Good day, Cloud Gurus, and welcome back.
For this lesson, we're going to take a look
at managing Azure Virtual Machines.
Let's take a look at what we're going to cover.
First up, we'll take a look
at managing virtual machine compute.
Then we'll take a look at managing VM storage.
We'll also take a look
at managing virtual machine networking.
We'll take a look at how you can securely connect
to your virtual machines.
And then finally, we'll go through and take a look
at some Azure Portal troubleshooting tools.
Let's get started.
Now unfortunately for us, Microsoft likes to test us
on how well we know the limitations and gotchas
around managing Azure Virtual Machines.
Let's take a look at some of the common actions
you might perform when managing compute
for Azure Virtual Machines.
Firstly, you need to know
that you can change the size of a VM.
For example, you can change from an F-series VM
to a D-series VM, but the VM will be restarted when you do.
And some VM sizes require you to stop the VM
prior to attempting the resize.
And this is due to how Azure datacenters are designed
on the back end.
Also, if you move away from a VM
that supports Premium Storage,
you know, one of those s VM sizes,
you will lose access to the Premium Storage
as part of that move.
You can also move to a VM without a temporary disk,
but you must move the page file before you do.
All right, now let's take a look at managing VM storage.
You might have situations
where you need to swap the operating system disk.
And I've seen this where a Windows patch
has killed the server
and I've needed to restore that server from a backup.
It's important to know that you must stop the VM
before you can swap the operating system disks.
And it's good know that you can add data disks to Azure VMs
while they're running,
but you must attach the disks or stop the VM
if you want to change the performance
or the capacity of the disk.
And this is actually an annoying limitation in my opinion.
I've had servers that have filled up a data disk
and I've needed to shut down that VM
to increase the size of the disk.
You can also change the drive letter for the temporary disk
from D drive, but there are a few limitations around this.
The first is that you need to relocate the page file,
but Azure may also change the drive letter back
so just be aware of that.
I suggest leaving your temporary disk as D drive
unless you've got a really good reason to change it.
All right, now I want to cover off some VM networking facts
that are important to know.
Firstly, it's important to know that a single VM
can have multiple network interfaces attached.
And you can attach or detach a network interface from a VM,
but the VM needs to be stopped.
But all of the network interfaces
must be connected to the same virtual network,
but you can connect multiple network interfaces
to the same subnet if you need to.
And you might connect multiple network adapters
to virtual network appliances, like firewalls.
And even though you can attach multiple network interfaces
to a virtual machine, the network throughput is determined
by the virtual machine size.
And each network interface
can have an associated public IP address.
And the associated public IP address can be used
for inbound connectivity from the internet,
and it can also be used as the IP address that's used
for outbound connectivity.
Azure does a Network Address Translation rewrite
to replace the source IP address with the public IP address
for outbound traffic.
And you can also control the path or route
that VM traffic takes by attaching a route table to a subnet
that a network interface is connected to.
It's important to note here
that the route tables are not associated
with the network interfaces,
they are associated with the subnets.
And finally, traffic to and from
a virtual machine network interface is controlled,
either allowed or blocked, by network security groups
which you can attach to a subnet or a network interface.
Now from time to time,
you're going to want to connect to an Azure VM
to manage that VM.
And to be honest,
if you're leveraging remote management capabilities,
especially those that we'll cover later in the course,
this will be something that happens less and less often,
but it will still happen.
So let's take a look at how you can connect to your Vms,
and more importantly, how you can connect to them securely.
The first option is to connect to your VM directly.
Let's say that you have a VM deployed to a virtual network
and you have an administrative work station.
Let's say for our purposes
that the administrative workstation
is not on the private network,
but rather it's out on the internet.
But most of what we're going to discuss applies equally
to both private and public connectivity.
You can assign a public IP address to the VM,
attach a network security group,
either to the network interface or the subnet,
and allow management port access to the VM
over the internet.
