Hello, Cloud Gurus,
and welcome back for this lesson,
where we're going to take a look
at a couple of the ways
you can integrate on-premises virtual machines
and Azure virtual networks.
Let's take a look at what we're going to cover.
First up, I'll introduce Azure Network Adapter,
and then we'll take a look at what's involved
to implement Azure Network Adapter.
And then we'll jump into a demo
where we will deploy Azure Network Adapter.
And then finally,
we'll take a quick look at Extended Network for Azure
and how that works.
And these 2 networking capabilities
will help you in very specific scenarios.
And while everyone might not use these,
it's good to know how each of them work
and when you might use them.
Let's get started.
Sometimes when you're working in Azure Hybrid environments,
you're going to get some
pretty technically challenging scenarios.
And while challenging,
these scenarios are where you can really shine
as an Azure Hybrid administrator
by solving these challenges
using Azure Hybrid technologies.
Let's take a look at an example.
Let's say that your virtual machines
are running in an Azure Virtual Network.
This includes your domain controllers
and a number of other virtual machines.
And your company goes ahead and acquires another company,
and they have a small branch office network
with a domain controller,
and they use Windows Admin Center to manage their service.
And you've been asked to provide Identity Sync
between their Active Directory forest
and your Azure ID tenant.
And due to global supply chain shortages
on network equipment,
you are not able to get a router
capable of deploying a VPN connection to Azure.
So you're kind of stuck, right?
Well, not quite.
Microsoft has been busily chasing down
all the scenarios like this,
and providing solutions to problems exactly like this.
And you'll face challenges similar to this
as a hybrid administrator.
One way you can solve this problem
is using Azure Network Adapter.
It's not the only way,
but it is a fairly fast and convenient way,
and it doesn't require any special equipment on-premises.
Azure Network Adapter is deployed
using Windows Admin Center,
and it is essentially an always-on point-to-site,
which is one computer to a virtual network,
VPN connection between an on-premises server,
like the branch office domain controller,
and an Azure virtual network.
And it's recommended where you have a single server,
here or there,
and you need to connect it to an Azure Virtual Network.
If you need to connect multiple computers or an entire site,
it's recommended to use something like a site-to-site VPN,
or for more performance, use something like ExpressRoute.
But in our scenario, where we have a single server,
and we want to connect it to an Azure Virtual Network,
Azure Network Adapter is a great option.
To deploy an Azure Network Adapter
on one of your servers, on-premises,
you're going to need an Azure Virtual Network
with an address space large enough
so that you'll be able to create a subnet
for your VPN gateway.
And if you let Windows Admin Center
deploy the virtual network gateway,
it will be deployed in the same resource group
as your virtual network,
using a fairly random WAC generated name.
Now, if you have strict naming conventions
or you'd like to use a separate resource group
for these Azure resources,
you can pre-deploy a gateway subnet and a VPN gateway.
Just make sure it's a supported SKU,
as no zone-redundant versions of VPN gateway can be used,
and it can only be used in an active-passive configuration.
You also need to have Windows Admin Center deployed
and the server you want to connect to the V-Net
needs to be added to your Windows Admin Center
as a managed server.
And you also need to connect Windows Admin Center to Azure,
and the account you're using
needs to have appropriate credentials
to create the required Azure resources,
like the virtual network gateway.
And your on-prem server must be running at least
Windows Server 2012 R2 or later.
And the installation process really couldn't be any simpler.
You navigate to the server in Windows Admin Center,
select the server and select to add the network adapter.
Then you'll need to provide details of the subscription,
virtual network and potentially, some network details.
And that's it.
All right, let's take a look at a demo
of deploying Azure Network Adapter.
In this demo, we have an existing virtual network
being used by Barrier Reef Audio,
and they've acquired a new company, River City AI,
and they have their own on-premises network.
And we need to synchronize
the Active Directory Domain Services' identities
for River City AI to Barrier Reef Audio's Azure ID tenant,
using the Barrier Reef Audio Azure ID connect server.
And this requires network connectivity
from the Barrier Reef Audio, Azure ID connect server
and the River City AI domain controller.
And we've been asked to do this
without acquiring any additional hardware.
River City AI already has Windows Admin Center deployed,
and they've added all those servers
into Windows Admin Center,
including the domain controller for River City AI.
To prepare for this, we've registered
the River City AI Windows Admin Center server
with the Barrier Reef Audio Azure tenant,
and we have an Azure account
with permissions to deploy the VPN gateway.
In this demo, we will deploy the Azure Network Adapter
using Windows Admin Center,
which will deploy a gateway subnet,
VPN gateway and Azure Network Adapter
on the on-premises domain controller.
And then we will test connectivity to the domain controller
from the Azure Virtual Network.
Let's take a look.
