Archive for the ‘Azure’ Tag

Microsoft Tech Summit Amsterdam #MSTechSummit   Leave a comment

Today and tomorrow I’ll be at the Microsoft Tech Summit.  You can find me at the Workshop Proctor "Build and manage your applications on Azure" or at the  Microsoft Booth or somewhere at the Expert Hub Center the help the Microsoft Tech Community

To help the Community / visitors Build your skills with the latest in cloud technologies at a free, technical learning event for IT professionals and developers, coming to a city near you. The Tech Summit is hitting the road with their top engineers to bring you two days of in-depth sessions, networking opportunities, industry insights, and hands-on skill-building with the experts behind Microsoft’s cloud services.

The cloud is changing expectations and transforming the way we live and work. Whether you’re developing innovative apps or delivering optimized solutions, Microsoft Tech Summit can help you evolve your skills, deepen your expertise, and grow your career.

Discover the latest trends, tools, and product roadmaps at more than 70 sessions, covering a range of topics across Microsoft Azure and Microsoft 365, which includes Windows 10, Office 365, and Enterprise Mobility + Security. From beginner sessions that will help you develop core cloud skills, to advanced, 400-level training that will take your expertise to the next level, there is something for everyone.

image

This year we will have two 60-minute keynotes focusing on Microsoft 365 and Azure. This will enable our keynote presenters to focus deeply on their areas of expertise and will include customers on stage and demos.

New this year to Microsoft Tech Summit is The Hub Expert Center where attendees will have the opportunity to connect with Microsoft SME’s during Day 1 and 2. It is an excellent opportunity to connect, gather lead retrievals and engage with potential customers.

Ask the Experts: We will hold an Ask the Experts Networking Hour on Day 1 from 17:45 – 18:45. All Speakers and Staff are required to attend this event. New this year are two 30-minute panels hosted by Microsoft SME and MVP’s. Additionally, attendees will be able to interact and learn from industry peers and representatives from Microsoft. Expert table topics will be as follows, and Speakers are required to self-staff these areas: Business Applications, Data and AI, Cloud Infrastructure, App Development, Internet of Things, Modern Workplace and Microsoft 365

 

on the Microsoft Tech Community at:

Visit aka.ms/ts/amsterdam

Sign in with your Microsoft or LinkedIn account and select ‘Evaluations’ to submit your feedback after sessions

image

Advertisements

Posted March 28, 2018 by Robert Smit [MVP] in Event

Tagged with ,

How to Backup Azure file shares with #AzureBackup #ASR #AFSB #Azure   Leave a comment

Backup for Azure file shares is something that is a feature that we all want. Azure Files is a cloud-first file share solution with support for industry standard SMB protocol. Azure Backup enables a native backup solution for Azure file shares, a key addition to the feature arsenal to enable enterprise adoption of Azure Files. Using Azure Backup, via Recovery Services vault, to protect your file shares is a straightforward way to secure your files and be assured that you can go back in time instantly.

If you want to read my old blogs about Azure backup https://robertsmit.wordpress.com/tag/azure-backup/

Below is a schematic on how the Backup for Azure File Shares Works.

Backup for Azure File Shares

Key features

  • Discover unprotected file shares: Utilize the Recovery Services vault to discover all unprotected storage accounts and file shares within them.
  • Backup multiple files at a time: You can back up at scale by selecting multiple file shares in a storage account and apply a common policy over them.
  • Schedule and forget: Apply a Backup policy to automatically schedule backups for your file shares. You can schedule backups at a time of your choice and specify the desired retention period. Azure Backup takes care of pruning these backups once they expire.
  • Instant restore: Since Azure Backup utilizes file share snapshots, you can restore just the files you need instantly even from large file shares.
  • Browse individual files/folders: Azure Backup lets you browse the restore points of your file shares directly in the Azure portal so that you can pick and restore only the necessary files and folders.

How to start with the Azure File share backup

First we make a backup vault that holds all the backups.

image

In the Azure Recovery services Vault I created a new vault that holds my file share backup.

