Hello, Cloud Gurus, and welcome back.
In this lesson we're going to take a look
at how you can provide hybrid name resolution.
Let's take a look at what we're going to cover.
First up, we'll take a look at Azure Private Link
as it's one of the Azure services
that's a little trickier to manage
when it comes to name resolution.
And then we'll take a look at hybrid DNS.
We'll also cover split-brain or split-horizon DNS,
and then we'll wrap up with some DNS troubleshooting tools.
Let's get started.
Up until now, we've only really talked about
virtual machines being connected to virtual networks,
but it doesn't stop there.
I want to introduce you to another Azure service
that can be integrated with virtual networks,
and that is Azure Private Link.
Typically, when your Azure virtual machines access
a platform as a service offering, like Azure Storage,
that traffic flows over the internet
to a publicly accessible endpoint for that resource.
But that might not be desirable for a number of reasons,
and one of the key reasons is that it increases your risk.
A simple misconfiguration could expose your resource
to the entire internet.
And that's where Private Link comes in;
it allows private access via private endpoint
which is a special network interface deployed
to a virtual network.
When you use Private Link, traffic is sent
via the private endpoint instead of via the public endpoint.
And what's great about Private Link is that it is accessible
from all connected networks including
peered virtual networks and your on-premises networks
that are connected via VPN or ExpressRoute.
But there are some DNS challenges with Private Link.
When your resources try to access the platform-
as-a-service resource, they will perform a DNS Lookup
for the name and that will return a public IP address.
To get around this, it's recommended that you integrate
your Private Link enabled service with a private DNS zone
so that when the resources in the virtual network
perform a DNS lookup for a platform-as-a-service resource,
Azure instead returns a CNAME or alias
for the private resource name,
which in turn provides the private IP address.
Now let's put all of this together and take a look
at the hybrid DNS big picture.
As we learned in the previous lesson,
Azure provides a recursive DNS server
via the 168.63.129.16 virtual IP.
And that virtual IP will respond with resource records
from your linked private DNS zones and any
Azure public DNS zones and all other DNS records
using recursive look outs.
But there is one key gotcha to be aware of.
Let's say that you have an on-premises network
and an Azure virtual network and they're connected
via ExpressRoute or VPN, and you have a VM on-premises
and it needs to resolve the DNS name for a private endpoint
in the Azure Virtual Network.
You can't use the Azure recursive DNS server
from outside of Azure, including those in private DNS zones.
So how can you solve this problem?
Well, you can configure a DNS server in Azure
and it's referred to as a customer-managed DNS folder
and you can configure your client to use that DNS server
and it will forward the request to the Azure provided
DNS server on behalf of the on-premises VM.
But you're likely not going to want to configure
all of your on-premises DNS clients to use a DNS server
in Azure.
So you can configure your clients to use a local DNS server
and then configure your DNS server to forward
or conditionally forward to the Azure DNS forwarder.
Without this configuration, your on-premises VMs
would not be able to resolve the private IP address
for the private endpoint.
Another newer alternative to deploying
your own DNS server virtual machines in Azure
to provide this DNS folding functionality,
is the Azure DNS Private Resolver,
which provides all of the important features you get
by hosting your own DNS server
without the complexity and cost of deploying and managing
your own virtual machines.
All right, now I want to change gears a bit
and introduce you to another DNS concept.
Now, typically, as we mentioned,
organizations will use a subdomain
of their public DNS name for their internal zone.
Their external DNS zone might be rivercityai.com,
and their internal DNS zone might be dev.rivercityai.com.
But this is not always the case,
sometimes they will want to use the same DNS name internally
and externally, and this is referred to as split-horizon DNS
sometimes also referred to as split-brain DNS.
The biggest advantage to implementing split-horizon DNS
is to help hide your internal network
but having implemented it before, if done well,
it can also make management and access a little easier.
You can give your internal staff the same URLs
for both internal and external resources
and they can access them easily without you needing
to create multiple CNAME records.
Let's take a look at an example of split-horizon DNS.
Let's say you have a web server deployed
to an Azure virtual network
and that web server is both accessible
via a public IP address from the internet,
and internally via our private IP address
using the www.rivercityai.com domain.
To implement this in Azure, you can create two zones,
a public DNS zone, and a private DNS zone,
and then you create an AI record in the public DNS zone
for the public IP address.
And then you create an AI record in the private DNS zone
for the private IP address.
And clients that are outside the network will receive
the external IP, and when they're inside the network
they'll receive the internal IP.
One minor issue with split-horizon DNS is caching.
Make sure to set a short time to live
on these resource records.
Otherwise, when a client moves between the internal network
and the external network, the client might try and use
a cached record to try and access the resource
via its private IP address from outside the network.
Now let's take a look at some of the common
DNS troubleshooting command-line tools.
And there are quite a few tools available
for managing and troubleshooting DNS.
So I will just go over some of the most common
command-line tools and how to use them.
If you want to display the DNS client cache
in Command Prompt, you can use IPConfig /displayDNS
and in PowerShell you can use the GET-DNSClient
cache PowerShell cmdlet.
If you want to clear the DNS client cache,
in Command Prompt, you can use IPConfig /flushdns
or in PowerShell you can use Clear-DNSClientCache.
Alternatively, if you want to register
your DNS client resource records with a DNS zone,
in Command Prompt you can use IPConfig /registerdns
and in PowerShell, you can use Register-DNSClient.
And to perform DNS name resolution, in Command Prompt,
you can use NSLookup and then the domain name,
and then in PowerShell, you can use the Resolved-DNSName
commandlet and the domain name.
All right, let's take a look at what we've covered
in this lesson.
Azure Private Link provides private connectivity
to Azure platform-as-a-service resources.
And you can integrate Azure Private Link
with private DNS zones to simplify the management
of associated resource records.
And you can deploy a DNS forward a virtual machine
to Azure.
To forward DNS requests from on-premises networks
to the Azure DNS Resolver.
And you can implement split-brain or split-horizon DNS
using an Azure public and Azure private DNS zone
with the same domain name.
Add AI records for the public IP to the public zone
and you add the private IP addresses
to the private DNS zone.
And you can use tools like IPConfig,
NSLookup and PowerShell to troubleshoot DNS.
All right, that wraps up this lesson.
Thanks for being with me and I hope you found this useful
and I look forward to seeing you in the next lesson.