All right, so here we are, logged on to Windows Admin Center
in the River City AI domain,
and we've gone ahead and added in
the domain controller for River City AI,
so we'll go ahead and select that server now.
And we've also already registered
this Windows Admin Center with Azure,
and we've provided our credentials,
so that we can create Azure resources.
Now that we've connected to the domain controller
in Windows Admin Center, we'll navigate down to Networks,
and then we can go ahead and add an Azure Network Adapter,
and the subscription's already been selected for us,
so I'll go ahead and select the region,
and we're using Australia East.
It's automatically selected the correct virtual network,
so I'll just scroll down,
and this gateway subnet address is okay for our purposes,
and this gateway SKU is also okay.
But this client address space
overlaps with our on-prem address space,
so I'm just going to go ahead and adjust this,
and increase that to 10.3.1.0.
And we're okay to use the auto-generated self-signed route
and client certificate.
This is recommended by Microsoft.
So we can go ahead and hit Create.
Now this will take anywhere up to 45 minutes
to actually deploy the Virtual Network Gateway
and connect our server.
So we'll take a bit of a break
and we'll come back when that's done.
All right, and that deployment is now complete.
And we can see that we have
our Azure Network Adapter configured here.
And if we flip over to the Azure portal and take a look,
here's our Windows Admin Center created VPN gateway.
And if we navigate to Point-to-Site Sessions
under Monitoring,
we can see that our on-premises domain controller
is connected using a point-to-site connection.
All right, that wraps up this demo.
Now let's continue on
with a look at Extended Network for Azure.
Another tricky situation you might face
as a hybrid administrator,
especially when you are migrating servers to Azure,
are unexpected network dependencies.
And a very annoying network dependency
is one where the IP address of a server
cannot be changed when you migrate it to Azure.
And this would prevent you from migrating that server
to a new IP range in an Azure Virtual Network.
One example of where this might occur
is where an IP address is statically configured
in compiled code,
and no one may have access to the source code
for that compiled code.
And that's pretty messy, right?
Well, Extended Network for Azure
enables you to stretch an on-premises subnet
into Azure, to let on-premises virtual machines
keep their original on-premises private IP addresses
when you migrate them to Azure.
Now be warned,
you're not going to get away with this lightly.
Microsoft has made this as easy as it can possibly be,
but honestly, you might want to learn whatever language
that application is written in,
as it might be easier to go ahead
and update the application.
And I'm kidding around here,
but what I'm trying to say
is that you only want to do this
if you absolutely have no other option,
and you only want to keep this configuration
for as long as you have to.
To extend your network to Azure,
you're going to need an Azure Virtual Network
with a gateway subnet and a Virtual Network gateway.
And you'll need a connection to your on-premises network,
either using VPN or ExpressRoute.
And I'm using VPN in this example.
And on-premises, we have a server with the IP address,
192.168.1.53.
And we want to migrate that server to Azure
without changing the IP address.
In Azure, you're going to need two subnets.
One with the same IP address range
as where your on-premises server uses,
and another with a non-overlapping IP address range.
You start by deploying a nested virtualization capable
Windows Server 22 Azure Edition VM
and enabling the Hyper-V role.
You'll also need to connect
2 virtual network interfaces to this VM,
and you'll need to create an external virtual switch
for each of these adapters on that Hyper-V host.
And on the on-premises side,
you're also going to need another Windows VM,
capable of nested virtualization,
2 network interfaces again,
and each with an external virtual switch attached.
Each subnet you're going to extend
requires one of these VMs on each side.
You will also need to enable asymmetric routing
on your on-premises firewall,
and this is bound to make your network admin very happy.
Then you can deploy the extended network
using Windows Admin Center,
starting by adding the Azure Extended Network extension,
then connecting your Windows Admin Center
deployment to Azure.
Then you can go through the process
of deploying a virtual appliance on each of your VMs,
one on-premises and one in Azure,
and configuring the extended network.
And then once you have all of this in place,
you can go ahead and migrate your server
to the target subnet in the Azure Virtual Network.
All right, let's take a look
at what we've covered in this lesson.
Azure Network Adapter enables you to connect
individual Windows Servers to an Azure Virtual Network,
using an always-on point-to-site VPN connection,
authenticated using certificates.
And Extended network for Azure
allows you to migrate a server to Azure
and retain its private IP address.
And both Azure Network Adapter
and Extended Network for Azure
are deployed using Windows Admin Center.
And Extended Network for Azure uses two virtual appliances,
deployed as nested VMs on Hyper V VMs.
And it requires Windows Server 2022 Azure Edition
for the Azure VM
and either Windows server 2019 or 2022
for the on-prem Hyper V server.
All right, that concludes this lesson.
Thanks for being with me,
and I hope you found it useful,
and I look forward to seeing you on the next lesson.