IP Address Management, or IPAM.
Let's take a look at some common IP address issues in hybrid environments.
Now I've got six on this side.
Of course, we can think of many more. One that springs to my mind as
Internet Protocol v6. But fortunately, the exam focuses strictly on
IPv4, and actually, the DHCP failover feature that we'll look at
later in this lesson supports only IPv4 anyway. But when I'm
thinking of a hybrid cloud,
I'm thinking first of all is making sure that we never
have the problem of IP address range overlap. With those
RFC 1918 private IP addresses,
the private IPv4 addresses that is, you have one or more of these ranges
on‑prem, and then as you're extending your network into Azure,
you have to think about that in terms of
site‑to‑site VPN or ExpressRoute circuit,
making sure that you're not overlapping to cause problems.
Although in the Azure VNet world,
your virtual networks could have overlapping ranges.
That's going to present a problem, again,
if you do peerings or VPN or ExpressRoute circuits. We also in
Azure need to think about Azure public IP addresses. Common
newcomer mistake I see people make is put public internet
accessible IPs directly on their Azure VMs.
Do you really want to do that?
In my experience,
you'll see RDP brute‑force attacks within minutes of exposing an Azure VM
directly to the internet. With Dynamic Host Configuration Protocol, there's the
notion of a rogue server. Maybe one of your development colleagues at work
brings up a DHCP server for testing, and that person winds up creating an
unwanted denial of service for other users.
DHCP is a broadcast‑based protocol,
so it's way too easy for a DHCP client to pick up an
IP address from a DHCP server.
How do you prevent that? With name resolution, we have rogue
DNS servers and rogue DNS updates. Elsewhere in this course we
looked at DNSSEC, for example,
as a way to mitigate that rogue DNS update problem.
But what do you have to prevent rogue DNS servers showing up
in your environment? When we look at Azure,
we have to recognize that currently, as of this recording in early 2022, the
Azure public cloud has no inbox IP address management solution.
It's a fully hosted architecture based on software‑defined
networking. Elsewhere in this course,
we learned about the Azure wire server that provides
Azure‑based DHCP for your virtual networks.
We don't have a way right now to have a single pane of
glass management wise from Microsoft.
It's unfortunate, but it's the truth. Now,
this opens the way for third‑party independent software
vendors, or ISVs. One that I know of,
although I don't have any experience with using it yet is called
EfficientIP. So there are third‑party vendors who do provide IP
address management for hybrid cloud. We're just not there yet in the Microsoft world.