This slide is so awesome there is only a title€¦ · Title: This slide is so awesome there is...
Transcript of This slide is so awesome there is only a title€¦ · Title: This slide is so awesome there is...
♡ ♡
•
•
•
•
•
• Sasha Kranjac
• Azure and Security Expert @ Kranjac - IT Training
& Consulting
• @SasaKranjac
• Microsoft Azure MVP
• MCSE, MCP, MCSA, MCITP, Microsoft Certified
Trainer (MCT), MCT Regional Lead, Certified
Ethical Hacker (CEH), Certified EC-Council
Instructor (CEI)
AM COFFEE LUNCH PM COFFEE
10:45 - 11:15 12:15 - 13:15 14:35 - 15:15
PaaSA platform of
services for
hosting a
custom
solution
IaaSA way to run
virtual servers
in the cloud
with full
control
SaaSA complete
software
solution
Who manages what?
Infrastructureas a Service
Storage
Servers
Networking
O/S
Middleware
Virtualization
Data
Applications
Runtime
Manag
ed
by M
icroso
ft
Yo
u s
cale
, make
resi
lient
& m
anag
e
Platformas a Service
Sca
le, R
esilie
nce
and
manag
em
ent b
y Micro
soft
Yo
u m
anag
e
Storage
Servers
Networking
O/S
Middleware
Virtualization
Applications
Runtime
Data
On PremisesPhysical / Virtual
Yo
u s
cale
, make
resi
lient
and
manag
e
Storage
Servers
Networking
O/S
Middleware
Virtualization
Data
Applications
Runtime
Softwareas a Service
Storage
Servers
Networking
O/S
Middleware
Virtualization
Applications
Runtime
Data
Sca
le, R
esilie
nce
and
manag
em
ent b
y Micro
soft
Windows Azure
Virtual Machines
Windows Azure
Cloud Services
•Azure portal
• PowerShell
•Azure Automation
•Azure CLI
•Visual Studio
•Azure Resource Manager provides a method for
grouping and managing Azure resources
• The advantages include:
• Manage resources as a group
• Reuse solutions and consistently deploy resources
• Quickly deploy and re-deploy large solutions
• Define dependencies and resource deployment order
• Use role-based access control for permissions
• Logically organize resources by using tags
•Resource groups enable logical groupings of
resources
•Resources are assigned to a resource group when
created
• Some resources can be moved between resource
groups
• Virtual networks and subnets
• Network interfaces
• IP addresses (private and public)
• Virtual network-based DNS and Azure DNS
• Azure Load Balancer
• Application Gateway
• Traffic Manager
• Network security groups
• User-defined routes
• Forced tunneling
• Virtual network connectivity
• Virtual network gateways
• An IP address space with one or more subnets:
• Private:
• 10.x.x.x
• 172.16.x.x – 172.31.x.x
• 192.168.x.x
• Public (supported, but rarely used)
• IP addresses:• Private – allocated to VM NICs or internal load balancers
• Public – assigned to VM NICs or load balancers
• DNS name resolution:• Default – Internet names and names within the virtual network
• Custom – cross-premises, cross-virtual networks, custom domains
Customer 2
Isolated Virtual
Networks
Customer 1
Subnet 1 Deployment X Deployment Y
VLAN-to-VLAN
Subnet 2 Subnet 3
DNS Server
Microsoft Azure
Azure virtual machines support:
• Windows Server:
• All currently supported versions (CSA required for older ones)
• All roles and features, except:
• DHCP, Direct Access, RMS, Windows DS
• iSNS, MPIO, NLB, PNRP, SNMP, Storage Manager for SANs, WINS,
Wireless LAN Service
• Linux:
• CentOS, CoreOS, Debian, Oracle Linux, Red Hat, SUSE,
openSUSE, and Ubuntu
• Windows Server software:
• FIM, MIM, SharePoint Server, SQL Server, System Center, and
more
• General purpose:
• Balanced CPU-to-memory ratio
• A0-A7, Av2, D, Dv2, Dv3, DS, DSv2, Dsv3 series
• Compute optimized:
• High CPU-to-memory ratio
• Fs and F series
• Memory optimized:
• High memory-to-CPU ratio
• D, Dv2, DS, DSv2, Ev3, Esv3, Ms, G, and GS series
• Storage optimized:
• High-performance disk I/O
• Ls series
• GPU:
• Graphic Processing Unit support
• NV and NC series
• High performance compute:
• Fastest CPUs and optional high-throughput RDMA
• H series and A8-A11
•Azure VMs in an availability set:
• Logical grouping of two or more Azure VMs
• Must be assigned during Azure VM deployment
• Up to 3 fault domains