And you can permanently allow these management ports,
like Remote Desktop on TCP port 3389
and Windows Remote Management TCP ports on 5985 and 5986.
But as you would expect,
this can present some security risks,
especially when you're accessing the VM
via the public IP address.
So what can you do to secure this connectivity?
Well, Microsoft provides a few options.
The first is to implement just-in-time access.
Just-in-time access allows you
to provide time-limited access to management ports
for specific users.
Just-in-time VM access is a feature
of the Microsoft Defender for Cloud solution,
and it requires a network security group
linked to the VM NIC, subnet,
or an Azure Firewall deployed.
Another alternative is to deploy Azure Bastion.
Azure Bastion provides secure web-based access to VMs
and you don't need a public IP address assigned to the VMs.
Deploying Azure Bastion requires a special subnet
named AzureBastionSubnet,
with at least a /27 CIDR address range.
And you connect to Azure Bastion from the Azure Portal
and it acts as proxy
and provides management access to your VMs
using Remote Desktop Protocol, SSH,
or custom ports if you're using the standard bastion SKU.
To connect to a VM using Azure Bastion,
you need the Azure role-based access control reader role
on the target VM, the VM network interface,
and the bastion resource.
All right, let's take a quick look at a demo
of just-in-time VM access and Azure Bastion.
All right, here we are on the Azure Portal
and I've gone ahead and navigated to a virtual machine.
And you can see that this virtual machine
has a public IP address associated with it.
Let's take a look at the networking
for this virtual machine.
So we'll navigate to Networking under Settings.
And we can see that this virtual machine
has a network security group associated with the subnet
that its network interface is connected to.
And we can see that there's a network security group rule
that is allowing Remote Desktop Protocol traffic
from any source,
to the subnet that this virtual machine is in.
And Microsoft is indicating with this warning
that this is not secure.
So let's go ahead and secure this a little bit.
First, we'll navigate to Microsoft Defender for Cloud.
And then we'll navigate down to Workload Protections.
And then we'll just scroll down a little bit
and we'll navigate to just-in-time VM access.
And the virtual machine that we want to figure
just-in-time VM access for is not configured currently,
so we'll select Not Configured.
And then we'll select the virtual machine
that we want to enable just-in-time VM access for,
and then we'll select enable just-in-time on one VM.
We can use the default management ports here,
so we'll go ahead and click Save.
This will just take a moment to save.
So we'll come back when this is done.
All right, just-in-time VM access has been enabled
for this virtual machine.
Now let's go ahead and navigate back to the virtual machine.
And then we'll navigate into the Networking settings again.
And we can see that there's been a new rule created
by just-in-time VM access.
So we can go ahead and remove
that allow Remote Desktop Protocol rule.
All right, with that rule deleted, we can now go ahead
and try and connect to this virtual machine
using just-in-time VM access.
So we'll go ahead and navigate back to the virtual machine.
And then we'll select Connect,
and then we'll select Remote Desktop Protocol.
And we can see it's asking
which IP address we want to request access for.
So I'm going to go ahead and select My IP
and I'll go ahead and select Request Access.
This will just take a moment to complete.
All right,
now it's successfully configured just-in-time VM access
to allow me to connect to Remote Desktop Protocol
using my IP address.
Let's take a look
at how the network security group rules have changed
now that I've been granted access.
So I'll navigate back to Networking.
And we can see here that there's a new rule created
just for my IP address
to allow access on Remote Desktop Protocol port 3389
to the destination IP address for this virtual machine.
All right, now let's take a quick look
at configuring Azure Bastion.
To do that, we'll navigate back to the overview page
for our virtual machine.
Then we'll select Connect and then we'll select Bastion.
And we're just going to go ahead
and create it with the defaults.
So we'll select the option to deploy Bastion.
This will just take a moment to complete.
So we'll come back when this is done.
