Matt Ouellette

Notes from MS Learn AZ-700 Module 8: Design and Implement Network Monitoring – Unit 3: Exercise – Monitor a Load Balancer Resource Using Azure Monitor

Tasks (taken from MS Learn: Items without “Task” in front of them are personal additions)

• Task 1: Create the virtual network.
  • Search and click Virtual networks in portal
  • Select Create
    • Select or Create New under Resource Group (create new in this example)
      • Enter unique name and click OK
    • Enter Unique name in Instance details Name box
    • Choose appropriate Region from dropdown
    • Click Next : IP Addresses >
      • Delete default IPv4 address space
      • Enter new IPv4 address space
      • Click add subnet
        • In right panel enter unique name
        • Enter appropriate Subnet address range
        • Click Add
    • Click Next : Security >
    • Toggle BastionHost to Enable
    • Enter Bastion Name in box
    • Enter AzureBastionSubnet address space in box
    • Select or create new Public IP address (create new in this example)
      • Enter unique name in dialog
      • Click OK
  • Click Review + create
  • Once validation succeeds click Create
• Task 2: Create the load balancer.
  • Search and choose Load Balancers in portal
  • Click Create
    • Choose Resource Group from dropdown
    • Enter unique name in Instance details name box
    • Click Next : Frontend IP Configuration >
    • Click Add a frontend IP configuratioin
      • In right panel Enter unique name
      • Choose backend subnet from dropdown
      • Click add
  • Click Review + Create
  • Once validated click Create
• Task 3: Create a backend pool.
  • On Deployment complete page from above click Go to resource
  • In left panel click Backend pools
    • Click Add
      • Enter Unique Name
      • Click Save
• Task 4: Create a health probe.
  • In left panel choose Health Probes
  • Select Add in menu bar
    • Enter Unique name
    • Change Protocol to HTTP in dropdown
    • Change Interval to 15
    • Click Add
• Task 5: Create a load balancer rule.
  • In left panel click Load balancing rules
  • Click Add in menu bar
    • Enter unique name
    • Choose Frontend IP Address from dropdown
    • Choose Backend Pool from dropdown
    • Enter Port Number in box
    • Enter backend port number in box
    • Choose created health probe from dropdown
    • Adjust Idle timeout slider to 15 min
    • Click Add
• Task 6: Create backend servers.
  • Open PowerShell in Azure Portal cloudshell
  • Upload template and parameters files as done in previous exercises
  • Verify account and set subscription and Resource Group variable as done in previous exercises
  • Deploy the 3 VMs using the 3 different parameters files using the same tasks as previous excercises
• Task 7: Add VMs to the backend pool.
  • Under Load balancers settings in the left pane select Backend Pools
  • Click myBackendPool
  • Click Add under IP configurations
  • Check all three new VMs checkboxes and click add
  • Click Save
• Task 8: Install IIS on the VMs.
  • Navigate to Virtual Machines in Portal
  • Connect via Bastion to the first VM
  • Open PowerShell in session
    • (Install-WindowsFeature -name Web-Server -IncludeManagementTools)
    • (Remove-Item C:|inetpub\wwwroot\iisstart.htm)
    • Add-Content -Path “C:\inetpub\wwwroot\iisstart.htm” -Value $(“HelloWorld from ” + $env:computername))
    • Repeat for other VMs
• Task 9: Test the load balancer.
  • Under Virtual Machines Page click Create
  • Choose Azure Virtual Machine
    • Choose appropriate Resource group from dropdown
    • Enter Unique Virtual machine name in box
    • Choose Windows Server 2019 Datacenter – x64 Gen2 from dropdown under image
    • Under size dropdown choose Standard_D2s_v3 – 2 vcpus, 8GiB memory ($137.24/month)
    • Enter creds
    • Click Next : Disks >
    • Click Next : Networking >
      • Under Public IP dropdown select None
      • Toggle NIC network security group to Advanced
        • Under Configure network security group dropdown choose myNSG
  • Click Review + Create
  • Once validated click Create
  • Navigate to Load Balancer (search under portal)
    • Click new LB (myIntLoadBalancer)
    • Click See more
    • Copy private IP
  • Connect to test Virtual Machine via Bastion
    • Open Internet Explorer
    • Browse to LB IP
    • Refresh
      • Should show diff VMs during refreshes
      • Close IE
• Task 10: Create a Log Analytics Workspace.
  • Search and select log analytics workspaces in portal
  • Click Create
  • Choose appropriate resource group from dropdown
  • Enter Unique Name
  • Choose appropriate region from dropdown
  • Click Review and Create
  • Once validated click Create
• Task 11: Use Functional Dependency View.
  • In portal navigate to previously create LB
  • Choose Insights in left panel
  • Close metrics pane
  • Click zoom button to zoom in
  • Hovering offers details
  • Click Download Topology
  • Click View Metrics to reopen pane
• Task 12: View detailed metrics.
  • After closing Metric pane select view detailed metrics
  • Click Frontend & Backend Availability to view response
  • Click Data Throughput
• Task 13: View resource health.
  • Search and click Monitor in portal
  • Click Service Health in left panel
  • Click Resource Health in left panel
    • In Resource type dropdown choose load balancer
    • Choose new load balancer
• Task 14: Configure diagnostic settings.
  • Navigate back to new load balancer page
  • Click diagnostic settings in left panel
  • Select Add diagnostic setting
    • Enter unique name
    • Check All Metrics box
    • Click Save
    • Close page
• Task 15: Clean up resources.

