Hybrid Hyper-scale Enterpris e Grade Azure compute regions.
-
Upload
asher-grant -
Category
Documents
-
view
252 -
download
1
Transcript of Hybrid Hyper-scale Enterpris e Grade Azure compute regions.
Spark the future.
May 4 – 8, 2015Chicago, IL
An Overview of Microsoft Azure New Networking CapabilitiesYousef KhalidiDistinguished EngineerMicrosoft Azure Networking
BRK2456
What’s new at Ignite Virtual Networking
User Defined Routes Public IP address mobility Multiple load-balanced IPs
DNS Services Azure DNS – Domain hosting
Azure Resource Manager New network APIs, PowerShell New JSON-based templates
Network Virtual Appliances New partners and scenarios
ExpressRoute ExpressRoute Premium add-
on ExpressRoute for Office 365
VPN ExpressRoute coexistence New Standard Gateway
Hybrid
Hyper-scale
Enterprise
Grade
Azure compute regions
Hyper-scale Footprint
Azure compute regions
19Azure compute regions open todayMore than AWS and Google Cloud combined
Hyper-scale Footprint
Hyper-Growth
5.1T
AZURE STORAGE TRANS. IN MARCH 2015
50T
STORAGE OBJECTS IN AZURE
425M
AZURE ACTIVEDIRECTORY USERS
20M
SQL DATABASE HOURS USED EVERYDAY
-- Hyper-Scale
85 iXP
4400+ CONNECTIONS TO 1695 NETWORKS
1.4M
MILES OF FIBER IN OUR DATA CENTERS
4x
WRAP THE EARTH IN NORTH AMER FIBER
$15B
MICROSOFT CLOUD INVESTMENT
Internet users
■500,000,000+
■100,000,000 – 499,999,999
■50,000,000 – 99,999,999
■25,000,000 – 49,999,999
■5,000,000 – 24,999,999
■100,000 – 4,999,999
■50,000 – 999,999
■0 – 49,999
*Operated by 21Vianet
Microsoft’s network is one of the largest in the worldMicrosoft Azure datacenter regionsInternet connectivity by country
INDIA NORTHTBD
Classic vs. Hyper-scale networksLarge L2 Domains
HW-based Service
Simple Tree Design
L3 at all Layers
SoftwareService
Clos-based design
Diversity and manual provisioning
Complex hardware and lack of automated operations
High complexity and human error Resilient, automated monitoring and remediation, low human involvement
Simplify requirements, optimized design, and unify infrastructure
Automated provisioning, integrated processAgility
Efficiency
Availability
L3
L3
L2
LB/FW LB/FW LB/FW LB/FW
L2
Software-defined networking (SDN)
PhysicalTransport
Plane
Control Plane
ApplicationPlane
Switch
Controller
AzureFrontEnd
ManagementPlane
ControlPlane
Proprietary HardwareAppliance
Building the right abstractions to enable Scale and Agility
CommodityHardware
Abstract Management, Control, and Data planes
TenantCompose compute & storage roles and networks
Tell & ProgramInstead of Discover and react
Management
Create a tenant
ControlPlumb tenant ACLs to switches
Data Apply ACLs to these flows
Example: ACLs
Users
Internet
The Big (Network) PictureAzure
Virtual Network
Front-End Access
Dynamic/Reserved Public IP addresses
Direct VM access, ACLs for security
Load balancing
DNS services: hosting, traffic management
DDoS protection
Virtual Network
“Bring Your Own Network”
Segment with subnets and security groups
Control traffic flow with User Defined Routes
Backend Connectivity
Point-to-site for dev / test
VPN Gateways for secure site-to-site connectivity
ExpressRoute for private enterprise grade connectivity
Backend ConnectivityExpressRouteVPN Gateways
Internet Connectivity
DNS Services
Traffic Manager
DNS
Azure DNSNew
Host your DNS domains in AzureIntegrate your Web and Domain hosting
Globally route user traffic with flexible policiesEnable best-of-class end to end user experience
Azure DNS Global footprint
Global footprint of DNS servers Anycast fast query
performance Ultra-available
New
Traffic Manager
www.contoso.com
Traffic Management Policies
Latency – Direct to “closest” serviceRound Robin – Distribute across all servicesFailover – Direct to “backup” if primary failsNested – Flexible multi-level policies
Internet IP Addresses & Load BalancingPublic IP Addresses in Azure
Can be used for instance (VM) level access or load balancing
Instance-level IPInternet IP assigned exclusively to a single VM Entire port range is accessible by defaultPrimarily for targeting a specific VM
Load balanced IP (VIP)Internet IP load balanced among one or more VM instancesAllows port redirectionPrimarily for load balanced, highly available, or auto-scale scenarios
Internet
IP1 IP2
VM1 VM2
LB
Microsoft Azure
151.2.3.4 (VIP)
131.3.3.3
(Instance-level IP)
131.3.4.4
(Instance-level IP)
Multiple Load-balanced IPs• Common use case: multiple SSL end points• Across one or more VMs
Internet
IP1
IP3
IP2
IP4
AZURE
LB
SSL Website 1
SSL Website 2
SSL Website 3
SSL Website 4
443
443
443
443
443
444
445
446
New
Reserved IPs•Retain your IP addresses