Doing this with powershell :

$vaultname="Azure-Fileshare-Vault02"
$rsgroup="AFS-BV-02"
$Location="West US"

Get-AzureRmRecoveryServicesVault
New-AzureRmResourceGroup -Name $rsgroup -Location $Location
New-AzureRmRecoveryServicesVault -Name $vaultname -ResourceGroupName $rsgroup -Location $Location

Now we open the just created backup vault and add a Backup job

image

Adding the Azure Backup job

image

As you can see the new Azure FileShare option is there.  If you want to do this with Powershell keep in mind that you will need the latest updates and as this is a preview it might change in the next version as currently there is only the -WorkloadType "AzureVM" option there.

image

Now we select the storage account that holds the file share.

image

It could take some time for the validation.

image

Now that the file share is selected, we can make a backup policy. Or use one that you already created.

image

After establishing a backup policy, a snapshot of the File Shares will be taken at the scheduled time, and the recovery point is retained for the chosen period.

image

Then finally we enable the backup. There will be a initial backup created.

image

When you check the backup jobs in you backup vault you can see the just created file share backup.

image

Just wait for the first backup or go to the job an right click and do a backup now.

image

You can also create an ondemand backup or stop the backup. 

image

With the backup now you can force to backup the FileShare.

image

If you double click the backup item and go to …more you can Stop the backup or even delete the backup.

Azure File Share Restore

image

Well the Azure FileShare Restore is easy, Pick restore in the menu and pick a restore point.

image

You can pick the original location but an alternate location can also be used. This is a great option on selecting the files or place the restored files on a different locations to sort out the files first.

 

Follow Me on Twitter @ClusterMVP

Follow My blog https://robertsmit.wordpress.com

Linkedin Profile Robert Smit MVP Linkedin profile

Google  : Robert Smit MVP profile

Bing  : Find me on Bing Robert Smit

LMGTFY : Find me on google Robert Smit

Posted February 27, 2018 by Robert Smit [MVP] in Azure Site Recovery

Tagged with ,

Check with Powershell for Meltdown and Spectre #exploit critical vulnerabilities Protection #Meltdown #Spectre #KB4056892   1 comment

Meltdown and Spectre exploit critical vulnerabilities in modern processors. These hardware bugs allow programs to steal data which is currently processed on the computer. While programs are typically not permitted to read data from other programs, a malicious program can exploit Meltdown to get hold of secrets stored in the memory of other running programs. This might include your passwords stored in a password manager or browser, your personal photos, emails, instant messages and even business-critical documents.

Edit:5-1-2018

Meltdown is Intel-only and takes advantage of a privilege escalation flaw allowing kernel memory access from user space, meaning any secret a computer is protecting (even in the kernel) is available to any user able to execute code on the system.

Spectre applies to Intel, ARM, and AMD processors and works by tricking processors into executing instructions they should not have been able to, granting access to sensitive information in other applications’ memory space.

Meltdown work on personal computers, mobile devices, and in the cloud. Depending on the cloud provider’s infrastructure, it might be possible to steal data from other customers.

image

Microsoft is aware of a new publicly disclosed class of vulnerabilities referred to as “speculative execution side-channel attacks” that affects many modern processors and operating systems including Intel, AMD, and ARM. Note: this issue will affect other systems such as Android, Chrome, iOS, MacOS, so we advise customers to seek out guidance from those vendors.

Microsoft has released several updates to help mitigate these vulnerabilities. We have also taken action to secure our cloud services. See the following sections for more details.

Microsoft has not received any information to indicate that these vulnerabilities have been used to attack customers at this time. Microsoft continues to work closely with industry partners including chip makers, hardware OEMs, and app vendors to protect customers. To get all available protections, hardware/firmware and software updates are required. This includes microcode from device OEMs and in some cases updates to AV software as well.

The following sections will help you identify and mitigate client environments affected by the vulnerabilities identified in Microsoft Security Advisory ADV180002.

The Windows updates will also provide Internet Explorer and Edge mitigations. We will also continue to improve these mitigations against this class of vulnerabilities.

Customers who only install the Windows January 2018 security updates will not receive the benefit of all known protections against the vulnerabilities. In addition to installing the January security updates, a processor microcode, or firmware, update is required. This should be available through your device manufacturer. Surface customers will receive a microcode update via Windows update.

Install the powershell module from the Gallery.

image

Install-Module SpeculationControl

image

With  Get-SpeculationControlSettings you can check your settings

image

As my system is not protected, but after all the fixes it should be like this below.

image

But you need to do more than just a software patch.

Customers who only install the Windows January 2018 security updates will not receive the benefit of all known protections against the vulnerabilities. In addition to installing the January security updates, a processor microcode, or firmware, update is required. This should be available through your device manufacturer. Surface customers will receive a microcode update via Windows update.

checking the BIOS of you machine with

get-wmiobject win32_bios

image

image

As there is no later Bios from my system, I’m out off luck.  good moment to renew my test machine.

