Category: Education

Just Write (Type) It Down: A Note Taking – Study Strategy!

Reading Time: 3 minutes

Okay sorry about that! The title is (but also isn’t) misleading. I’m going to write this from an I.T. perspective but in all truth it applies to anything you may be studying.

In the field of I.T. it’s a given…You will always be studying/learning new things. Only always as some would say. Things move so fast, and tasks, technologies, plans, procedures, etc are always changing. It’s really the same in any field to be honest.

One thing I was taught well back in early elementary school was to write it down because writing it down helps you remember it. Well in my case two things, I’m a south paw (aka left handed) and yes I have that stereotypical left handed writing that even if I write the word “the” on a piece of paper odds are tomorrow I can’t even read it 🙂

The second thing is it’s such a digital world and well, I’m kind of a technology guy so I choose to type out my notes. For a few reasons such as be able to search them, and the ease of sharing them with others. Or even collaborating on note taking. And as noted above to be honest, so I can actually read them later!

I’m going to write this as my strategy for note taking using a specific platform/software, as well as based on a self paced course. At the end I will outline at a high level the same(ish) strategy for things like exams or specific technology or books. I’m hoping to get a guest write up from someone that still prefers to hand write their notes because I think that’s a super fun way to do it I just can’t because my handwriting looks like I gave PacketPup a pen and piece of paper.

In my case I prefer to use Microsoft OneNote. For me it makes it simple to share across devices, collaborate, organize, and search. Also allowing me to export to PDF’s or whatnot for storage/archive purposes. I’d like to hear from others what platforms/software you use for digital notes and how you use them. If you’d like, we can set up a guest post to share.

My outline for this is going to based on the (currently) free Junior Cybersecurity Analyst self paced course on Cisco’s Networking Academy (NetAcad).

One of the first things I do is create a new OneNote notebook titled the same as the course (etc) I’m following. This helps because then I have a notebook for every Topic/Course/Book/Exam/Technology I study.

I won’t bore you with the first step of creating a notebook in OneNote as I have a hunch I can put a Benjamin on a bet you all know how to do that even if you don’t use the application. So we’ll start with my process of organizing.

First thing is first I peek at the courses outline or (exam blueprint/book chapter/topic structure). Usually (not always) the self paced learning plans anywhere are organized into a hierarchy of the course as a whole, with sub courses and within the sub courses modules (whatever term they use) and within a module topic areas.

That’s how I like to organize my notes. I build a notebook, within the notebook I create what Microsoft OneNote calls section groups for each course in the learning path in the case of this Cisco NetAcad course. Then within the section group I create a section for each module. In the section I then create individual pages for each sub section within that module. At that point I use bulleted notes on the individual page for the sub topics. That sounds complicated but can be modified/adjust for the different types of studying as mentioned above with book chapters/topics, exam blueprints, days of instructor led training etc. As an example look at the screenshot below outlining the notebook/section group/section/page/bulleted notes hierarchy. (Note titles based off Cisco NetAcad course not my own)

I’m curious to your organization structure while note taking. I would also as mentioned enjoy a handwritten note taker to do a guest post. I know some like individual notebooks for every topic/course/book and some like to use those adhesive flags to separate sections in said notebook but would love to share those strategies as well but as I said…..I have Dr.s handwriting being a southpaw so I can’t read what I wrote down yesterday 🙂

Share this article:

Permanent link to this article: https://www.packetpilot.com/just-write-type-it-down-a-note-taking-study-strategy/

Basics to Begin With

Reading Time: 4 minutes

So glancing through various social media a few weeks ago an industry friend posted this:

After asking he was okay with me kind of stealing this topic to make this post. Of course please follow Rowell. He’s a great asset to the community, always sharing topics and advice to everyone and overall just a nice dude. https://rowelldionicio.com/

I’m going to take a step back from his post for a minute. I was lucky enough to grow up in a household where my father spent his entire career working for the telephone company. That kind of gave me a head start. We were early adopters of computing and due to his employment at the telco we had early access to dial-up internet. Also, albeit just fun and games when we’d go out on a fishing trip we’d often stop at the central office’s as he knew of issues and while he fixed them gave me wire and a punch down tool with an empty block to play around with. Kind of gave me a spark later on.

So it became time to graduate high school and go to my local community college. Plenty of degree options but they had one they called “Network Administration”. However, as you looked at the outline of courses involved it was more basic computers and networks. Which in hindsight I’m happy about.

Of course during college I had all the odd jobs: construction/roofing/lumberjack/sandwich shop/etc but they way the degree was structured was this. Microsoft computing foundations, courses build around CompTIA A+, and courses built around CompTIA Network+. Aside from MS foundations it wasn’t really built around any vendors. It was build around the ideas and concepts of computer and networking technology to lay out the fundamentals.

This was great. As a natural progression of those courses I of course took up studying for those exams which helped build study strategies for learning and ultimately obtaining certifications to try and help spark my career.