•IPs on existing services can be reserved
•IPs can be moved between services in seconds
Cloud Service 1 Cloud Service 2
Azure Load Balancer
New
Reserved IP Moves
Reserved IP
Internet
DNS Names for Public IP FQDN access to a virtual
machine Available for virtual
machines and web/worker roles
Automatic DNS registration/de-registration during scale-up, scale-down
Internet
Webrole.1.contoso.cloudapp.net 130.26.5.120
VM Instance 1 VM Instance 2
Contoso App with 2 virtual machines
New
Webrole.0.contoso.cloudapp.net 130.26.10.80
Virtual Networks
Bring your own network
Create subnets with your private or public IP addresses
Bring your own DNS or use Azure-provided DNS
Secure with Network Security Group ACLs
Control traffic flow withUser Defined Routes
Virtual Network
Virtual Network
VPN GW
Frontend10.1/16
Mid-tier10.2/16
Backend10.3/16
Internet
On Premises10.0/16
VPN &ExpressRoute
AD / DNS
Azure
Direct InternetConnectivity
User Defined Routes Control traffic flow in your
network with custom routes
Attach route tables to subnets
Specify next hop for any address prefix
Set default route to force tunnel all traffic to on-premises or appliance
Internet
Virtual Network
FrontEnd Subnet
BackEnd Subnet
SystemRoute
User Defined Route
Default Route
System Route
New
VM/Appliance
VM with “IP Forwarding”
Multiple NICs in Azure VMs Up to 16 NICs per VM
NSG and Routes on all NICs
Can separate frontend, backend, and management
Virtual Machine
NIC2 NIC1Defaul
t
Virtual Network
Frontend
Subnet
MgmtSubnet
BackendSubnet
Internet
10.2.2.22
10.3.3.33
10.1.1.11
VIP 133.44.55.
66
Update
Securing the Network
Layered Security, Protection, and Isolation
DDoSProtection
Virtual Networ
kIsolatio
n
NSGVM
Firewall
Cloud Services &
Virtual Machines InternetACLs
Network Security Groups Segment network to meet
security needs 5 tuple ACLs on both
directions Can protect Internet and
internal traffic Enables DMZ subnets Associated to subnets/VMs
and now NICs ACLs can be updated
independent of VMs Virtual Network
Backend10.3/16
Mid-tier10.2/16
Frontend10.1/16
VPN GW
Internet
On Premises 10.0/16
ExpressRouteand VPNs
√ √
√ √
Network Virtual Appliances
Overview VMs that perform specific network functions Focus: Security (Firewall, IDS , IPS), Router/VPN, ADC (Application
Delivery Controller), WAN Optimization Typically Linux or FreeBSD-based platforms
Scenarios IT Policy & Compliance – Consistency between on premises & Azure Supplement/complement Azure capabilities
Azure Marketplace Available through Azure Certified Program to ensure quality
and simplify deployment You can also bring your own appliance and license
Network Virtual Appliances
Azure Virtual Network
Virtual Appliances - Firewalls, IDS/IPS, VPNsSecure your virtual networks in Azure
DMZ
IDSIPS
Internet
Cross-premises connectivity
Frontend load balancing and delivery control
Scenario – Application Delivery Controller
Applications
Web Farms Internet
ADC & Load
Balancer
Virtual Network
Optimizing cross premises traffic
Scenario – WAN Optimization
CustomerOn Premises
Microsoft Azure
Compress/Optimize
Network Virtual Appliance Ecosystem
Cross premises connectivity
Connectivity Options and Hybrid OfferingsCloud Customer Segment and
workloads
Secure site-to-site VPN connectivity
• SMB, Enterprises• Connect to Azure
compute
Secure point-to-site connectivity
• Developers• POC Efforts• Small scale
deployments• Connect from
anywhere
ExpressRoute private connectivity
• SMB & Enterprises• Mission critical workloads• Backup/DR, media, HPC• Connect to Microsoft
services
Internet Connectivity
• Consumers• Access over public IP• DNS resolution• Connect from anywhere
On-premises VPN Ecosystem
Cloud on your WANTraffic flows directly from customer WAN to MicrosoftReduces complexityLower latency, higher bandwidth and higher availability
Microsoft
WAN
Corp HQ
Branch office 1
Branch office 2
Public internet
Connectivity choices: Internet or Private
IPsec VPN over InternetEncrypted data traverses Internet to reach AzureLimited bandwidth and higher availability
Microsoft
WAN
Corp HQ
Branch office 1
Branch Office 2
Public internet
ExpressRoute
Microsoft
WAN
Corp HQ
Branch office 1
Branch office 2
Public internet
ExpressRoute provides a private, dedicated, high-throughput network
connection to Microsoft
Security
Lower cost
Predictable performance
High throughput
ExpressRoute Connectivity
Microsoft Edge
Customer’s network
Customer’sconnection
Partner Edge
Traffic to public IP addresses in Azure
Traffic to Virtual Networks
Traffic to Office 365 Services
ExpressRoute PartnersExchange Provider Network Service Provider
