In this demonstration, I'm going to walk you through using
the Azure Network Adapter, and I'll at least get you started
with Azure extended network.
I'm on a Windows Server 2022 domain member server
running in my local environment.
It's not in Azure, and I've installed Windows Admin
Center on this machine and signed in.
As you can see, I've done a couple things on the Server Manager page here.
I've got my local server set up as a Gateway, and then I've
used the Add function to bring in localdc1.
That's my domain controller in my local domain, so I can work with it as well.
So for Azure Network Adapter, what do we want to do?
Well, we want to go to my local server,
localmem1. And then in the settings, I'm going to look for
networks. And then in the Networks interface, you can see we
have Add Azure Network Adapter.
Now, it's a little bit odd because notice it says Preview.
What does that mean?
Well,
this means it's a public preview feature, that it's not generally available.
And normally that means, unless Microsoft tells you otherwise, that the
feature is not covered by service‑level agreements or Azure support, so I
do want to give that caveat alway. Be careful using public preview
features because they're normally intended for non‑production use.
Microsoft sometimes makes an exception,
but that's something you need to track with that engineering team.
Okay, so I'm going to click Add Azure Network Adapter, and we get an error.
This is to be expected because I haven't yet registered this machine and this
instance of Windows Admin Center with my Azure subscription.
So let's hit Settings. And on the Account page, we're going to sign
in. It looks like I'm already signed in with my timw account, so
it's just directly asking me to consent.
This is an OAuth authorization screen asking us for
permission and so on and so forth.
So I'm signed in.
That's looking pretty good.
Let's come back to Server Manager, back to our Gateway, back
down to Networks, back into Azure Network Adapter. And you may
be asked to sign in a second time.
I must have already done that sometime in the past. And when you
sign in and formally register your WAC server,
you're asked,
do you want to reuse an existing service principal or create a new one?
Because what happens is, let me go back for a moment into my Azure
subscription and go to Azure Active Directory. We need a security
context for your Windows Admin Center to do its work.
Does that make sense?
So you not only need to sign in with your administrative account,
but then you create a persistent,
basically a service account for WAC and your tenant, and we
can find that if we go to App registrations. If I go to All
applications and sort that in verse,
we can see I've got it right down here. I've got Windows Admin Center gateway
installed on several of my servers. The one that we're concerned with right
now is this one I'm highlighting. And notice that the service principal has
the name WindowsAdminCenter and then the URL of the server. And so that means
we can grant this identity role‑based access ourselves in addition, and that
would determine the scope of work that can happen here in WAC. So anyway,
I've got my Add Azure Network Adapter form up here. I choose my Subscription,
my Region, my Virtual Network,
which I believe, in my case, is vnet11. And here, depending upon whether
you already have a virtual network gateway installed,
you can either have WAC initiate the creation of that subnet and
gateway, or we can reuse our existing one, which is what I'm going to
do. Now again, to show you that back in Azure, let me go to Virtual
network gateways, and I've created a gateway.
These take quite a bit of time to create, 30,
40 minutes at least, depending upon your region.
So rather than have WAC create one,
I made sure to do the work in advance. So we can see it's in vnet11. And
if I jump over to my virtual network and go to Subnets, your virtual
network gateway is a managed appliance. It's a VPN ExpressRoute endpoint.
That needs to be on its own subnet. I normally will do a class C block,
/24, but you can make it much smaller if you want to, 24 is kind of
overkill, for sure. But the subnet does need the name label,
GatewaySubnet, with no spaces.
So let me go back a couple steps to the VNet gateway. And what we're getting at
here is on Point‑to‑site‑configuration, right now there's no point‑to‑site
configuration happening, but we're going to initiate that in an automated way
with this Add Azure Network Adapter thing.
So when you set up a point to site,
you need to specify a private client address space that will be used by
connections. As it says here, it's the client address pool, their private
IPs. This needs to be a non‑overlapping range with any of my other
networks, so I'm going to do a 172.16.30/24. And the way Azure Network
Adapter does authentication is with certificate, so I'm going to have it
auto generate self‑signed.
Now that's not particularly secure and flexible. Otherwise, if
you're using Active Directory Certificate Services,
you can add the public key and client package manually.
I'm going to auto generate. And that will create a root certificate that's
attached to the gateway and a client certificate that WAC will auto install
on the local server to establish that connection. Let me click Create. And
this shouldn't go as fast because we're not having to create the gateway.
It says that it could take up to 10 minutes for Azure to complete this
work. That's fine. And while we're waiting for that work to finish
actually, I can just walk you through a little bit of the Azure extended
network.
Now, remember, extended network is where you need to extend an on‑premises
subnet into Azure using the very same IP range because the idea is you're
migrating a virtual machine, and it needs to retain its existing private IP.
What we'll do is go over to Settings, Extensions. And I can see it right here,
Azure Extended Network. So you'll want to install that extension onto your
server, so I'll click Install. Once it's installed, it'll reload the page, and
it will show up on the Installed extensions list, right here. Then, to make use
of that network, we can again come back to our server in question, localmem1.
Come down to Networks, specifically we have a new setting for Azure Extended
Network, and then we can initiate the setup process. Once again,
I need you to understand that as of this recording,
I mean maybe by the time you're watching this training video,
Extended Network and/or the Network Adapter will be in generally
available status in which you won't see a preview tag, and those
products will have their own published service‑level agreements and
Azure support arrangements.
Let's click Set up. Again,
there's a lot of set up here to this and a lot of prerequisites that
you need to get on board here. It gives firewall exceptions. We've got
needing those network virtual appliances that have multiple switches
and Hyper‑V VMs. Oh, boy. There's quite a bit to it. But this takes you
through that setup, and that's really all I want to say about that at
this point.
Let's come back to Networks, and let's see how WAC
is doing thus far in its work.
Okay,
we see an update here that Point to Site VPN Client Configuration is started.
This will take up to 5 minutes. We'll get notification once it's completed. And
what that's referring to, if we go back to our gateway here.
Let me refresh the Point‑to‑site configuration screen. Notice now that
the interface is fleshed out to where we have the client address pool as
I configured it in WAC. It looks like the Azure Network Adapter is using
the IKEv2 and OpenVPN (SSL) option with, as we know, Azure certificate is
the Authentication type.
It created a root certificate using self‑signed data.
There's the public key data right there, and it auto
generated just a single client certificate.
And normally, when you set up a shared point‑to‑site configuration,
after you establish your metadata here in terms of
tunnel type, authentication type,
you save, let it cook, and the gateway will create a VPN
installation package right here, Download VPN client. You
actually already saw that in the previous demo.
I'm kind of repeating. It occurred to me now that I'm repeating
a lot of what I taught in the previous demo.
That's totally okay because let's face it,
adult education is about repetition, isn't it?
Nice.
Well, once that configuration completes,
we now see on the Networks page for localmem1,
in addition to its own primary Ethernet adapter,
we have this point‑to‑site VPN that goes into
vnet11, and the status is connected.
If we select the link, we can disconnect,
we can delete,
we can reconnect again. And then on this machine, we can
always go into the Settings app, and we've got our
point‑to‑site VPN already connected.
So what does that mean?
Well, that means we should be able to open up a Layer 3 connection.
So that means I should be able to establish Layer 3 connectivity,
the resources in that VNet.
Like I have a VM in that VNet right now,
so let me try a ping, IPv4 10.11.11.11. Yep, so we've got connectivity. And
this localmem machine, it's going over the internet normally. It's just that
we're using the P2S VPN to get into that VNet. So there we have it. It's working just fine.