So where does that actually take me. Well, after building up from those courses and studying those basics for the CompTIA exams it eventually got me into an EasyTech roll at Staples. Eventually I moved away from my parents house and over time got a help desk roll at a healthcare company. It was a small team of 2 helpdesk/deskside support people (one of them me), 1 guy that ran the network, and a couple app analysts for the EMR apps. Slowly I started to get involved into the networking and eventually was able to get sent to a CCNA class. Let me tell you sideways to none knowing networking basics from the Network+ studying/coursework/exam made learning the Cisco way so much easier.

Overtime I ended up working for VAR’s/Consulting and began to learn more and more vendor deployments. To Rowell’s point in his post. Knowing the networking basics made learning that so much easier. While they all might do things a little different the base of technology follows protocols and concepts.

Overall a route is a route, an IP Address is an IP Address, a VLAN is a VLAN. Sure every vendor might call it something different or have some fancy marketing name for it but if you get the concept the only hard part about moving on is memorizing the nuance marketing. Hello in English is different then hello in German but if you understand a hello you can get going.

I learned a lot about this at one VAR I worked at when SD-WAN was a big push. Some customers wanted vendor A, others wanted to use vendor B. So I had to read up and understand them. When it boiled down to it the basic concepts were the same and you know what never truly changed other than implementation? The basic networking concept of routing.

I’m following the same logic as I choose to chase Microsoft Azure Networking AZ-700 but thought to myself, start with a foundation first. So the first thing I did was study the Azure Fundamentals AZ-900 and take that exam. Glad I did. The Fundamentals outlined Microsoft’s Azure VNets which are literally a huge foundational concept as part of all of the Azure Networking. As I study I learn how these basics are key. Funny enough, general networking basics play a huge role as networks/routing/subnetting/IP addresses are all pivotal to know and understand.

Understanding the basics helps you in troubleshooting issues as well. As networking folk we often get pulled into trouble situations. Knowing how to diagnose the core concepts of networking is important in helping rule out network issues vs client/server and application issues. I’ve used those basics all the time to verify end to end connectivity so we could collectively as a team lean on the app or server or workstation to figure out what was causing the issue.

People do it, just go head first into things like CCNA/CCNP and other vendors exams, but in the long run. Understanding the basics aids you first in troubleshooting and verifying, but as to Rowell’s point, makes learning a new technology easier since they are built on those foundations.

Share this article:

Permanent link to this article: https://www.packetpilot.com/basics-to-begin-with/

I’ll take two or more at a time please – A study method

Reading Time: 3 minutes

We Information Technology folks (e.g. Network Engineers, Security Engineers, Cloud Engineers, Software Engineers, etc. the list goes on) are always in a predicament. I can’t speak for everyone but a lot, if not most of us, kind of do it to ourselves in a sense. What is that predicament?

Well, I guess it has multiple elements to it in my opinion. To start as technology changes, grows, expands, whatever you want to call it we often get geeked out about the new. It’s kind of in our blood. The problem is we have to maintain what we already know while keeping up with and learning whats new.

This maintenance comes in a few forms. One is keeping up with the environment we work in. It’s elements, configurations, upcoming changes, etc. Another large thing is keeping our credentials up to date and valid. Some things stay the same which gets tedious to go over again and again and constantly paying to uphold certifications. These change over time, but often hold onto a lot of technology that gets tiresome to re-study time and time again to put it back in your brain just for an exam. As time goes, new elements are added yes, and that’s a fun part of repeating these exams to re-certify but that is the same reason I got burnt out allowing expiry of a lot of credentials I’ve held.

Now there is learning something new. This is exciting and a lot easier to maintain focus and a study schedule. No, I’m not saying you have to study for an exam or certification but I find using those as outlines a good way to organize forward progress and small achievements/goals covering broken down topics that fall under a “section” or “category”. For me I usually do this and take the exam/certification because if I break down studying using those as outlines I might as well attempt it.

So whats with the “I’ll take two or more” thing. It’s an idea I use to keep from the burnout. The thought process is to study for two or more (obviously allowable open/available time based) things at once. Personally my plan is to pick one credential I want to maintain/renew (or in my case obtain again from having it active previously) and pick another that is something new to spark that excitement back into learning/studying.

This allows me to work a bit on that tedious task of going over the same content again and again so when I get that study exhaustion I can bounce to the new and more fun to me thing I’m studying.

This takes some dedication as you can imagine. Organization is also key, not just in note taking and planning time, sections/category breakdowns, but most importantly keeping things separate in your head as well. This is different for everyone but I like using OneNote for note taking and utilizing the training books/videos/course/exam blueprints sections and categories as an outline.

This strategy isn’t for everyone but I figured I’d share it in hopes it can help someone. Also, don’t think this is limited to Information Technology. It could certainly be used in other arenas or even as a way to break away from the doldrums of the field you are maintaining knowledge in. For instance, maybe you are an electrician and need to maintain journeyman statuses but are burning out, you could pick up learning a new language as your second topic as a getaway, or maybe a good getaway is picking up culinary or BBQ skills.

Let’s keep the train wheels moving in this exciting, constantly changing and evolving landscape we call life. High fives and best of luck!