SO I need to patch my system, As I’m a windows insider I run several versions of windows. First check there was KB4056890 but this is already updated to KB4056892 make sure you get the latest version of the patch. you don’t want to patch and reboot the machine twice.

https://support.microsoft.com/en-us/help/4056892/windows-10-update-kb4056892

Get the hotfix http://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4056890

image

The Updated version!

Get the hotfix http://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4056892

 

http://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4056892

 

In this case I installed the KB4056890 Update installation may stop at 99% and may show elevated CPU there is a fix for that read this :

https://support.microsoft.com/en-us/help/4056892/windows-10-update-kb4056892

 

image

You need a reboot for this fix.

image

Remember this is not just a Microsoft Windows thing if you are on Citrix,Xenserver,Amazon or VMWare You need to check your hardware.

https://blogs.vmware.com/security/2018/01/vmsa-2018-0002.html

 

 

Follow Me on Twitter @ClusterMVP

Follow My blog https://robertsmit.wordpress.com

Linkedin Profile Http://nl.linkedin.com/in/robertsmit

Google Me : https://www.google.nl

Bing Me : http://tinyurl.com/j6ny39w

LMGTFY : http://lmgtfy.com/?q=robert+smit+mvp+blog

Posted January 4, 2018 by Robert Smit [MVP] in Windows Server 2016

Tagged with

End of support for #DirSync and #AzureAD Sync upgrade to #Azure AD Connect before end off 2017 #Cloud   Leave a comment

Azure AD Connect is the best way to connect your on-premises directory with Azure AD and Office 365. This is a great time to upgrade to Azure AD Connect from Windows Azure Active Directory Sync (DirSync) or Azure AD Sync as these tools are now deprecated and are no longer supported as of April 13, 2017.

image

The two identity synchronization tools that are deprecated were offered for single forest customers (DirSync) and for multi-forest and other advanced customers (Azure AD Sync). These older tools have been replaced with a single solution that is available for all scenarios: Azure AD Connect. It offers new functionality, feature enhancements, and support for new scenarios. To be able to continue to synchronize your on-premises identity data to Azure AD and Office 365, we strongly recommend that you upgrade to Azure AD Connect. Microsoft does not guarantee these older versions to work after December 31, 2017.

Suppose you are on an old version below is the link to get the latest version

Microsoft Azure Active Directory Connect

https://www.microsoft.com/en-us/download/details.aspx?id=47594

  • Integrating your on-premises directories with Azure AD makes your users more productive by providing a common identity for accessing both cloud and on-premises resources. With this integration users and organizations can take advantage of the following:
    • Organizations can provide users with a common hybrid identity across on-premises or cloud-based services leveraging Windows Server Active Directory and then connecting to Azure Active Directory.
    • Administrators can provide conditional access based on application resource, device and user identity, network location and multifactor authentication.
    • Users can leverage their common identity through accounts in Azure AD to Office 365, Intune, SaaS apps and third-party applications.
    • Developers can build applications that leverage the common identity model, integrating applications into Active Directory on-premises or Azure for cloud-based applications

    Azure AD Connect makes this integration easy and simplifies the management of your on-premises and cloud identity infrastructure.

But where to find the current version of the Azure AD connect ? If we go to the management tool you can see this in the GUI

Go to the folder Microsoft Azure AD Sync

 

image

 

image

Now start the miisclient.exe and in the about there is your version number

image

Detailed Azure AD Connect: Version release history

https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-version-history

If you need to upgrade you can do an in-place upgrade (Automatic upgrade)

High-level steps for upgrading from DirSync to Azure AD Connect
  1. Welcome to Azure AD Connect
  2. Analysis of current DirSync configuration
  3. Collect Azure AD global admin password
  4. Collect credentials for an enterprise admin account (only used during the installation of Azure AD Connect)
  5. Installation of Azure AD Connect
    • Uninstall DirSync (or temporarily disable it)
    • Install Azure AD Connect
    • Optionally begin synchronization

Remember Azure AD will stop accepting connections from DirSync and Azure AD Sync after December 31, 2017 Upgrade now to avoid downtime and start 2018 relaxed.

