Overview
Azure Virtual Network Connectivity options
Why do you need Hybrid Cloud?
What is Azure VPN Gateway?
Monitoring Azure Virtual Network Gateways
Azure Virtual Network (Azure VNet) is likely one of the most important components in your Azure Infrastructure deployment. Azure VNet uses Software-defined Networking solution that connects most of your virtual resources via a primary virtual container. Azure VNet enables you to Scale, Control and Secure your virtual network with agility. By default, Azure VNets are isolated and secured, so much so that even resources within a single Azure subscription will not be able to connect with each other through the VNet unless specifically allowed. You have total control over specifically allowed connections. Using VNets, Azure administrators can multi-tier networks in the cloud.
Azure VNet can also extend your on-premises private network to the cloud. Azure VNet enables you to create a hybrid network between your on-premises network, various regions in the Azure cloud or even another cloud service provider. It allows you to control network traffic segmentation and virtual appliance support with features such as Network Security Groups and User defined routes. You can deploy resources such as Virtual Machines, Cloud Services or App Services in this virtual container.
Microsoft Azure provides numerous mechanisms to deploy your infrastructure resources using ARM (Azure Resource Management), REST-based API, Azure SDK, Azure PowerShell, Azure CLI and Azure Portal.
There is a number of different connectivity options available in Azure.
It is the default connectivity option for resources in Azure. In this model, you can deploy multiple VM’s, Cloud services or App Services that can communicate with each other. By default, all resources can connect to each other in a VNet even if they may be part of different subnets. This is possible due to “Default Route” which is created by default in Azure.
Hybrid connectivity is the ability to connect your on-premises datacenter to your resources running in a datacenter in Microsoft Azure or to other cloud service providers. To enable Hybrid connection, you need to deploy an Azure VPN Gateway. It exposes an endpoint over IPSec tunnel for other VPN connectivity. Azure provides 3 different options for hybrid connectivity.
This option allows you to create a secure VPN connection from a single source like a laptop or a computer to resources in Azure. You do not need a VPN device for this type of deployment. The ideal use scenario of P2S connectivity is to allow access to a handful of client computers from a remote location.
This option allows you to use secure IPSec VPN to connect one or more networks from on-premises directly to Azure or from Azure to Azure. You would need a VPN device in your on-premises location to connect to Azure VPN Gateway. This type of connection enables a secure connection between resources on-premises and in the cloud. You do not need to create separate connections for different client computers on your local network to access resources in the cloud. The S2S connection further enables connectivity options like Site-to Multi-Site and VNet-to-VNet.
It provides organizations a Private, Dedicated, High-throughput network connection between Microsoft Azure datacenters and their on-premises IT environment. It is a much more scalable solution for hybrid connectivity. It is basically an extension of your on-premises network in the cloud. It also involves third-party express route partner. It comes in two flavors:
Pointers provided by research study:
Now that you know what the IT trends looks like what are the benefits of deploying a Hybrid Cloud.
Azure VPN Gateway enables Azure VNet to connect to your network on-premises or between virtual networks in Azure or with another cloud service provider. Your Azure VPN Gateway connectivity with your on-premises network will depend on the compatibility of your VPN device as per Microsoft recommendations. Check out the list of compatible VPN devices as per Microsoft.
[su_note note_color=”#eeeeee” text_color=”#151212″]NOTE
It is very important to plan and design your Virtual Network before deploying any other resources in Azure. You still do not have the ability to move your existing Azure resources from one VNet to another.[/su_note]
There are two types of Azure VPN Gateways, static route, and dynamic route. A static route is policy-based VPN that directs packets through IPSec tunnel whereas dynamic route is route-based VPN configuration.
[su_note note_color=”#eeeeee” text_color=”#151212″]NOTE
The routing option you select will depend on the type of route your VPN device supports.
[/su_note]
There is no UI to monitor Azure VNet Gateway. The only way you can check the status of your Azure VNet Gateway is by using the portal which shows Data-In (Ingress), Data-Out (Egress) and Connection Status. While this seems very limited information, the goal of these metrics is to ensure that different sites are connected to each other and the data is flowing between them.
[su_table]
| Name | Description | Metrics type |
|---|---|---|
| Data In (Ingress) | Data flowing in the VNet | Kb |
| Data Out (Egress) | Data going out of the VNet | Kb |
| State | Status of the VNet connectivity | Succeeded, Suspended, Disconnected, Connecting |
[/su_table]
The figure below shows what Azure Portal would show.
Now that the default monitoring data shows enough information, it is important to have some sort of alert mechanism, comparison method to check if the VNet Gateway is working as expected.
Netreo uses expression based analysis to check the resource state. Expression based monitoring are comparison statements which can be used to evaluate the condition of the resources. The figure shows you an alert from Netreo of an VNet Gateway going down or disconnected.
Netreo enables you to create custom metrics. More often than not Azure Portal would show the connection state of VPN Gateway as “Connected” but you also need to know the working condition of the VNets. The figure below shows how to configure an Aggregate expression that compares Data In (Ingress) in a VNet Gateway in a time span of every 5 minutes. You can also configure alerts if the Ingress has stayed constant for 5 minutes which means there is no data transfer between VNets for 5 minutes. Such comparison metrics can be of great use. Some great examples of such back date monitoring is when you want to check what was the last time a particular event fired or when a particular error occurred etc.
For more information about how Netreo can help with monitoring Azure Virtual Networks, refer to Netreo Azure Virtual Network Monitoring.