Notes from MS Learn AZ-700 Module 8: Design and Implement Network Monitoring – Unit 4: Monitor Your Networks Using Azure Network Watcher

Azure Network Watcher is regional service enabling you to monitor/diagnose network conditions. Allows to diagnose problems at end-to-end network level. Network dianostic and visual tools are available with Network Watcher helping understand, diagnose, and gain. Insight to your Azure network. Designed to monitor/repair network health of IaaS including VMs, VNets, App Gateways, and LB

• Azure Network Watcher scenarios (example)
  • Automate remote network monitor with packet capture
    • Monitor/Diag network issues without logging into VMs
    • Trigger PCAP by setting alerts
    • Gain real-time perf info at packet level
    • Investigate in detail when issue observed
  • Gain insight into network traffic using flow logs
    • Build deep understanding of traffic patterns using NSG flow logs
    • Info helps gather data for compliance,auditing,monitoring of sec profile
  • Diagnose VPN connectivity
    • Provides ability to diagnose most common VPN GW/Connection issues
    • Allows identifying issue using details logs for further investigation

• Azure Network Watcher Tools
  • Network Topology
    • Generates visual of resources in VNet as well as relationship between resources
  • Verify IP Flow
    • Diagnose connectivity issues from/to INET and from/to On-prem
  • Next Hop
    • Determine if traffic directed as intended
    • Info helps determine routing
    • Next hop could be INET/VirtualAppliance/Virtual Network Gateway/VNet/VNet Peering/None
  • Effective Security Rules
    • NSG are associated at subnet or NIC.
    • Effect rules returns all configured NSGs/rules associated to VM
    • Allows accessing things like open ports
  • VPN Diags
    • Returns info to aid tshoot of Gateways and connections
    • Summary info includes
      • Connection statistics
      • CPU Info
      • Memory Info
      • IKE errors
      • Packet Drops
      • Buffers
      • Events
  • Packet Capture
    • Capture sessions to track traffic to/from VM
    • Aids in diagnosing network anomalies
    • Gather network stats
    • Info on network intrusions
    • Debug client-server comms
  • Connection Troubleshooting
    • More recent addition to Watcher suite
    • Provides net perf data
  • NSG Flow Logs
    • Maps IP traffic through NSGs
      • Network Monitoring
        • Identify unknown or undesired traffic
        • Monitor traffic/bandwidth consumption
        • Filter logs by IP & port to understand app behavior
        • Export Flow Logs to tools for dashboards
      • Usage Monitoring/Optimization
        • Identify top talkers
        • Combine with data to identify cross-region traffic
        • Understand traffic growth for forcasting
        • Use to remove overtly restrictive rules
      • Compliance
        • Use flow data to verify isolation/compliance with enterprise rules
      • Network forensics/security analysis
        • Flows analyzed from compromised IP/NICs
        • Explort logs to SIEM/IDS tools