 

 

Follow Me on Twitter @ClusterMVP

Follow My blog https://robertsmit.wordpress.com

Linkedin Profile Http://nl.linkedin.com/in/robertsmit

Google Me : https://www.google.nl

Bing Me : http://tinyurl.com/j6ny39w

LMGTFY : http://lmgtfy.com/?q=robert+smit+mvp+blog

Posted December 28, 2017 by Robert Smit [MVP] in Azure

Tagged with ,

Step by Step Azure File Sync – on-premises file servers to #Azure Files Storage Sync Service #AFS #Cloud #MSIgnite   5 comments

Finally Azure File Sync is there in public preview, for the last months I had the pleasure to work with the Azure File Sync team and tested the product and thought about some great ideas where Azure File Sync (AFS) could be useful. And I guess you all have Ideas where you could use AFS. Placing your File server somewhere and get your files to the cloud.  Our use a Azure Data Box ADB https://azure.microsoft.com/nl-nl/updates/azure-data-box-preview/

With Azure File Sync (preview), shares can be replicated on-premises or in Azure and accessed through SMB or NFS shares on Windows Server. Azure File Sync is useful for scenarios in which data needs to be accessed and modified far away from an Azure datacenter, such as in a branch office scenario. Data may be replicated between multiple Windows Server endpoints, such as between multiple branch offices.

Azure File Sync (AFS)

Azure File Sync is a multi-master sync solution, it makes it easy to solve global access problems introduced by having a single point of access on-premises, or in Azure by replicating data between Azure File shares and servers anywhere in the world. With Azure File Sync, we’ve introduced a very simple concept, the Sync Group, to help you manage the locations that should be kept in sync with each other. Every Sync Group has one cloud endpoint, which represents an Azure File share, and one or more server endpoints, which represents a path on a Windows Server. That’s it! Everything within a Sync Group will be automatically kept in sync!

    Azure File Sync enables organizations to:

    • Centralize file services in Azure storage
    • Cache data in multiple locations for fast, local performance
    • Eliminate local backup and DR

    The Azure File Sync agent is supported on Windows Server 2016 and Windows Server 2012 R2 and consists of three main components:

    • FileSyncSvc.exe: The background Windows service responsible for monitoring changes on Server Endpoints and initiating sync sessions to Azure.
    • StorageSync.sys: The Azure File Sync file system filter, responsible for tiering cold files to Azure Files (when cloud tiering is enabled).
    • PowerShell management cmdlets: PowerShell cmdlets for interacting with the Microsoft.StorageSync Azure Resource Provider. The cmdlets can be found at the following locations (by default):
  • %ProgramFiles%\Azure\StorageSyncAgent\StorageSync.Management.PowerShell.Cmdlets.dll
  • %ProgramFiles%\Azure\StorageSyncAgent\StorageSync.Management.ServerCmdlets.dll

The Azure File Sync agent also includes a preview version of the Work Folders server feature which has been updated to support Azure File Sync. This preview version of Work Folders does not have a UI and must be managed via PowerShell: https://docs.microsoft.com/en-us/powershell/module/syncshare/?view=win10-ps

But In the Preview I’m a bit Confused, what is the name of the product this Azure File Sync Or Storage Sync Service So looking it up in the Azure Store and in the quick list the name is not the Same.

imageimage

So when created the Azure File Sync <> you need to look under Storage Sync Services

image

Now that said how to built a Replica to Azure and back to my other Data Center ?

 

 Azure File Sync (AFS)

So what do we need for this scenario, We need two File servers and a storage account in Azure.

imageimage

I created on a file server mvpafs01 with an extra disk that is hosted my onprem files. on the other server MVPAFS02 the share is in a different location.

Azure File Sync extends on premises files servers into Azure providing cloud benefits while maintaining performance and compatibility.

Azure File Sync provides:

  • Multi-site access – provide write access to the same data across Windows Servers and Azure Files
  • Cloud Tiering – store only recently accessed data on local servers
  • Integrates with Azure backup – no need to back up your data on premises
  • Rapid DR – restore file metadata immediately and recall data as needed

Open your Azure subscription and look into the store for Azure File Sync.

image

 

image

Create the Azure File Sync components

imageAzure File Sync (AFS)

First we make a New Storage Account, this storage account will hold the on premise files

image

image

When the Storage account is created we create a file share on this storage account.

image

Currently the share has a maximum of 5TB !

image

Max size of a file share  5 TB

Max size of a file in a file share 1 TB

Max number of files in a file share Only limit is the 5 TB total capacity of the file share

Max IOPS per share 1000

Max number of files in a file share Only limit is the 5 TB total capacity of the file share

image

In this a limit of 4TB is more than enough to hold my files.

image

Now that the Azure File Sync is created we can configure the Azure File Sync.

First we create a sync group in this group we can sync the files from one to many.

image

If you didn’t create the Storage account and the File share you will need to create this first.

Create a sync Group

A Sync Group contains a list of endpoints that define where a set of files sync to. Servers and Azure File Shares can participate in syncing the same set of files when they are listed in the same Sync Group.

