I'm going to provide Verizon for this link provider name,
and then you need to provide either the public IP address
or the fully qualified domain name for your remote network.
And then if you're using BGP for routing,
you can go ahead and add your BGP details here.
We're not going to create this connection.
Instead, I'm going to navigate back to the Virtual WAN
so we can take a look
at some of the other configuration options.
And now let's take a look at point-to-site VPN connections
by selecting user VPN configurations.
And then we're going to select
to Create a User VPN Configuration,
and here you can provide a name for your user VPN.
You can select the type of tunnel
and you can configure IPsec,
and then you can configure how your users will authenticate.
They can authenticate using an Azure certificate,
RADIUS authentication to support something
like Active Directory Domain Services,
or they can authenticate with Azure Active Directory.
We'll go ahead and cancel this.
And then finally,
you'll connect your Virtual WAN to Azure Virtual Networks.
So we'll go ahead and select Virtual Network Connections,
and from here,
you can connect your hubs to virtual networks.
All right, let's navigate back to the hub.
And I just wanted to also show you
that you can connect your hubs to Azure Firewalls
and network virtual appliances.
All right, that wraps up this demo. Let's continue on.
All right, now let's talk
about resolving IP addressing issues in hybrid networks.
Sometimes your networks won't be planned
as well as you'd like.
You can spend a heap of time
carefully planning out your IP addressing
to make sure you don't get any overlapping
IP address ranges,
and then your company goes ahead
and merges with or acquires another company.
And they might use a range of IP addresses
that you also use, but that won't stop your company
needing to connect their networks
with the new company's networks.
So how can you go about resolving this issue?
Well, Network Address Translation, or NAT,
can be used to resolve some of these issues.
In its simplest form,
NAT translates one IP address to another.
So you can use it to translate non-routable addresses,
one that overlaps, with a routable address
so the network traffic can find its way back.
And NAT is supported on virtual network gateway
with support for Azure Virtual WAN and VPN gateway.
Let's take a look at what we've covered in this lesson.
A route-based VPN gateway can be used
to configure multi-site and point-to-site connectivity
to Azure Virtual Networks.
ExpressRoute private peering can be used
to configure private connectivity
to an Azure Virtual Network,
and Azure Virtual WAN in can be used
to configure multi-site, point-to-site,
and ExpressRoute connections.
And virtual networks can be secured
by network security groups, Azure Firewall,
or network virtual appliances.
And Network Address Translation can be used
with VPN gateway and Azure Virtual WAN
to resolve IP address overlapping issues.
All right, thanks for being with me in this lesson
and I hope you found it useful.
And I look forward to seeing you in the next lesson.