• Connection Monitor Overview
  • Provides unified e-to-e monitoring in Network Watcher
  • Connection Monitor supports hybrid and Azure cloud
  • Provides tools to monitor/diagnose/view connectivity related metrics for Azure deployments
  • Benefits of Connection Monitor
    • Unified, Intuitive experience in Azure and Hybrid
    • Cross-region/workspace connectivity monitoring
    • High probing freq and better viz into network perf
    • Faster alerting for hybrid
    • Support connectivity checks based on HTTP/TCP/ICMP
    • Metrics/Log Analytics for both Azure and non-Azure tests
  • Example Use Cases
    • Front end web server VM communicating with DB in multi-tier app
      • Test connectivity between the two VMs
    • VMs in East US ping VMs in Central US
      • Compare cross-region latency
    • Multi on-premises office in diff locations
      • Office connect to MS 365 Url
      • Compare latency between locations
    • Hybrid app required connectivity to Azure storage
      • On-prem site and Azure app connect to same endpoint
      • Compare latency between the two
    • Check connectivity between on-prem and Azure VM’s hosting cloud app

• Connection Monitor Components
  • Connection Monitor Resource
    • Region specific Azure resource
    • All following entities are properties of this
  • Endpoint
    • SRC/DST participating in connectivity checks
      • VM
      • On-prem agent
      • URL
      • IP’s
  • Test config
    • Protocol-specific config for test
    • Based on chosen protocol
    • Define port/threshold/frequency/etc
  • Test group
    • Group containing SRC/DST endpoints and test configs
    • Connection Minotir can contain multiple test groups
  • Test
    • Combo of SRC/DST endpoint and test config
    • Most granular
    • Includes percentage of checks failed and RTT

• Traffic Analytics
  • Cloud-based providing visibility into user/app activity in cloud networks
  • Traffic Analytics looks at Network Watcher NSG flow logs to provide insight into traffic flow
  • Abilities
    • Visualize network activity across subscriptions and identify hot spots
    • Identify sec threat to and secure network with info such as
      • Open Ports
      • Apps attempting INET access
      • VMs connecting to rouge nets
    • Determine traffic flow patterns over Azure regions and INET
    • Pinpoint misconfigs leading to failed connections

• How Traffic Analytics Works
  • Examines raw NSG flow logs
  • Aggregated and then enhanced
  • Enhancements
    • Geography
    • Security
    • Topology Info
  • Info stored in Log Analytics workspace

Notes from MS Learn AZ-700 Module 8: Design and Implement Network Monitoring – Unit 2: Monitor Your Networks Using Azure Monitor

• What is Azure Monitor
  • Helps to maximize availability/performance of apps and services
  • Delivers comprehensive solution for collecting/analyzing/acting on telemetry from cloud and on-prem
  • Info helps understand how apps are performing and identify issues affecting them and depended upon resources
  • Sample list of features
    • Use App Insights to detect/diagnose issues across apps
    • Correlate infra issues with VM and Container insights
    • Use log analytics for troubleshooting/diagnostics of monitoring data
    • Support ops at scale with smart alerts/automated actions
    • Create visual dashboards and workbooks in Azure
    • Collect data from monitored resources using. Azure Monitor Metrics
  • Diagram below offers high-level overview of Azure Monitor
  • Two fundamental types of data
    • Metrics
    • Logs
  • Left Panel is monitoring source to populate data stores
  • Right Panel is actions that can be performed on said data
    • Analysis
    • Alerting
    • Stream to ext sources
  • (Image taken from MS Learn)
  • 

• Monitor data types in Azure Monitor
  • Two types of data collected
    • Metrics
      • Azure Monitor Metrics is feature collecting numeric data from monitored resources into time series DB
      • Metrics are numerical and collected at regular intervals
      • Describe aspects of system at a particular time
      • Lightweight/Capable of supporting near real-time – useful for alerting
    • Logs
      • Contain diff kinds of data organized into records with diff properties for each type
      • Telemetry(events and traces) stored as logs in addition for perf data for analysis

• Azure Monitor metric sources
  • 4 key sources of collected
    • Azure resources
      • Create platform metrics giving visibility into resource health/perf
      • Each resource type creates distinct metrics
      • Platform metrics collected from Azure resource at 1min unless defined differently
    • Applications
      • App insights show metrics for monitored apps to aid in perf issue and trend detection
      • Includes server response time and browser exceptions
    • VM Agents
      • Collected from guest OS
      • Enable guest OS for Windows VM with Windows Diagnostic Extension (WAD)
      • Linux VMs with InfluxData Telegraf Agent
    • Custom
      • Defined metrics in app monitored with App Insights
      • Also custom metrics for Azure service using custom API