• Up to 20 update domains
• 99.95% availability SLA
• Considerations:
• Add multiple virtual machines to the same availability set
• Place application tiers in separate availability sets
• Combine availability sets with load balancing
• Standalone VMs:
• 99.9% availability SLA if using Premium storage disks
• Web Apps:
• Near instant deployment
• SSL and Custom Domain Names available in some tiers
• WebJobs provide background processing for independent scaling
• Can Scale to larger machines without redeploying applications
• SQL-as-a-Service Offering:
• Fully managed
• Automatically replicated
• Compatible with existing TDS-capable software:
• Visual Studio
• SQL Server Management Studio
• Entity Framework
• Managed using existing tools, the CLI, PowerShell or
the Portal
• Performance measured in a predictable manner:
• Database Throughput Units (DTUs)
•Azure provides money-backed SLAs for IaaS
services:
• Two Instances or more in an Availability Set = 99.95%
• Single Instance VM using Premium Storage = 99.9%
•Decisions should based on cost and availability
requirements
• Single instance VM would gain 99.9% SLA if it
complies with:
• Premium Storage for all Operating System Disks and
Data Disks
•Any single instance VM without Premium storage
receives no SLA
•Availability Sets provide assurance that any
multiple instance VM will be available 99.95%
of the time
Availability Sets cater for planned and unplanned maintenance using Update Domains and Fault Domains
When planning multiple tier applications use
multiple Availability sets, one per tier
•Azure Load Balancer:
• Internal load balancer
• Internet-facing load balancer
• To configure:
• Assign a front-end IP
• Public for an Internet-facing load balancer
• Private for an internal load balancer
• Assign back-end address pool
• Create load-balancing rules
• Create inbound NAT rules (optional)
• Create health probes
•Application Gateway
• Traffic Manager
•Azure Functions:
• Build on WebJobs Technology
• Available in Consumption and App Service Plan billing
modes
• Can be deployed using Scripts or Pre-Compiled
• Managed and Edited directly in the portal:
• Supports CI from GitHub or VSO if preferred
•Azure Functions features no-code triggers that
can invoke a function based on changes in the
following services:
• Azure:
• Storage Blobs
• Cosmos DB
• Storage Tables
• Mobile Apps
• Office 365 Files
• Third-Party:
• Twilio
• SendGrid
•Automation workflow solution:
• No-code designer for rapid creation of integration
solutions
• Pre-built templates to simplify getting started
• Out-of-box support for popular SaaS and on-premises
integrations
• BizTalk APIs available to advanced integration solutions
• JSON-based workflow definition:
• Can be deployed using ARM templates
Plan1 Monitor + Learn
ReleaseDevelop +
Test2
Development Production
4
3
DevOps
✓ Centrally manage users and access to
Azure, O365, and hundreds of pre-
integrated cloud applications
✓ Build Azure AD into your web and
mobile applications
✓ Can extend on-premises directories to
Azure AD through synchronizationEnd Users
Active Directory
Azure Active Directory Cloud Apps
✓ Protect sensitive data and applications
both on-premises and in the cloud with
Multi Factor Authentication
✓ Can use Active Directory (on-premises)
with Azure Active Directory (in cloud) to
enable single sign-on, a single directory,
and centralized identity management
✓ Multi Factor Authentication can be
implemented with Phone Factor or with
AD on-premises
Active Directory
Microsoft AzureActive Directory
Virtual Machines:
✓ Data drives – full disk encryption through BitLocker
✓ Boot drives – partner solutions
✓ SQL Server – Transparent Data Encryption
✓ Files & folders - EFS in Windows Server
Storage:✓ Bitlocker encryption of drives for import/export of
data
✓ Server-side encryption of Blob Storage using AES-256
✓ Client-side encryption w/.NET and Java support
✓ StorSimple with AES-256 encryption
Applications:✓ Client Side encryption through .NET Crypto API
✓ RMS SDK for file encryption by your applications