Share this article:

Permanent link to this article: https://www.packetpilot.com/ill-take-two-or-more-at-a-time-please-a-study-method/

Microsoft AZ-700: Module 8 Additional Resource

Reading Time: < 1 minute

Notes from MS Learn AZ-700 Module 8: Design and Implement Network Monitoring – Unit 5: Additional Resources

Resources from MS Learn

Network monitoring solutions

Share this article:

Permanent link to this article: https://www.packetpilot.com/microsoft-az-700-module-8-additional-resource/

Microsoft AZ-700: Exercise – Monitor a Load Balancer Resource Using Azure Monitor

Reading Time: 3 minutes

Notes from MS Learn AZ-700 Module 8: Design and Implement Network Monitoring – Unit 3: Exercise – Monitor a Load Balancer Resource Using Azure Monitor

Tasks (taken from MS Learn: Items without “Task” in front of them are personal additions)

  • Task 1: Create the virtual network.
    • Search and click Virtual networks in portal
    • Select Create
      • Select or Create New under Resource Group (create new in this example)
        • Enter unique name and click OK
      • Enter Unique name in Instance details Name box
      • Choose appropriate Region from dropdown
      • Click Next : IP Addresses >
        • Delete default IPv4 address space
        • Enter new IPv4 address space
        • Click add subnet
          • In right panel enter unique name
          • Enter appropriate Subnet address range
          • Click Add
      • Click Next : Security >
      • Toggle BastionHost to Enable
      • Enter Bastion Name in box
      • Enter AzureBastionSubnet address space in box
      • Select or create new Public IP address (create new in this example)
        • Enter unique name in dialog
        • Click OK
    • Click Review + create
    • Once validation succeeds click Create
  • Task 2: Create the load balancer.
    • Search and choose Load Balancers in portal
    • Click Create
      • Choose Resource Group from dropdown
      • Enter unique name in Instance details name box
      • Click Next : Frontend IP Configuration >
      • Click Add a frontend IP configuratioin
        • In right panel Enter unique name
        • Choose backend subnet from dropdown
        • Click add
    • Click Review + Create
    • Once validated click Create
  • Task 3: Create a backend pool.
    • On Deployment complete page from above click Go to resource
    • In left panel click Backend pools
      • Click Add
        • Enter Unique Name
        • Click Save
  • Task 4: Create a health probe.
    • In left panel choose Health Probes
    • Select Add in menu bar
      • Enter Unique name
      • Change Protocol to HTTP in dropdown
      • Change Interval to 15
      • Click Add
  • Task 5: Create a load balancer rule.
    • In left panel click Load balancing rules
    • Click Add in menu bar
      • Enter unique name
      • Choose Frontend IP Address from dropdown
      • Choose Backend Pool from dropdown
      • Enter Port Number in box
      • Enter backend port number in box
      • Choose created health probe from dropdown
      • Adjust Idle timeout slider to 15 min
      • Click Add
  • Task 6: Create backend servers.
    • Open PowerShell in Azure Portal cloudshell
    • Upload template and parameters files as done in previous exercises
    • Verify account and set subscription and Resource Group variable as done in previous exercises
    • Deploy the 3 VMs using the 3 different parameters files using the same tasks as previous excercises
  • Task 7: Add VMs to the backend pool.
    • Under Load balancers settings in the left pane select Backend Pools
    • Click myBackendPool
    • Click Add under IP configurations
    • Check all three new VMs checkboxes and click add
    • Click Save
  • Task 8: Install IIS on the VMs.
    • Navigate to Virtual Machines in Portal
    • Connect via Bastion to the first VM
    • Open PowerShell in session
      • (Install-WindowsFeature -name Web-Server -IncludeManagementTools)
      • (Remove-Item C:|inetpub\wwwroot\iisstart.htm)
      • Add-Content -Path “C:\inetpub\wwwroot\iisstart.htm” -Value $(“HelloWorld from ” + $env:computername))
      • Repeat for other VMs
  • Task 9: Test the load balancer.
    • Under Virtual Machines Page click Create
    • Choose Azure Virtual Machine
      • Choose appropriate Resource group from dropdown
      • Enter Unique Virtual machine name in box
      • Choose Windows Server 2019 Datacenter – x64 Gen2 from dropdown under image
      • Under size dropdown choose Standard_D2s_v3 – 2 vcpus, 8GiB memory ($137.24/month)
      • Enter creds
      • Click Next : Disks >
      • Click Next : Networking >
        • Under Public IP dropdown select None
        • Toggle NIC network security group to Advanced
          • Under Configure network security group dropdown choose myNSG
    • Click Review + Create
    • Once validated click Create
    • Navigate to Load Balancer (search under portal)
      • Click new LB (myIntLoadBalancer)
      • Click See more
      • Copy private IP
    • Connect to test Virtual Machine via Bastion
      • Open Internet Explorer
      • Browse to LB IP
      • Refresh
        • Should show diff VMs during refreshes
        • Close IE
  • Task 10: Create a Log Analytics Workspace.
    • Search and select log analytics workspaces in portal
    • Click Create
    • Choose appropriate resource group from dropdown
    • Enter Unique Name
    • Choose appropriate region from dropdown
    • Click Review and Create
    • Once validated click Create
  • Task 11: Use Functional Dependency View.
    • In portal navigate to previously create LB
    • Choose Insights in left panel
    • Close metrics pane
    • Click zoom button to zoom in
    • Hovering offers details
    • Click Download Topology
    • Click View Metrics to reopen pane
  • Task 12: View detailed metrics.
    • After closing Metric pane select view detailed metrics
    • Click Frontend & Backend Availability to view response
    • Click Data Throughput
  • Task 13: View resource health.
    • Search and click Monitor in portal
    • Click Service Health in left panel
    • Click Resource Health in left panel
      • In Resource type dropdown choose load balancer
      • Choose new load balancer
  • Task 14: Configure diagnostic settings.
    • Navigate back to new load balancer page
    • Click diagnostic settings in left panel
    • Select Add diagnostic setting
      • Enter unique name
      • Check All Metrics box
      • Click Save
      • Close page
  • Task 15: Clean up resources.
Share this article:

Permanent link to this article: https://www.packetpilot.com/microsoft-az-700-exercise-monitor-a-load-balancer-resource-using-azure-monitor/

Microsoft AZ-700: Monitor Your Networks Using Azure Network Watcher

Reading Time: 3 minutes

Notes from MS Learn AZ-700 Module 8: Design and Implement Network Monitoring – Unit 4: Monitor Your Networks Using Azure Network Watcher

Azure Network Watcher is regional service enabling you to monitor/diagnose network conditions. Allows to diagnose problems at end-to-end network level. Network dianostic and visual tools are available with Network Watcher helping understand, diagnose, and gain. Insight to your Azure network. Designed to monitor/repair network health of IaaS including VMs, VNets, App Gateways, and LB

  • Azure Network Watcher scenarios (example)
    • Automate remote network monitor with packet capture
      • Monitor/Diag network issues without logging into VMs
      • Trigger PCAP by setting alerts
      • Gain real-time perf info at packet level
      • Investigate in detail when issue observed
    • Gain insight into network traffic using flow logs
      • Build deep understanding of traffic patterns using NSG flow logs
      • Info helps gather data for compliance,auditing,monitoring of sec profile
    • Diagnose VPN connectivity
      • Provides ability to diagnose most common VPN GW/Connection issues
      • Allows identifying issue using details logs for further investigation
  • Azure Network Watcher Tools
    • Network Topology
      • Generates visual of resources in VNet as well as relationship between resources
    • Verify IP Flow
      • Diagnose connectivity issues from/to INET and from/to On-prem
    • Next Hop
      • Determine if traffic directed as intended
      • Info helps determine routing
      • Next hop could be INET/VirtualAppliance/Virtual Network Gateway/VNet/VNet Peering/None
    • Effective Security Rules
      • NSG are associated at subnet or NIC.
      • Effect rules returns all configured NSGs/rules associated to VM
      • Allows accessing things like open ports
    • VPN Diags
      • Returns info to aid tshoot of Gateways and connections
      • Summary info includes
        • Connection statistics
        • CPU Info
        • Memory Info
        • IKE errors
        • Packet Drops
        • Buffers
        • Events
    • Packet Capture
      • Capture sessions to track traffic to/from VM
      • Aids in diagnosing network anomalies
      • Gather network stats
      • Info on network intrusions
      • Debug client-server comms
    • Connection Troubleshooting
      • More recent addition to Watcher suite
      • Provides net perf data
    • NSG Flow Logs
      • Maps IP traffic through NSGs
        • Network Monitoring
          • Identify unknown or undesired traffic
          • Monitor traffic/bandwidth consumption
          • Filter logs by IP & port to understand app behavior
          • Export Flow Logs to tools for dashboards
        • Usage Monitoring/Optimization
          • Identify top talkers
          • Combine with data to identify cross-region traffic
          • Understand traffic growth for forcasting
          • Use to remove overtly restrictive rules
        • Compliance
          • Use flow data to verify isolation/compliance with enterprise rules
        • Network forensics/security analysis
          • Flows analyzed from compromised IP/NICs
          • Explort logs to SIEM/IDS tools
  • Connection Monitor Overview
    • Provides unified e-to-e monitoring in Network Watcher
    • Connection Monitor supports hybrid and Azure cloud
    • Provides tools to monitor/diagnose/view connectivity related metrics for Azure deployments
    • Benefits of Connection Monitor
      • Unified, Intuitive experience in Azure and Hybrid
      • Cross-region/workspace connectivity monitoring
      • High probing freq and better viz into network perf
      • Faster alerting for hybrid
      • Support connectivity checks based on HTTP/TCP/ICMP
      • Metrics/Log Analytics for both Azure and non-Azure tests
    • Example Use Cases
      • Front end web server VM communicating with DB in multi-tier app
        • Test connectivity between the two VMs
      • VMs in East US ping VMs in Central US
        • Compare cross-region latency
      • Multi on-premises office in diff locations
        • Office connect to MS 365 Url
        • Compare latency between locations
      • Hybrid app required connectivity to Azure storage
        • On-prem site and Azure app connect to same endpoint
        • Compare latency between the two
      • Check connectivity between on-prem and Azure VM’s hosting cloud app
  • Connection Monitor Components
    • Connection Monitor Resource
      • Region specific Azure resource
      • All following entities are properties of this
    • Endpoint
      • SRC/DST participating in connectivity checks
        • VM
        • On-prem agent
        • URL
        • IP’s
    • Test config
      • Protocol-specific config for test
      • Based on chosen protocol
      • Define port/threshold/frequency/etc
    • Test group
      • Group containing SRC/DST endpoints and test configs
      • Connection Minotir can contain multiple test groups
    • Test
      • Combo of SRC/DST endpoint and test config
      • Most granular
      • Includes percentage of checks failed and RTT
  • Traffic Analytics
    • Cloud-based providing visibility into user/app activity in cloud networks
    • Traffic Analytics looks at Network Watcher NSG flow logs to provide insight into traffic flow
    • Abilities
      • Visualize network activity across subscriptions and identify hot spots
      • Identify sec threat to and secure network with info such as
        • Open Ports
        • Apps attempting INET access
        • VMs connecting to rouge nets
      • Determine traffic flow patterns over Azure regions and INET
      • Pinpoint misconfigs leading to failed connections
  • How Traffic Analytics Works
    • Examines raw NSG flow logs
    • Aggregated and then enhanced
    • Enhancements
      • Geography
      • Security
      • Topology Info
    • Info stored in Log Analytics workspace
Share this article:

Permanent link to this article: https://www.packetpilot.com/microsoft-az-700-monitor-your-networks-using-azure-network-watcher/

Microsoft AZ-700: Monitor Your Networks Using Azure Monitor

Reading Time: 3 minutes

Notes from MS Learn AZ-700 Module 8: Design and Implement Network Monitoring – Unit 2: Monitor Your Networks Using Azure Monitor

  • What is Azure Monitor
    • Helps to maximize availability/performance of apps and services
    • Delivers comprehensive solution for collecting/analyzing/acting on telemetry from cloud and on-prem
    • Info helps understand how apps are performing and identify issues affecting them and depended upon resources
    • Sample list of features
      • Use App Insights to detect/diagnose issues across apps
      • Correlate infra issues with VM and Container insights
      • Use log analytics for troubleshooting/diagnostics of monitoring data
      • Support ops at scale with smart alerts/automated actions
      • Create visual dashboards and workbooks in Azure
      • Collect data from monitored resources using. Azure Monitor Metrics
    • Diagram below offers high-level overview of Azure Monitor
    • Two fundamental types of data
      • Metrics
      • Logs
    • Left Panel is monitoring source to populate data stores
    • Right Panel is actions that can be performed on said data
      • Analysis
      • Alerting
      • Stream to ext sources
    • (Image taken from MS Learn)
  • Monitor data types in Azure Monitor
    • Two types of data collected
      • Metrics
        • Azure Monitor Metrics is feature collecting numeric data from monitored resources into time series DB
        • Metrics are numerical and collected at regular intervals
        • Describe aspects of system at a particular time
        • Lightweight/Capable of supporting near real-time – useful for alerting
      • Logs
        • Contain diff kinds of data organized into records with diff properties for each type
        • Telemetry(events and traces) stored as logs in addition for perf data for analysis
  • Azure Monitor metric sources
    • 4 key sources of collected
      • Azure resources
        • Create platform metrics giving visibility into resource health/perf
        • Each resource type creates distinct metrics
        • Platform metrics collected from Azure resource at 1min unless defined differently
      • Applications
        • App insights show metrics for monitored apps to aid in perf issue and trend detection
        • Includes server response time and browser exceptions
      • VM Agents
        • Collected from guest OS
        • Enable guest OS for Windows VM with Windows Diagnostic Extension (WAD)
        • Linux VMs with InfluxData Telegraf Agent
      • Custom
        • Defined metrics in app monitored with App Insights
        • Also custom metrics for Azure service using custom API
  • Azure Monitor Metric tasks
    • Table summarized tasks possible for using metrics
    • (Table below from MS Learn)
  • Metrics Explorer
    • Data collected is shown in the Monitoring tab of a resource Overview Page
    • Example for a VM
      • CPU
      • Network
      • Disk
  • Monitor network resources with Azure Monitor Network Insights
    • Use Insights > Networks section of Azure Monitor for high-level network resource health and metrics
    • Provides access to network monitoring features
      • Connection Monitor
      • Flow Logging for NSG
      • Traffic Analytics
    • Key components
      • Network Health/Metrics
        • Offers simple method of visualizing inventory of net resources along with resource health and alerts
        • Health divided into 4 areas
          • Search & filtering
          • Resource health & metrics
          • Alerts
          • Dependency view
      • Connectivity
        • Providing visualization of Connection Monitor tests
        • Test grouped by SRC/DST
      • Traffic
        • Providing access to NSG flow logs & Traffic analytics for selected subscriptions
        • Grouped by location
        • Searchable by any IP addr in environment
      • Diagnostic Toolkit
        • Providing access to all diag feature available for shoot of network/components
        • Most user Network Watcher
          • Capture packets for anomaly diagnoses
          • Troubleshoot VPN
            • Diagnose Virtual Network Gateway/Connection health
          • Troubleshoot connectivity
            • Check TCP connections
            • Includes FQDN, URI, or IPv4 Addr
          • Identify Next Hops
            • Obtain next hop type/IP of packet from VM and NIC
            • Knowing can help establish traffic direction to expected DST or drops
          • Diagnose traffic filtering issues
            • Verify packet is allowed/denied to/from VM
            • Security group decision and name of rule denying traffic returned
Share this article:

Permanent link to this article: https://www.packetpilot.com/microsoft-az-700-monitor-your-networks-using-azure-monitor/

MS AZ-700: Module 7: Design and Implement Private Access to Azure Services – Unit 7: Summary + Additional Resources from MS Learn Course

Reading Time: < 1 minute

Notes from MS Learn AZ-700 Module 6: Design and implement network security – Unit 7: Summary + Additional Resources from MS Learn Course

Additional links from MS Learn Course

Share this article:

Permanent link to this article: https://www.packetpilot.com/ms-az-700-module-6-summary-additional-resources-from-ms-learn-course/

Microsoft AZ-700: Exercise – Create an Azure Private Endpoint Using Azure PowerShell

Reading Time: 2 minutes

Notes from MS Learn AZ-700 Module 7: Design and Implement Private Access to Azure Services – Unit 6: Exercise – Create an Azure Private Endpoint Using Azure PowerShell

Tasks (taken from MS Learn: Items without “Task” in front of them are personal additions)

  • Task 1: Create a resource group and deploy the prerequisite web app.
    • Open PowerShell in cloudshell under portal: Button next to search bar
    • Upload template and parameter file as done in previous exercises
    • View/verify subscription
      • (az account show –output table)
    • Set subscription
      • (az account set –subscription “Name as noted from output above”
    • Create Resource Group
      • (New-AzResourceGroup -Name ‘NAME-rg’ -Locatiion ‘eastus’)
    • Set Resource Group name variable
      • ($RGName = “CreatePrivateEndpointQS-rg”)
    • Create VMs
      • (New-AzResourceGroupDeployment -ResourceGroupName $RGName -TemplateFile templatefile.json -TemplateParameterFile parametersfilename.json)
  • Task 2: Create a virtual network and bastion host.
    • Create backend subnet
      • ($subnetConfig = New-AzVirtualNetworkSubnetConfig -Name myBackendSubnet -AddressPrefix 10.0.0.0/24)
    • Create Azure Bastion Subnet
      • ($bastsubnetConfig = NewAzVirtualNetworkSubnetConfig -Name AzureBastionSubnet -AddressPrefix 10.0.1.0/24)
    • Create Virtual Network
      • ($vnet = New-AzVirtualNetwork @parameters1)
    • Create Public IP for Bastion Host
      • ($parameters2 = @{
        Name = ‘myBastionIP’
        ResourceGroupName = ‘CreatePrivateEndpointQS-rg’
        Location = ‘eastus’
        Sku = ‘Standard
        AllocationMethod = ‘Static’
        }
      • ($publicip = New-AzPublicIpAddress @parameters2)
    • Create Bastion Host
      • ($parameters3 = @{
        ResourceGroupName = ‘CreatePrivateEndpoingQS-rg’
        Name = ‘myBastion’
        PublicIpAddress = $publicip
        VirtualNetwork = $vnete
        })
      • (New-AzBastion @parameters3)
  • Task 3: Create a test virtual machine.
    • Set local admin creds for VM
      • ($cred = Get-Credential)
      • Input Username
      • Input Password
    • Get VNet config
      • ($vnet = Get-AzVirtualNetwork -Name myVNet -ResourceGroupName CreatePrivateEndpoingQS-rg)
    • Create VM NIC
      • ($parameters1 = @{
        Name = ‘myNicVM’
        ResourceGroupName = ‘CreatePrivateEndpoingQS-rg’
        Location = ‘eastus’
        Subnet = $vnet.Subnets[0]
        })
      • ($nicVM = New-AzNetworkInterface @parameters1)
    • Create VM Configuration
      • ($parameters2 = @{
        VMName = ‘myVM’
        VMSize = ‘Standard_DS1_v2’
        })
      • ($parameters3 = @{
        ComputerName = ‘myVM’
        Credential = $cred
        })
      • ($parameters4 = @{
        PublisherName = ‘MicrosoftWindowsServer’
        Offer = ‘WindowsServer’
        Skus = ‘2019DataCenter’
        Version = ‘latest’
        })
      • ($vmConfig = New-AzVMConfig @parameters2 | Set-AzVMOperatingSystem -Windows @parameters3 | Set-AzVMSourceImage @parameters4 | Add-AzVMNetworkInterface -Id $nicCM.Id)
      • (New-AzVM -ResourceGroupName ‘CreatePrivateEndpoingQS-rg’ -Location ‘eastus’ -VM $vmConfig)
  • Task 4: Create a private endpoint.
    • Place Webapp into variable
      • ($webapp = Get-AzWebApp -ResourceGroupName CreatePrivateEndpointQS-rg)
    • Create Private Endpoint connection
      • ($parameters1 = @{
        Name = ‘myConnection
        PrivateLinkServiceId = $webapp.ID
        GroupID = ‘sites’
        })
      • $privateEntpointConnection = New-AzPrivateLinkServiceConnection @parameters1)
    • Place VNet into variable
      • ($vnet = Get-AzVirtualNetwork -ResourceGroupName ‘CreatePrivateEndpoingQS-rg’ -Name ‘myVNet’)
    • Disable Private Endpoint Policy
      • ($vnet.Subnets[0].PrivateEndpointNetworkPolicies = “Disabled”
      • ($vnet | Set-AzVirtualNetwork)
    • Create Private Endpoint
      • ($parameters2 = @{
        ResourceGroupName = ‘CreatePrivateEndpoingQS-rg’
        Name = ‘myPrivateEndpoint’
        Location = ‘eastus’
        Subnet = $vnet.Subnets[0]
        PrivateLinkServiceConnection = $privateEndpoingConnection
        })
      • New-AzPrivateEndpoint @parameters2)
  • Task 5: Configure the private DNS zone.
    • Place VNet into variable
      • (vnet = Get-AzVirtualNetwork -ResourceGroupName ‘CreatePrivateEndpointQS-rg’ -Name ‘myVNet’)
    • Create Private DNS Zone
      • ($parameters1 = @{
        ResourceGroupName = ‘CreatePrivateEndpointQS-rg’
        Name = ‘privatelinke.azurewebsites.net’
        })
      • ($zone = New-AzPrivateDnsZone @parameters1)
    • Create DNS Network Link
      • ($parameters2 = @{
        ResourceGroupName = ‘CreatePrivateEndpoingQS-rg’
        ZoneName = ‘privatelink.azurewebistes.net’
        Name = ‘myLink’
        VirtualNetworkId = $vnet.Id
        })
      • ($link = New-AzPrivateDnsVirtualNetworkLink @parameters2)
    • Create DNS Config
      • ($parameters3 = @{
        Name = ‘privatelink.azurewebsites.net’
        PrivateDnsZoneId = $zone.ResourceId
        })
      • ($config = New-AzPrivateDnsZoneConfig @parameters3)
    • Create DNS Zone Group
      • ($parameters4 = @{
        ResourceGroupName = ‘CreatePrivateEndpoingQS-rg’
        PrivateEndpointName = ‘myPrivateEndpoint’
        Name = ‘myZoneGroup’
        PrivateDnsZoneConfig = $config
        })
      • (New-AzPrivateDnsZoneGroup @parameters4)
  • Task 6: Test connectivity across the private endpoint.
    • Navigate to Virtual Machines in portal
    • Open myVM created earlier
    • Click Connect > Bastion
      • Enter credentions and click connect
      • Open PowerShell
        • (Nslookup contoso-webapp-755238.azurewebsites.net)
          • Private IP provided from subnet
        • Browse to URL in Internet Explorer
        • Select OK in dialog
        • Success
Share this article:

Permanent link to this article: https://www.packetpilot.com/microsoft-az-700-exercise-create-an-azure-private-endpoint-using-azure-powershell/

Microsoft AZ-700: Exercise – Restrict Network Access to PaaS Resources with Virtual Network Service Endpoints Using the Azure Portal

Reading Time: 3 minutes

Notes from MS Learn AZ-700 Module 7: Design and Implement Private Access to Azure Services – Unit 5: Exercise – Restrict Network Access to PaaS Resources with Virtual Network Service Endpoints Using the Azure Portal

Tasks (taken from MS Learn: Items without “Task” in front of them are personal additions)

  • Task 1: Create a virtual network.
    • Search and select Virtual Networks in portal
    • Click Create
      • Select or Create New Resource group (create new in this example)
        • Enter unique name in dialog and click OK
      • Enter Instance Name
      • Choose Region from dropdown
      • Click Next : IP Addresses >
      • Click link for default
        • In right panel change name to Public
        • Click Save
      • Click Next : Security >
      • Verify all security settings toggled to Disable
      • Click Review + create
      • Once validated click Create
  • Task 2: Enable a service endpoint.
    • Click Go to resource on deployment complete page from task above
    • Click Subnets in left panel
    • Click Subnet in menu bar to create a new subnet
      • In right panel
        • Enter unique name for subnet
        • Under Service Endpoints choose Microsoft.Storage from services dropdown
        • Click Save
    • Note 2 subnets created: Public and Private
  • Task 3: Restrict network access for a subnet.
    • Search and click Network security groups in portal
    • Click Create in menu bar
      • Choose Resource group from dropdown
      • Enter unique name under Instance details
    • Click Review + create
    • Once validated click Create
    • Once deployment complete choose Go to resource
    • Under Settings choose Outbound security rules
      • Click Add in menu bar
      • In right panel
        • Choose Service Tag in Source dropdown
        • Choose Virtual Network in Source service tag dropdown
        • Choose Service Tag in Destination dropdown
        • Choose Storage in Destination Service Tag dropdown
        • Enter wildcard (*) in Destination port ranges box
        • Enter unique name in Name box
        • Click Add
      • Click Refresh to verify rule created with Priority 100
  • Task 4: Add other outbound rules.
    • Follow MS Learn steps similar to above to Deny Internet All
    • Change Priority to 110
    • Click Add
    • Refresh page to verify rule with priority 110 created
  • Task 5: Allow access for RDP connections.
    • Under settings in left panel click Inbound Security Rules
    • Click Add in menu bar
      • In right panel
        • Select Service Tag in Destination dropdown
        • Select Virtual Network in Destination Service Tag dropdown
        • Change port in Destination port ranges box to 3389
        • Add unique name for rule in Name box
        • Click Add
    • Click Refresh to verify new rule created
    • Click Subnets in left panel
      • Click Associate in menu bar
      • In right panel
        • Select Private subnet from subnet dropdown
        • Click OK
  • Task 6: Restrict network access to a resource.
    • This is really just a task to create the storage account but Task 6: Title is as from MS Learn
    • Search and click Storage Accounts in portal
    • Click Create
      • Choose resource group from dropdown
      • Enter unique storage account name
      • Choose Locally-redundant storage (LRS): from Redundancy dropdown
      • Click Review
      • Click Create
  • Task 7: Create a file share in the storage account.
    • Click Go to resource from deployment completion page from Task 6 steps
    • Choose File Shares under data storage in left panel
    • Click File Share in menu bar
      • In right panel
        • Enter Marketing in Name box
        • Click Create
  • Task 8: Restrict network access to a subnet.
    • In left panel under Security + networking choose Networking
    • Toggle Public Network Access to “Enabled from selected virtual networks and IP addresses
    • Click Add existing virtual network
      • In right panel
        • Select VNet under Virtual networks dropdown
        • Select subnet under Subnets dropdown (Private)
        • Click Add
    • Click Save in menu bar
    • In left panel under Security + Networking choose Access Keys
      • Click Show button for Key under key1
      • Click Copy to clipboard button
  • Task 9: Create virtual machines.
    • Open PowerShell in cloudshell pane (button next to portal search bar)
    • Upload Template and Parameter file as we’ve done in previous exercises
    • Verify Subscription
      • (az account show –output table)
    • Set account
      • (az account set –subscription “Name from output above”)
    • Set resource group name variable

($RGName = “myResourceGroup”)

  • Deploy VM
    • (New-AzResourceGroupDeployment -ResourceGroupeName $RGName -TemplateFile filename.json -TemplateParameterFile filename.parameters.json)
  • Close cloud PowerShell
  • Search Virtual Machines and verify new VMs created
  • Task 10: Confirm access to storage account.
    • Choose Private VM
    • Select Connect > RDP from menu bar
    • Click Download RDP File
    • Click Open file link
    • Click Connect on dialog
    • Enter creds and click OK
    • Search for PowerShell in RDP session
      • ($acctKey = ConvertTo-SecureString -String “previouslycopiedkey” -AsPlainText -Force)
      • (credential = New-Object System.Management.Automation.PSCredential -ArgumentList “Azure\contosostorage755238”, $acctKey)
      • (New-PSDrive -Name Z -PSProvider FileSystem -Root “\\contosostorage755238.file.core.windows.net\marketing” -Credential $credential)
      • Ping bing.com
        • Should fail
      • Close RDP Session and ContosoPrivate VM page in portal
    • Choose ContosoPublic VM
    • Click Connect > RDP from menu bar
    • Click Download RDP File
    • Click Open file link
    • Click Connect on dialog
    • Enter creds and click OK
    • Open PowerShell in RDP session
      • ($acctKey = ConvertTo-SecureString -String “previouslycopiedkey” -AsPlainText -Force)
      • (credential = New-Object System.Management.Automation.PSCredential -ArgumentList “Azure\contosostorage755238”, $acctKey)
      • (New-PSDrive -Name Z -PSProvider FileSystem -Root “\\contosostorage755238.file.core.windows.net\marketing” -Credential $credential)
        • Output should list Access is denied
      • Ping bing.com
        • Should be successful
    • Close RDP session
    • Search Storage accounts in portal
      • Choose the new contosostorage account created earlier
      • Choose File share in left panel under Data Storage
      • Choose marketing
        • Access is denied due to PC not in private subnet
Share this article:

Permanent link to this article: https://www.packetpilot.com/microsoft-az-700-exercise-restrict-network-access-to-paas-resources-with-virtual-network-service-endpoints-using-the-azure-portal/

Load more