Exchange
Publicinternet
Customer site
Microsoft
Customer site 1
Customer site 2
Customer site 3
WANPublic
internet
Microsoft
ExpressRoute Sites and Partners
AtlantaChicagoChicago (Gov Cloud)*DallasLANYSeattleSilicon ValleyWashington DCWashington DC (Gov Cloud)*
Sao Paulo
AmsterdamDublin*London
Chennai*Hong KongMumbai*Melbourne*Osaka*SingaporeSydneyTokyo
ExpressRoute
ExpressRoute and S2S VPN CoexistenceS2S VPN as a backup for ExpressRoute
S2S connectivity to branch offices
Connecting Virtual Networks in other Azure regions
Contoso HQ
Exchange
AD/DNS
IIS ServersSQL Farm
Monitoring
Contoso virtual networks/VMs
Internet
NEW
Services on public IPs
VPN Gateway(Internet Edge)
ExpressRoute Premium Add OnNEW
Global connectivity Link a Virtual Network from any Azure Region to your ExpressRoute
circuit
More routes (IP prefixes) Supports up to 10,000 routes, increase from 4,000 routes
Connect more Virtual Networks Up to 100 virtual networks depending on bandwidth option
ExpressRoute gateway or VPN gateway needed to access a virtual network
Introducing a new Standard Gateway Supports ExpressRoute and VPN coexistence Improved throughput for ExpressRoute
VPN Gateways for Virtual NetworkNEW
Virtual Network Gateway
SKU
ExpressRoute GW
Throughput
VPN GW ExpressRouteCoexistence
VPN GWThroughput
VPN GW Max IPsec
Tunnels
Cost (USD) / Hour
Basic 500 Mbps No 100 Mbps 10 $0.04
Standard 1000 Mbps Yes 100 Mbps 10 $0.19
Performance 2000 Mbps Yes 200 Mbps 30 $0.49
Note that ExpressRoute traffic for Azure public services, O365, and
Skype for Business does NOT go through a Virtual Network gateway
Office 365 Timelines and PartnersLaunch Partners
Other providers soon to follow
LocationsAll Microsoft Regions.
General AvailabilityQ3 CY 2015
Supported WorkloadsExchange Online & Exchange Online Protection
SharePoint Online, OneDrive for Business, Office 365 Video, Delve
Skype for Business Online (formerly Lync Online)
Office Online
Power BI and Project Online
Azure Resource Manager – a new way to provision services
Network Resource Provider• New REST API surface
• Loosely coupled network resource model
• Fine grained access/control of networking resource
• RBAC of networking resources
• Support for logging and tagging
• Highly performant & scalable
• Regional resiliency
• Imperative and declarative management style
NEW
StorageAccount
VirtualMachine
VMExtension
AvailabilitySet
VirtualNetwork
Subnet
NetworkInterfaceCard
PublicIPAddress
LoadBalancer
NetworkSecurityGroup
NetworkSecurityRule
TrafficManager VirtualNetworkGateway
Click To Deploy in Cloud Readily available
templates to Click and Deploy from GitHub
Rapidly customize and automate your build & deployment
Versatile management interfaces
REST API
PowerShell
Azure CLI
SDK(.NET, Node.JS, Java)
Azure Portal
NEW
Putting it all together
ExpressRoute
Infrastructure (protected)
Middle Tier (exposed to FE and Infra)
Front End – through firewalls
• User Defined Routes on subnets to direct flows to appliances
• Network Security Groups to secure subnets• Network Virtual Appliances for security, routing and
ADC• Secure cross-premises connectivity with
ExpressRoute and VPN Gateways
Site-to-site
VPN
Internet connectivity
Demo
Summary Azure Networking
New at Ignite User Defined Routes Public IP address mobility Multiple load-balanced IPs Azure DNS – Domain hosting New network APIs, PowerShell New JSON-based templates Network Virtual Appliances ExpressRoute Premium and
O365 VPN ExpressRoute
Coexistence
Enterprise-Ready Global Scale
Strong Partners
Complete Solutions
Learn more with FREE IT Pro Resources
Free technical training resources: On-demand online training: http://aka.ms/learnhybrid
Expand your Hybrid Infrastructure Knowledge
Free ebooks:Rethinking Enterprise Storage: A Hybrid Cloud Model: http://aka.ms/hybrid-storage-ebookMicrosoft Azure Essentials: Fundamentals of Azure: http://aka.ms/azure-fundamentals-ebook
Join the IT Pro community: Twitter @MS_ITPro
Ignite Azure Challenge Sweepstakes
Attend Azure sessions and activities, track your progress online, win raffle tickets for great prizes!
Aka.ms/MyAzureChallenge
Enter this session code online: BRK2456
NO PURCHASE NECESSARY. Open only to event attendees. Winners must be present to win. Game ends May 9th, 2015. For Official Rules, see The Cloud and Enterprise Lounge or myignite.com/challenge
Visit Myignite at http://myignite.microsoft.com or download and use the Ignite Mobile App with the QR code above.
Please evaluate this sessionYour feedback is important to us!
© 2015 Microsoft Corporation. All rights reserved.