All right, with Bastion deployed,
we could now go ahead and connect
using our username and password.
But instead of doing that,
let's go and have a look at what has been deployed for us
as part of this Bastion deployment.
So we'll navigate to our Bastion host here.
And we can see that the Bastion host has been created
and it has created a new virtual network subnet
for this Bastion host.
And it's created a public IP address for this Azure Bastion.
We could now go ahead and remove the public IP address
from our virtual machine
and remove the network security group rules
that allow remote access from the internet.
All right, that concludes this demo. Let's continue on.
Now, let's take a look at some of the management actions
you can perform directly in the Azure Portal.
One example of this is run command,
which uses the VM agent to run scripts
inside the VM operating system.
And you can also run custom PowerShell scripts
using Run command.
You can also use boot diagnostics
to view the startup console log and capture a screenshot
of the pre-operating system boot environment.
And boot diagnostics requires a diagnostic storage account.
And your diagnostic storage account can be managed by Azure
or you can choose to manage it.
You can also perform advanced troubleshooting
using the Serial Console, which can assist with VMs
that are experiencing serious issues with networking
or the operating system.
The Serial Console requires
the virtual machine contributor role
and requires boot diagnostics with a custom storage account.
All right, let's take a look at a quick demo of run command,
boot diagnostics, and the Serial Console.
All right, so here we are back on our virtual machine.
Let's first take a look at run command.
We'll navigate down to Operations
and then we'll select Run Command.
And you can see here,
there's a range of troubleshooting scripts available
that will help you resolve issues
with your virtual machines.
Things like fixing remote desktop settings,
remote PowerShell,
resolving issues with the administrator account,
and also running custom PowerShell scripts
to troubleshoot more advanced issues.
Now let's take a look at boot diagnostics
and the Serial Console.
To do that, we'll navigate down to Help
and then Boot Diagnostics.
And let's go ahead and enable boot diagnostics.
So we'll select Settings.
And because we want to use the Serial Console
we're going to enable boot diagnostics
with a custom storage account,
and then we'll create a new storage account
for this purpose,
and we'll just provide a storage account name.
And then we can go ahead and click OK
and then we can go ahead and click Save.
This will just take a moment.
So we'll come back when this is done.
All right, the boot diagnostic settings are now saved.
Let's navigate back to the VM.
And then we'll click Refresh.
And we can see that we're receiving a screenshot
of the virtual machine console.
Now let's navigate to Serial Console.
So under Help, we'll navigate to Serial Console.
This will just take a moment to load up.
So we'll come back when this is done.
All right, the Serial Console is now loaded up.
Let's take a look at the types of commands
that are available in the Serial Console.
And you can see that you can use the Serial Console
to deal with networking troubleshooting issues,
or you might want to restart
or shut down the virtual machine,
or you might want to crash the virtual machine.
Or another example is where you might have a process
that's kind of gone out of control on a virtual machine
and it's consuming so much memory or processor
that you're unable to use the user interface
for that virtual machine.
In that instance, you can use the K command
to kill a process that's causing the problems.
All right, that concludes this demo.
Let's wrap up with a bit of a summary
of what we've covered in this lesson.
All right, let's take a look
at what we've covered in this lesson.
A VM must be restarted
before you can change the size of a VM.
It's also important to remember
that you can add data disks to a running VM,
but you must detach the disk if you want to modify it.
It's also important to remember
that you use route tables to control VM traffic flow
and network security groups to allow
or deny network traffic.
And you can securely connect to your VMs
using Azure Bastion,
but Azure Bastion requires a special subnet,
named AzureBastionSubnet with a /27 CIDR address block.
And you can troubleshoot serious issues
with your virtual machines using Serial Console,
but it's important to remember that Serial Console requires
a custom diagnostic storage account
and the contributor role on the virtual machine.
All right, thanks for being with me in this lesson
and I hope you found it useful.
And I look forward to seeing you in the next lesson.