• Azure Monitor Metric tasks
  • Table summarized tasks possible for using metrics
  • (Table below from MS Learn)
  • 

• Metrics Explorer
  • Data collected is shown in the Monitoring tab of a resource Overview Page
  • Example for a VM
    • CPU
    • Network
    • Disk

• Monitor network resources with Azure Monitor Network Insights
  • Use Insights > Networks section of Azure Monitor for high-level network resource health and metrics
  • Provides access to network monitoring features
    • Connection Monitor
    • Flow Logging for NSG
    • Traffic Analytics
  • Key components
    • Network Health/Metrics
      • Offers simple method of visualizing inventory of net resources along with resource health and alerts
      • Health divided into 4 areas
        • Search & filtering
        • Resource health & metrics
        • Alerts
        • Dependency view
    • Connectivity
      • Providing visualization of Connection Monitor tests
      • Test grouped by SRC/DST
    • Traffic
      • Providing access to NSG flow logs & Traffic analytics for selected subscriptions
      • Grouped by location
      • Searchable by any IP addr in environment
    • Diagnostic Toolkit
      • Providing access to all diag feature available for shoot of network/components
      • Most user Network Watcher
        • Capture packets for anomaly diagnoses
        • Troubleshoot VPN
          • Diagnose Virtual Network Gateway/Connection health
        • Troubleshoot connectivity
          • Check TCP connections
          • Includes FQDN, URI, or IPv4 Addr
        • Identify Next Hops
          • Obtain next hop type/IP of packet from VM and NIC
          • Knowing can help establish traffic direction to expected DST or drops
        • Diagnose traffic filtering issues
          • Verify packet is allowed/denied to/from VM
          • Security group decision and name of rule denying traffic returned

Notes from MS Learn AZ-700 Module 6: Design and implement network security – Unit 7: Summary + Additional Resources from MS Learn Course

Additional links from MS Learn Course

• Private endpoint overview
• Virtual network service endpoints overview
• Design ip addressing for Azure
• Secure and isolate with nsg and service endpoints
• Private link and dns integration at scale

Notes from MS Learn AZ-700 Module 7: Design and Implement Private Access to Azure Services – Unit 6: Exercise – Create an Azure Private Endpoint Using Azure PowerShell

Tasks (taken from MS Learn: Items without “Task” in front of them are personal additions)