At the moment only one Azure File Share can participate in a Sync Group and it must be in the same region as this Storage Sync Service. Below you can create the Sync Group and its first and only Cloud Endpoint in one step. In the future you will be able to add more Cloud Endpoints. You can add Server Endpoints after this step completes.

After creating this Sync Group and its first Cloud Endpoint, the next step is adding one or more Server Endpoints to the Sync Group.

 

Azure File Sync (AFS)

Next step is preparing the on premise file server and install the Agent and add the Azure PowerShell modules.

To register a server:

  • Download the Azure Storage Sync agent and install it on all servers you want to sync.
  • After finishing the agent install, use the server registration utility that opens to register the server to this Storage Sync Service.

 

image image

When finishing the download of the right files we start the installation of the Agent.

  1. Download and run the StorageSyncAgent.msi.
  2. Follow the instructions to complete the installation.
  3. At the conclusion of the Azure File Sync agent installation, the Server Registration UI will auto-start.
  4. Follow the instructions to register the server with your Storage Sync Service.

Before we start the Agent we need to disable the enhanced security ( for admins only)

 

image

The installation of the Agent is simple and Quick unless the Azure Modules are not on the Server.

Azure File Sync (AFS)Azure File Sync (AFS)Azure File Sync (AFS)Azure File Sync (AFS)imageAzure File Sync (AFS)Azure File Sync (AFS) image

Now that the Agent is installed we can register this server in Azure File Sync (AFS)

Azure File Sync (AFS)

I did not have the Azure PowerShell modules on this server So I need to install the modules first

https://go.microsoft.com/fwlink/?linkid=856959

image

You can check the version with the Powershell command lets

Get-Module PowerShellGet -list | Select-Object Name,Version,Path

# Install the Azure Resource Manager modules from the PowerShell Gallery

Install-Module AzureRM

imageimage

This can take sometime but you don’t need a reboot for this.

image

just login to your azure subscription where the Azure File Sync (AFS) is installed

imageimage

Pick the right subscription and Resource Group with the Storage Sync Service.

image

The next step after the registration of the server is creating an endpoint this End point is linking the File share to the Sync service

image

 

Creating an Endpoint is the final step but remember as soon as this is in place the Sync services on the on premise server starts the initial sync!

image

Creating the Azure File Sync (AFS) Endpoint

image

A Server Endpoint integrates a subfolder of a volume from a Registered Server as a location to sync. The following considerations apply:

  • Servers must be registered to the Storage Sync Service that contains this Sync Group before you can add a location on them here.
  • A specific location on the server can only sync with one Sync Group. Syncing the same location or even a part of it – with a different Sync Group doesn’t work.
  • Make sure that the path you specify for this server is correct and not the root of a volume before hitting Create.

image

  • Cloud Tiering: A switch to enable or disable cloud tiering, which enables infrequently used or accessed files to be tiered to Azure Files.
  • Volume Free Space: the amount of free space to reserve on the volume on which the Server Endpoint resides. For example, if the Volume Free Space is set to 50% on a volume with a single Server Endpoint, roughly half the amount of data will be tiered to Azure Files. Note that regardless of whether cloud tiering is enabled, your Azure File share always has a complete copy of the data in the Sync Group.

image

Data traffic on the File server in this case it is just with one CPU. The upload speed is around the 300Mbps with almost 100% CPU

imageimage

After checking the same upload with 4 Cores and the upload is more than doubled so keep this in mind when uploading the files. Unless your line is the throttle neck

imageimage

Perfect the files are synced and ready for cloud usage.

But I also want these files in my other datacenter, I could just copy those files and in a few days I run robocopy with the delta’s but I can also use a second endpoint in Azure File Sync (AFS) and keep all files in sync.

The first step is the same as any server to register install the Azure File Sync (AFS)  Agent with the Powershell Modules

 

image

Connect with the same Azure subscription

image

As you can see the server is online and registered.

 

image

As this server doesn’t have a second disk I place all the files on a different share

image

But after filling in the share name and applied it the server gets very busy but there are no files in the folder.

Check this : all the files are cached in the System volume information folder under HFS. After the caching it placed all the files in the right folder.

Just keep in mind that this is the process and your Monitoring agents could alarm you for this. 

image

After the initial sync I have two file servers and a Azure Storage account with the same files. I can Edit files on 3 point and still it got synced.

image

The synced files on the Second server and as you can see that the System files are gone and placed in the share.

image

Hope this blog gives you the start on using the Azure File Sync (AFS) it is very useful as you could sync file between subscriptions or regions or just between your data centers.

