Hello, Cloud Gurus, and welcome back.
And congratulations on making it to the end of this section.
I hope the knowledge you've gained in this section
will serve you well, both now and into the future.
Let's recap some of the key takeaways
from the lessons in this section.
We took a look at providing remote access
to legacy applications.
And these are the applications
that don't use modern authentication methods,
like those that are supported by Azure Active Directory.
You can provide access to these applications
using Windows Server technologies
or you can use newer Azure technologies.
And if you are using Windows server,
you can deploy Web Application Proxy.
The infrastructure required to support Web Application Proxy
is substantial,
especially in a typical, highly available deployment.
So let's take a look at what's required.
You're locally going to have an external firewall
and these might be a pair of highly available firewalls.
And these are usually complex to deploy,
secure, manage, and maintain.
And to provide access using Windows Server,
you're going to need to deploy something
like an application gateway.
And these are typically a network appliance
designed to distribute traffic to web applications.
They might be a hardware appliance or a virtual appliance.
They're sometimes called application delivery controllers
or ADCs
and common brands of these appliances
include Citrix and F5.
And typically you'll have a highly available pair
of these deployed.
And you use these application gateways to distribute traffic
to your Web Application Proxy servers.
And you'll need at least 2 Web Application Proxy servers
deployed in the perimeter network.
And the application gateways will be configured
to load balance and distribute the traffic
to the Web Application Proxy servers
using a common externally resolvable DNS name.
You'll also likely have an internal firewall
and these might be physical or virtual
and they might even be the same pair of appliances
as your external firewall.
And you'll need to configure these to allow traffic
from the perimeter network
to the web server on your internal network.
You'll also need to configure access to the AD FS servers
from these servers.
And you'll locally have 2 AD FS servers in a farm
and farms don't require an application gateway
like the Web Application Proxies do.
And if you're using integrated Windows authentication,
remember, that Web Application Proxies
need access to your domain controllers
because you'll have to domain join
your Web Application Proxy servers.
If you want to use integrated Windows authentication,
you'll also likely have to have
at least 2 domain controllers for high availability.
And this infrastructure is nothing short of crazy, right?
Well, if you have the required Azure AD Premium licenses,
which is just one for the administrator,
do yourself a favor
and replace this with Azure AD Application Proxy.
Azure AD Application Proxy only requires 2 servers
deployed on your internal network for high availability
and it's much easier to manage.
And if you have Azure AD Premium licenses for your users,
you can use Azure AD multifactor authentication
to further secure access to the applications.
The big tips to remember here
are that you need to be a global administrator
or an application administrator
to register an Azure AD Application Proxy.
And the application proxy server also needs access
to your web applications.
And you can just log on to your application proxy connectors
and check if they have access.
And you can make sure
that any firewall rules and DNS configuration is in place
to allow your proxy connectors
to connect to your backend web application.
And finally,
you should place your application proxy connectors
close to your applications
in terms of network latency.
They don't have to be in the same subnet, just close.
Remember that you can use connector groups
to ensure that the closest application proxy servers
are used to connect to your web application.
We also took a look at how you can provide remote access
using Windows Server
to access applications that are not web based.
And these are things like file shares or databases.
To do this, you can deploy DirectAccess,
which requires a direct access server
deployed in the perimeter network.
And this server can have 2 network adapters or just one
if it's being deployed behind a NAT device like a firewall.
You'll also have DirectAccess clients on the internet,
which are domain-joined Windows PCs only.
The important things to remember about DirectAccess
is that it relies on Group Policy for configuration
and DNS to provide access.
So you'll need to make sure
both of these are appropriately configured.
For DNS, your clients need to find the DirectAccess server
and your DirectAccess server
needs to be able to find Active Directory.
The reason I call this out is that it's a little odd
for a server in the perimeter network
to need to resolve internal DNS names
and even be domain joined.
So just be aware of that.
However, it's far more likely
that you're going to encounter a situation in your job
where there are non-Microsoft devices deployed
either in the perimeter network,
providing VPN access or on the internal network,
providing wireless or wired network access.
And you can provide a great user experience
by integrating, authentication, and authorization
for these devices with Active Directory Domain Services.
And this will likely require
configuring at least one radius server.
And in this section we learned that Network Policy Server
is Microsoft's implementation of a radius server.
You configure the network devices as radius clients
so that they can hand off the authentication
and authorization to the Network Policy Server
and in turn Active Directory Domain Services.
And on your network policy server,
you will only need to configure connection request policies
if you need to forward radius connection requests.
For example, if you need to authenticate someone
from an untrusted Active Directory forest.
And no matter what,
you'll need to configure network policies
to grant or deny access
and under what conditions access is allowed.
What's very important to remember about network policies
is that only the first matching policy is checked.
If you have a policy that applies to a broad group of users
and it denies access for a user,
no further policies will be checked.
So make sure you remember that one in the real world
and for the exam.
We also took a look at a few networking technologies
that can help you deliver the magic
of a hybrid administrator
by getting your company out of tricky situations.
We first took a look at Azure Relay,
which allows you to expose on-premises data and services
to applications running in the cloud
without making complex network changes.
What's important to remember about Azure Relay
is that there are 2 types of connections,
hybrid and WCF relays.
If you're using the traditional .NET framework
for your application
and you're using Windows Communication Foundation or WCF,
you should use that relay type.
For all other types of applications,
including accessing .NET core applications,
you should use the hybrid connections relay type.
We also explored how you can connect individual servers
outside of Azure to an Azure Virtual Network.
And this can be done using Azure Network Adapter.
Azure Network Adapter is essentially an always-on
point-to-site VPN connection
that you configure through Windows Admin Center.
What's important to remember about Azure Network Adapter
is that it requires a VPN gateway,
which Windows admin center can deploy for you
or you can use an existing gateway,
provided the existing gateway is not active-active
or a zone redundant SKU.
And finally, we explored Extended Network for Azure
and how you can use Extended Network for Azure
to move a server to an Azure Virtual Network
and retain its existing IP address.
And this is also deployed using Windows Admin Center.
Extended network for Azure is a complicated setup
that uses virtual appliances, both on-premises and in Azure.
What's important to remember here
is that you need 2 network adapters on each of the hosts
that will run the virtual appliance
and that the Azure virtual appliance
must be running Windows Server 2022 Azure edition.
All right.
That wraps up this lesson.
I hope you've learned something useful.
And I hope this prepares you well for what's ahead
as an Azure hybrid administrator.
I'll see you in the next section.