• Task 1: Create a resource group and deploy the prerequisite web app.
  • Open PowerShell in cloudshell under portal: Button next to search bar
  • Upload template and parameter file as done in previous exercises
  • View/verify subscription
    • (az account show –output table)
  • Set subscription
    • (az account set –subscription “Name as noted from output above”
  • Create Resource Group
    • (New-AzResourceGroup -Name ‘NAME-rg’ -Locatiion ‘eastus’)
  • Set Resource Group name variable
    • ($RGName = “CreatePrivateEndpointQS-rg”)
  • Create VMs
    • (New-AzResourceGroupDeployment -ResourceGroupName $RGName -TemplateFile templatefile.json -TemplateParameterFile parametersfilename.json)
• Task 2: Create a virtual network and bastion host.
  • Create backend subnet
    • ($subnetConfig = New-AzVirtualNetworkSubnetConfig -Name myBackendSubnet -AddressPrefix 10.0.0.0/24)
  • Create Azure Bastion Subnet
    • ($bastsubnetConfig = NewAzVirtualNetworkSubnetConfig -Name AzureBastionSubnet -AddressPrefix 10.0.1.0/24)
  • Create Virtual Network
    • ($vnet = New-AzVirtualNetwork @parameters1)
  • Create Public IP for Bastion Host
    • ($parameters2 = @{
      Name = ‘myBastionIP’
      ResourceGroupName = ‘CreatePrivateEndpointQS-rg’
      Location = ‘eastus’
      Sku = ‘Standard
      AllocationMethod = ‘Static’
      }
    • ($publicip = New-AzPublicIpAddress @parameters2)
  • Create Bastion Host
    • ($parameters3 = @{
      ResourceGroupName = ‘CreatePrivateEndpoingQS-rg’
      Name = ‘myBastion’
      PublicIpAddress = $publicip
      VirtualNetwork = $vnete
      })
    • (New-AzBastion @parameters3)
• Task 3: Create a test virtual machine.
  • Set local admin creds for VM
    • ($cred = Get-Credential)
    • Input Username
    • Input Password
  • Get VNet config
    • ($vnet = Get-AzVirtualNetwork -Name myVNet -ResourceGroupName CreatePrivateEndpoingQS-rg)
  • Create VM NIC
    • ($parameters1 = @{
      Name = ‘myNicVM’
      ResourceGroupName = ‘CreatePrivateEndpoingQS-rg’
      Location = ‘eastus’
      Subnet = $vnet.Subnets[0]
      })
    • ($nicVM = New-AzNetworkInterface @parameters1)
  • Create VM Configuration
    • ($parameters2 = @{
      VMName = ‘myVM’
      VMSize = ‘Standard_DS1_v2’
      })
    • ($parameters3 = @{
      ComputerName = ‘myVM’
      Credential = $cred
      })
    • ($parameters4 = @{
      PublisherName = ‘MicrosoftWindowsServer’
      Offer = ‘WindowsServer’
      Skus = ‘2019DataCenter’
      Version = ‘latest’
      })
    • ($vmConfig = New-AzVMConfig @parameters2 | Set-AzVMOperatingSystem -Windows @parameters3 | Set-AzVMSourceImage @parameters4 | Add-AzVMNetworkInterface -Id $nicCM.Id)
    • (New-AzVM -ResourceGroupName ‘CreatePrivateEndpoingQS-rg’ -Location ‘eastus’ -VM $vmConfig)
• Task 4: Create a private endpoint.
  • Place Webapp into variable
    • ($webapp = Get-AzWebApp -ResourceGroupName CreatePrivateEndpointQS-rg)
  • Create Private Endpoint connection
    • ($parameters1 = @{
      Name = ‘myConnection
      PrivateLinkServiceId = $webapp.ID
      GroupID = ‘sites’
      })
    • $privateEntpointConnection = New-AzPrivateLinkServiceConnection @parameters1)
  • Place VNet into variable
    • ($vnet = Get-AzVirtualNetwork -ResourceGroupName ‘CreatePrivateEndpoingQS-rg’ -Name ‘myVNet’)
  • Disable Private Endpoint Policy
    • ($vnet.Subnets[0].PrivateEndpointNetworkPolicies = “Disabled”
    • ($vnet | Set-AzVirtualNetwork)
  • Create Private Endpoint
    • ($parameters2 = @{
      ResourceGroupName = ‘CreatePrivateEndpoingQS-rg’
      Name = ‘myPrivateEndpoint’
      Location = ‘eastus’
      Subnet = $vnet.Subnets[0]
      PrivateLinkServiceConnection = $privateEndpoingConnection
      })
    • New-AzPrivateEndpoint @parameters2)
• Task 5: Configure the private DNS zone.
  • Place VNet into variable
    • (vnet = Get-AzVirtualNetwork -ResourceGroupName ‘CreatePrivateEndpointQS-rg’ -Name ‘myVNet’)
  • Create Private DNS Zone
    • ($parameters1 = @{
      ResourceGroupName = ‘CreatePrivateEndpointQS-rg’
      Name = ‘privatelinke.azurewebsites.net’
      })
    • ($zone = New-AzPrivateDnsZone @parameters1)
  • Create DNS Network Link
    • ($parameters2 = @{
      ResourceGroupName = ‘CreatePrivateEndpoingQS-rg’
      ZoneName = ‘privatelink.azurewebistes.net’
      Name = ‘myLink’
      VirtualNetworkId = $vnet.Id
      })
    • ($link = New-AzPrivateDnsVirtualNetworkLink @parameters2)
  • Create DNS Config
    • ($parameters3 = @{
      Name = ‘privatelink.azurewebsites.net’
      PrivateDnsZoneId = $zone.ResourceId
      })
    • ($config = New-AzPrivateDnsZoneConfig @parameters3)
  • Create DNS Zone Group
    • ($parameters4 = @{
      ResourceGroupName = ‘CreatePrivateEndpoingQS-rg’
      PrivateEndpointName = ‘myPrivateEndpoint’
      Name = ‘myZoneGroup’
      PrivateDnsZoneConfig = $config
      })
    • (New-AzPrivateDnsZoneGroup @parameters4)
• Task 6: Test connectivity across the private endpoint.
  • Navigate to Virtual Machines in portal
  • Open myVM created earlier
  • Click Connect > Bastion
    • Enter credentions and click connect
    • Open PowerShell
      • (Nslookup contoso-webapp-755238.azurewebsites.net)
        • Private IP provided from subnet
      • Browse to URL in Internet Explorer
      • Select OK in dialog
      • Success

Notes from MS Learn AZ-700 Module 7: Design and Implement Private Access to Azure Services – Unit 4: Integrate Private Endpoint with Domain Name Service

Private DNS zones typically hosted in same subscription where hub VNet deployed. Central hosting practice is recommended for cross-premises DNS resolution. Most cases – only networking and identity admins have permissions to manage DNS records

• Azure Private Endpoint DNS Configuration
  • Below diagram show typical high-level architecture for enterprise env with central DNS.
  • Name resolution for Private Link resources done via Azure Private DNS
  • (Image taken from MS Learn)

• Highlights of diagram
  • On-prem DNS servers have conditional forwarders configured for each Private Endpoint
  • DNS servers in hub VNet use Azure DNS resolver as forwarder
  • All VNets have DNS forwarders configured as primary/secondary DNS servers
  • DNS records follow lifecycle of Private Endpoint

• Significance of IP Addr 168.63.129.16
  • VIP (public) that facilitates communication channel to Azure platform resources
    • Enables VM Agent to communicate with Azure platform to signal that it is in a “Ready” state
    • Enables communication with DNS virtual server providing filtered name resolution – Filtering ensures customers can resolve only hostnames to their resources
    • Enables health probes from load balancer to determine health state of VMs
    • Enables VMs to obtain dynamic IP addr from DHCP service in Azure
    • Enables heartbeat messages for PaaS role

• DNS Configuration Scenarios
  • FQDN of services resolves automatically to public IP. To resolve to private IP of Private Endpoint, change the DNS config
  • DNS is critical component to make app work correctly by successful resolution of Private Endpoint IP
  • Based on prefs follow these scenarios (taken from MS Learn site)
    • Virtual network workloads without custom DNS server.
    • On-premises workloads using a DNS forwarder.
    • Virtual network and on-premises workloads using a DNS forwarder.
    • Private DNS zone group.

• On-prem workloads using DNS forwarder
  • For on-prem workloads to resolve FQDN of Private Endpoint use DNS forwarder to resolve Azure service public DNS zone
  • A DNS forwarder is VM running on VNet linked to Private DNS Zone
  • Query must be originated from VNet to Azure DNS
  • Proxy options include
    • Windows DNS
    • Linux DNS
    • Azure FW
  • Diagram below illustrates DNS resolution sequence from on-prem
  • Configuration uses DNS forwarder in Azure
  • Resolution made by private DNS zone linked to VNet
  • (Image taken from MS Learn)
  • Configuration needs
    • On-prem network
    • VNet connected to on-prem
    • DNS forwarder in Azure
    • Private DNS zones privatelink.database.windows.net with A record
    • Private Endpoint info (FQDN record name with private IP)

• Virtual Network and On-prem workloads using Azure DNS Private Resolver
  • When using DNS Private Resolver – you don’t need DNS forwarder VM.
  • Azure DNS is able to resolve on-prem domain names
  • Below diagram uses DNS Private Resolver in hub-spoke topo
  • Best practice: Azure landing zone design pattern recommends using this type of topo
  • Hybrid net connection established using Azure ExpressRoute and FW
  • Provides secure hybrid network
  • DNS Private Resolver is deployed in hub network
  • (Image taken from MS Learn)

• Reference Links taken from MS Learn
  • Review the DNS Private Resolver solution components
  • Review the traffic flow for an on-premises DNS query
  • Review the traffic flow for a VM DNS query
  • Review the traffic flow for a VM DNS query via DNS Private Resolver
  • Review the traffic flow for a VM DNS query via an on-premises DNS server