 

Follow Me on Twitter @ClusterMVP

Follow My blog https://robertsmit.wordpress.com

Linkedin Profile Http://nl.linkedin.com/in/robertsmit

Google Me : https://www.google.nl

Bing Me : http://tinyurl.com/j6ny39w

LMGTFY : http://lmgtfy.com/?q=robert+smit+mvp+blog

Posted September 28, 2017 by Robert Smit [MVP] in Azure

Tagged with , , ,

Step by Step Azure network security groups NSG – Security Center #Azure #NSG #Network   2 comments

Now Days I see that people not fully understand  the security needs in Azure. There are a lot of options in Azure to improve the security.

A great option is the Security Center. This is a great dashboard to get a quick over view an the security status of your subscription.

image

 

image

 

But the other Option is setting up a network security group (NSG)

image

A network security group (NSG) contains a list of security rules that allow or deny network traffic to resources connected to Azure Virtual Networks (VNet). NSGs can be associated to subnets, individual VMs (classic), or individual network interfaces (NIC) attached to VMs (Resource Manager).

When an NSG is associated to a subnet, the rules apply to all resources connected to the subnet. Traffic can further be restricted by also associating an NSG to a VM or NIC.

Associating NSGs

You can associate an NSG to VMs, NICs, and subnets, depending on the deployment model you are using, as follows:

  • VM (classic only): Security rules are applied to all traffic to/from the VM.
  • NIC (Resource Manager only): Security rules are applied to all traffic to/from the NIC the NSG is associated to. In a multi-NIC VM, you can apply different (or the same) NSG to each NIC individually.
  • Subnet (Resource Manager and classic): Security rules are applied to any traffic to/from any resources connected to the VNet.

You can associate different NSGs to a VM (or NIC, depending on the deployment model) and the subnet that a NIC or VM is connected to. Security rules are applied to the traffic, by priority, in each NSG, in the following order:

  • Inbound traffic

    1. NSG applied to subnet: If a subnet NSG has a matching rule to deny traffic, the packet is dropped.

    2. NSG applied to NIC (Resource Manager) or VM (classic): If VM\NIC NSG has a matching rule that denies traffic, packets are dropped at the VM\NIC, even if a subnet NSG has a matching rule that allows traffic.

  • Outbound traffic

    1. NSG applied to NIC (Resource Manager) or VM (classic): If a VM\NIC NSG has a matching rule that denies traffic, packets are dropped.

    2. NSG applied to subnet: If a subnet NSG has a matching rule that denies traffic, packets are dropped, even if a VM\NIC NSG has a matching rule that allows traffic.

image

As most items in Azure there are Limits to the number of NSGs you can have in a subscription and number of rules per NSG. To learn more about the limits, read the Azure limits article.

image

Creating a network security group (NSG) is easy you can do this in the portal or with Powershell

imageimage

As I mentioned above you can set the network security group (NSG) on a subnet or VM. Add multiple items in a network security group (NSG)

image

By default all is set to basic just pick a service and open or close the port.

imageimage

But when checking the Advanced option the Rule pane will change into a rich and flexible option menu.

 

image   Instead of selecting just a service You can also add a IP range to exclude others for accessing this machine.

image

Setting this in the GUI is nice but when you need to change or add a lot of these you will need Powershell or ARM templates.

Below are just some examples on how to use them

Login-AzureRmAccount
 
# Select a subscription
$subscriptionId = (Get-AzureRmSubscription | Out-GridView -Title ‘Select your Azure Subscription:’ -PassThru)
Select-AzureRmSubscription -SubscriptionId $subscriptionId.Id
 
# Select a Resource Group
$rgName = (Get-AzureRmResourceGroup | Out-GridView -Title ‘Select your Azure Resource Group:’ -PassThru).ResourceGroupName
 
# Set the NSG name and Azure region
$nsgName = "Trusted-Nsg01"
$location = "West Europe"
$source1 = "8.8.8.8/32"
$source2 = "8.8.4.4/32"
$source3 = "*"
$dest1="3389"
$dest2="443"
$dest3="80"
$tag="blog"

#Below are Sample Rules
$rule1 = New-AzureRmNetworkSecurityRuleConfig -Name rdp-rule -Description "Allow RDP" `
-Access Allow -Protocol Tcp -Direction Inbound -Priority 100 `
-SourceAddressPrefix $source1 -SourcePortRange * `
-DestinationAddressPrefix * -DestinationPortRange $dest1

$rule2 = New-AzureRmNetworkSecurityRuleConfig -Name web-rule2 -Description "Allow Port" `
-Access Allow -Protocol Tcp -Direction Inbound -Priority 101 `
-SourceAddressPrefix $source2 -SourcePortRange * -DestinationAddressPrefix * `
-DestinationPortRange $dest2

$rule3 = New-AzureRmNetworkSecurityRuleConfig -Name web-rule3 -Description "Allow Port" `
-Access Allow -Protocol Tcp -Direction Inbound -Priority 103 `
-SourceAddressPrefix $source3 -SourcePortRange * -DestinationAddressPrefix * `
-DestinationPortRange $dest3

$rule4 = New-AzureRmNetworkSecurityRuleConfig -Name web-rule4 -Description "Allow Port" `
-Access Allow -Protocol Tcp -Direction Inbound -Priority 104 `
-SourceAddressPrefix Internet -SourcePortRange * -DestinationAddressPrefix * `
-DestinationPortRange 88

 

Now that the port Rules are created we need to put them in a security group

#applying the Rules
$nsg = New-AzureRmNetworkSecurityGroup -ResourceGroupName $rgName -Location $location -Name $nsgName -SecurityRules $rule1,$rule2,$rule3,$rule4

image

# Display default and security rules for NSG
 
(Get-AzureRmNetworkSecurityGroup -Name $nsgName -ResourceGroupName $rgName).SecurityRules | Select-Object * | Out-GridView
(Get-AzureRmNetworkSecurityGroup -Name $nsgName -ResourceGroupName $rgName).DefaultSecurityRules | Select-Object * | Out-GridView

#Remove NSG

Remove-AzureRmNetworkSecurityGroup -Name $nsgName -ResourceGroupName $rgName

 

Now that we created a network security group (NSG) we can add it to a VM this can also be done with PowerShell but there is a BUT.

let me show you, Go to the VM and select the network card.

image

The Nic can be named nic245768323 something, I always use named NIC’s so that is easy but if not the NSG could be applied on an other VM and maybe it will fail.

imageimage

When selecting this manual you can see the nic and if you are sure on the other machines you can do this with PowerShell also.

 

Follow Me on Twitter @ClusterMVP

Follow My blog https://robertsmit.wordpress.com

Linkedin Profile Http://nl.linkedin.com/in/robertsmit

Google Me : https://www.google.nl

Bing Me : http://tinyurl.com/j6ny39w

LMGTFY : http://lmgtfy.com/?q=robert+smit+mvp+blog

Posted September 11, 2017 by Robert Smit [MVP] in Azure

Tagged with ,

Step by Step Azure Network watcher #Azure #ANW #Network #Cloud #diagnose #troubleshooting   Leave a comment

 

Network Watcher is a regional service that enables you to monitor and diagnose conditions at a network scenario level in, to, and from Azure. Network diagnostic and visualization tools available with Network Watcher help you understand, diagnose, and gain insights to your network in Azure. Use Network Watcher, a service that enables you to monitor and diagnose conditions at a network scenario level.

Network Watcher currently has the following capabilities:

  • Topology – Provides a network level view showing the various interconnections and associations between network resources in a resource group.
  • Variable Packet capture – Captures packet data in and out of a virtual machine. Advanced filtering options and fine-tuned controls such as being able to set time and size limitations provide versatility. The packet data can be stored in a blob store or on the local disk in .cap format.
  • IP flow verify – Checks if a packet is allowed or denied based on flow information 5-tuple packet parameters (Destination IP, Source IP, Destination Port, Source Port, and Protocol). If the packet is denied by a security group, the rule and group that denied the packet is returned.
  • Next hop – Determines the next hop for packets being routed in the Azure Network Fabric, enabling you to diagnose any misconfigured user-defined routes.
  • Security group view – Gets the effective and applied security rules that are applied on a VM.
  • NSG Flow logging – Flow logs for Network Security Groups enable you to capture logs related to traffic that are allowed or denied by the security rules in the group. The flow is defined by a 5-tuple information – Source IP, Destination IP, Source Port, Destination Port and Protocol.
  • Virtual Network Gateway and Connection troubleshooting – Provides the ability to troubleshoot Virtual Network Gateways and Connections.
  • Network subscription limits – Enables you to view network resource usage against limits.
  • Configuring Diagnostics Log – Provides a single pane to enable or disable Diagnostics logs for network resources in a resource group.
  • Connectivity (Preview) – Verifies the possibility of establishing a direct TCP connection from a virtual machine to a given endpoint.

 

Lets start with creating the Network Watcher.

Open Powershell  :

Login-AzureRmAccount

Register-AzureRmProviderFeature -FeatureName AllowNetworkWatcher -ProviderNamespace Microsoft.Network

Get-AzureRmProviderFeature -FeatureName AllowNetworkWatcher -ProviderNamespace  Microsoft.Network

 

Go to the https://portal.azure.com

https://robertsmit.wordpress.com/

As you can see I have several with status disabled and one with partially enabled

image

Enabling the Network Watcher is easy just do a right click on the 3 dots and enable this for all regions or just one, or set this as a default.

 

image

image

Now that we enabled the Network Watcher We create a separate Storage Account for this, as all the logging goes to this storage account. We don’t want to place log files all over the subscription.

image

Our just run a PowerShell command to do this. I use a own resource group for this

New-AzureRmResourceGroup -Name "rsg-netwatcher01" -Location "westeurope"
New-AzureRmStorageAccount -ResourceGroupName "rsg-netwatcher01" -Location "westeurope" -Name "stnetwatcher01" -SkuName Standard_LRS

 

Topology – Provides a network level view showing the various interconnections and associations between network resources in a resource group.

TO view the topology from your network could be very handy- Remember this is only ARM so no ASM

image

and yes the pictures getting large

image

This is all the basic stuff IP flow verify is the more interesting part.

 

IP flow verify

IP flow verify checks if a packet is allowed or denied to or from a virtual machine based on 5-tuple information. This information consists of direction, protocol, local IP, remote IP, local port, and remote port. If the packet is denied by a security group, the name of the rule that denied the packet is returned. While any source or destination IP can be chosen, this feature helps administrators quickly diagnose connectivity issues from or to the internet and from or to the on-premises environment.

IP flow verify targets a network interface of a virtual machine. Traffic flow is then verified based on the configured settings to or from that network interface. This capability is useful in confirming if a rule in a Network Security Group is blocking ingress or egress traffic to or from a virtual machine.

Remember If you have multiple regions you must enable Network Watcher in all regions.

image

The flow is easy the Source Machine and Port number and the destination Machine and Port number. as this is all in the same subnet but If you are running this in more complex networks then this could be very useful.

 

Checking the Security Groups all settings in just one overview that is also very handy when troubleshooting.

image

So all thing in the Network Watcher is nice but one this that is always a pain is troubleshoot the VPN connections and get the log files etc.

In the Network Watcher there is an option on troubleshoot the VPN connection

Network Watcher – VPN Diagnostics

This is also the place where the storage container is needed. Just select the Virtual network gateway and add the Storageaccount with the Start Troubleshooting. This could take a few Minutes to complete!

imageimage image

When the trace is done there is a Zipfile GatewayTenantWorker_IN_0.zip placed in the folder with a date folder structure so no overwrite of the file.

In the Zip file are 2 files unless you have issues.

image

Connectivity State : Connected
Remote Tunnel Endpoint :
Ingress Bytes (since last connected) : 202242292718 B
Egress Bytes (Since last connected) : 2435917732003 B
Connected Since : 8/15/2017 9:41:08 AM

In the connection stats you can see the traffic between the VPN connection.

When you have issues with the VPN connection then there will be more files in the zip file. Beside the ConnectionStats.txt and the CPUStat.txt, we got IKEErrors.txt, Scrubbed-wfpdiag.txt, wfpdiag.txt.sum and wfpdiag.xml.

The IKEErrors.txt and Scrubbed-wpfdiag.txt will get you the most detail about the error of the VPN connection

 

Pricing details

There are no charges to use Network Watcher today. On October 1, 2017, the pricing model below goes into effect.

Feature Monthly allotment Overage charge
Network Logs Ingested 5 GB €0.422 per GB
Network Diagnostic Tools 1,000 checks €0.844 per 1,000 checks
 
  • Network logs are stored within a storage account and have a retention policy that can be set from one day to 365 days. If a retention policy is not set, the logs are maintained forever. Corresponding charges will apply for storage, Log Analytics, and event hubs respectively.
  • Network Watcher Diagnostic Tools and Topology features are billed for the number of Network Diagnostic checks initiated via Azure Portal, PowerShell, CLI, or Rest.

As the Cost are minimal and easy to use so enable this today.

 

Follow Me on Twitter @ClusterMVP

Follow My blog https://robertsmit.wordpress.com

Linkedin Profile Http://nl.linkedin.com/in/robertsmit

Google Me : https://www.google.nl

Bing Me : http://tinyurl.com/j6ny39w

LMGTFY : http://lmgtfy.com/?q=robert+smit+mvp+blog

Posted August 16, 2017 by Robert Smit [MVP] in Azure

Tagged with

  • Twitter

  • Advertisements
    %d bloggers like this: