Category Archives: Azure

Step-by-Step Guide to protect Azure VM using Azure Backup

Azure Backup is capable of replacing typical on-premises backup solutions. It is cloud-based, secure, reliable solution. It has four components which can use to backup different types of data.

Component

Protected data

Can use with On-premises?

Can use with Azure?

Azure Backup (MARS) agent

Files, Folders, System State

Yes

Yes

System Center DPM

Files, Folders, Volumes,

VMs, Applications, Workloads, System State

Yes

Yes

Azure Backup Server

Files, Folders, Volumes,

VMs, Applications, Workloads, System State

Yes

Yes

Azure IaaS VM Backup

VMs, All disks (using PowerShell)

No

Yes

More details about azure backup and components limitations can be find on https://docs.microsoft.com/en-us/azure/backup/backup-introduction-to-azure-backup 

In this article we are going to look in to Azure VM backup (Azure IaaS VM Backup). 

How Azure VM Backup works? 

Azure VM backup doesn’t need any special agent installed in VM. It also does not need to have any additional components (backup server) install either to enable backup. When very first backup job is triggered, it installs backup extension inside the VM. If its Windows VM, it installs VMSnapshot extension and if its Linux VM, it installs VMSnapshotLinux extension. VM must be in running state in order to install extension. After extension in place, it takes point-in-time snapshot of the VM. If VM is not running during backup window, it takes snapshot of VM storage. If its windows VM, backup service uses Volume Shadow Copy Service (VSS) to get consistence snapshot of VM disk. If its Linux VM, users can create custom scripts to run before and after backup job to keep application consistency. Once snapshot is taken it will transfer to the backup vault. Service can identify the recent changes and only transfer the block of data which changed from last backup. Once the data transfer completes snapshot will removed and recovery point will be created. 

vmbackup-architecture

Image Source: https://docs.microsoft.com/en-us/azure/backup/media/backup-azure-vms-introduction/vmbackup-architecture.png 

Performance of backup depends on,

1) Storage account limitations 

2) Number of disks in VM

3) Backup Schedule – if all jobs running in same time it can create traffic jam

According to Microsoft following are recommended when you use Azure backup for Azure VMs. Reference: https://docs.microsoft.com/en-us/azure/backup/backup-azure-vms-introduction 

1) Do not schedule more than 40 VMs to backup same time.

2) Schedule VMs backup when minimum IOPs been used in your environment (In relevant storage accounts). 

3) Better not to back up more than 20 disks in single storage account. If you have more than 20 disks in single storage account spread those VMs across the multiple policies to maintain required IOPS. 

4) Do not restore a VM running on Premium storage to same storage account. Also try to avoid restore while backup process is running on same storage account.

5) For Premium VM backup, ensure that storage account that hosts premium disks has at least 50% free space for staging snapshot for a successful backup.

6) Linux VM needs python 2.7 enabled for backup.

Next step is to see this in action.

1) Log in to Azure Portal as Global Administrator

2) First step is to create Azure Recovery Service Vault. In order to do that, go to All Services and click on Recovery Service vaults under storage section. 

bk1

3) Then click on Add in new window

bk2

4) It will open up wizard and there provide vault name, subscription, resource group and location. Once done, click on Create.

bk3

5) Now we have vault created, next step is to create backup policy. To do that click on vault we just created from the Recovery service vault window.

bk4

6) Then click on Backup Policies 

bk5

7) There is default policy from Azure VM backup. It backup VMs daily and keep it for 30 days.

bk6

8) I am going to create new policy to do backup every day at 01:00 am and keep it for 7 days. To do that click on add option in policy window. 

bk7

9) Then select the policy type. for VMs, it should be Azure Virtual Machine

bk8

10) In next window we can define time and retention period of data. Once done with the details click on Create

bk9

11) Next step of the configuration is to enable backup. In order to do that, go to the VM you like to backup. Then click on the option Backup 

bk10

12) Then in new window select the vault and policy we created before and then click on enable backup

bk11

13) Once it is done we can run backup by going in to same backup window. If you like to take ad-hoc backup, click on Backup Now

bk12

14) We can see the progress of the backup job by clicking View All Jobs

bk13

bk14

15) Once backup jobs completed we can see the status of it in same backup window.

bk15

16) To test the restore I installed Acrobat Reader in this server and created test folder in desktop. 

bk16

17) Now I am going to do a restore to an earlier day. To do that go to VM backup page, then click on Restore VM

bk17

18) In next window it asks which backup to restore. I am selecting back up from 3 days.

bk18

19) In next window it allows me to restore it as new VM or as disk. In here I am going to restore it as new VM

bk19

20) Once selection is done click on Restore to begin the process.

21) We also can check the status of the job using backup job window.

bk20

22) Once restore completed, I can see a new VM. 

bk21

23) Once log in to the VM I can’t see the folder and application I installed, as expected. 

bk22

This marks the end of this blog post. If you have any questions feel free to contact me on rebeladm@live.com also follow me on twitter @rebeladm to get updates about new blog posts.

Azure virtual machine scale sets – part 02 – Deploy Application to scale set

In my previous post Azure virtual machine scale sets – part 01, we learned what is VM scale set and how we can create a scale set in Azure. if you not read it yet please go through it before we start on this post as reset of the steps in this post depend on it http://www.rebeladmin.com/2018/04/azure-virtual-machine-scale-sets-part-01/ 

In this post we are going to deploy a sample application to scale set. In my previous post I have created a new scale set using,

New-AzureRmVmss `

  -ResourceGroupName "rebelResourceGroup" `

  -Location "canadacentral" `

  -VMScaleSetName "rebelScaleSet" `

  -VirtualNetworkName "rebelVnet" `

  -SubnetName "rebelSubnet" `

  -PublicIpAddressName "rebelPublicIPAddress" `

  -LoadBalancerName "rebelLoadBalancer" `

  -BackendPort "80" `

  -VmSize "Standard_DS3_v2" `

  -ImageName "Win2012Datacenter" `

  -InstanceCount "4" `

  -UpgradePolicy "Automatic"

In above it created an Azure Load balancer and TCP port 80 been load balanced among 4 instances. Under Azure Load Balancer | Inbound NAT rules it does have default rules for port 3389 and 5985. Those ports are mapped to custom TCP ports in order to give external access. 

scaleapp1

As an example, in above sample, I can RDP to instance0 using 52.237.8.186:50000. Likewise, we can connect to each instance and install apps if need. instead of that we can use centralized remote deployment, so the configuration is same across the instance. 

In my config I didn’t use static ip address. You can find public ip address by running following azure PowerShell command,

Get-AzureRmPublicIpAddress -ResourceGroupName rebelResourceGroup | Select IpAddress

scaleapp2

In order to push application, first need to prepare app config. in my demo I got a file in GitHub repository. 

$customConfig = @{

  "fileUris" = (,"https://raw.githubusercontent.com/rebeladm/rebeladm/master/simplewebapp.ps1");

  "commandToExecute" = "powershell -ExecutionPolicy Unrestricted -File simplewebapp.ps1"

}

My config is very simple one. In PowerShell script I have following,

Add-WindowsFeature Web-Server

Set-Content -Path "C:\inetpub\wwwroot\Default.htm" -Value "Test webapp running on host $($env:computername) !"

It will install IIS and then create HTML file which will print text with the instance name. 

scaleapp3

As next step lets go and retrieve info about scale set,

$vmss = Get-AzureRmVmss `

          -ResourceGroupName "rebelResourceGroup" `

          -VMScaleSetName "rebelScaleSet"

scaleapp4

After that, lets create custom script extension

$vmss = Add-AzureRmVmssExtension `

  -VirtualMachineScaleSet $scaleconfig `

  -Name "customScript" `

  -Publisher "Microsoft.Compute" `

  -Type "CustomScriptExtension" `

  -TypeHandlerVersion 1.8 `

  -Setting $customConfig

In above,

 –Publisher specifies the name of the extension publisher. This can find using Get-AzureRmVMImagePublisher 

 –Type specify the extension type. we can use Get-AzureRmVMExtensionImageType find the extension type. 

TypeHandlerVersion specify the extension version. It can view using Get-AzureRmVMExtensionImage.

scaleapp5

Next step of the configuration is to update scale set with the custom extension,

Update-AzureRmVmss `

  -ResourceGroupName "rebelResourceGroup" `

  -Name "rebelScaleSet" `

  -VirtualMachineScaleSet $vmss

scaleapp6

Now it is time to do testing. Let’s go to public IP address and see if it’s got the app we submit. 

As I refresh we can see the instance number get updated. That means script is successfully running on scale set as expected. 

scaleapp7

scaleapp8

scaleapp9

This marks the end of this blog post. If you have any questions feel free to contact me on rebeladm@live.com also follow me on twitter @rebeladm to get updates about new blog posts.  

Step-by-Step guide to Azure Policy (Preview)

Every business has different regulations, compliances that they need to comply with. These regulations and compliances are different from one industry to another. As an example, if its financial institute they will need to comply with PCI (Payment Card Industry Data Security Standard), if it’s a healthcare service they will need to comply with HIPPA (Health Insurance Portability and Accountability Act). Some of these compliances are must to comply and some will just add extra value to business. ISO certifications are good example for that. Some of these regulations and compliances are directly apply to computer infrastructures as well. Especially related to data protection and data governance. 

Apart from that most business has their own “Policies” to protect data and workloads in their infrastructures. Most of the time end goal of these policies is to make sure if “IT department” done their part to support business compliance requirements.  There are two great tools available from Microsoft to make it easier for enterprises to reach their corporate compliance requirements with in Azure environments. 

1. Compliance Manager – This service can scan your azure environment and provide report of your compliance level against most common industry standard such as GDPR, ISO 27000 etc. I already wrote detail article about it http://www.rebeladmin.com/2017/11/microsoft-compliance-manager-makes-easy-deal-compliance-challenges/ 

2. Azure Policy – This is more to review continues compliance in corporate infrastructure policies. As an example, a corporate need to make sure all their Azure resources are deployed under west us region. With help of Azure policy, we can continuously monitor resources and make sure it does stay compliance with that policy. in event of breach it will flag it up as well. 

In this post we are going to look in to Azure Policies and how it can help. 

Azure Policy does have 34 inbuilt policy definitions (at the time this article written). These are covering most infrastructure Management, Audit, and security requirements. Users can use these inbuilt policies or build their own. 

Azure Policy definition are JSON based. Each policy has following elements. 

mode

parameters

display name

description

policy rule

               – logical evaluation

               – effect

Mode 

This is to define the resource type considered in the policy. There are two modes can use in a policy.

All – All resource types. This is the recommended mode for policies

Indexed –  Resource types that support tags and locations 

Parameters 

If you work with programming language or PowerShell I am sure you already know what parameter is. In here also it’s the same meaning. Parameter is special kind of variable which refer to piece of data. It simply the policy by reducing code. Following is extracted from a policy to show the parameter usage. 

"parameters": {

            "publisher": {

                "type": "String",

                "metadata": {

                    "description": "The publisher of the extension",

                    "strongType": "type",

                    "displayName": "Extension Publisher"

                }

Display name & Description

It is just to identify the policy. description also can use to add more meaning. 

{

    "type": "Microsoft.Authorization/policyDefinitions",

    "name": "allowed-custom-images", 

    "properties": {

        "displayName": "Approved VM images",

        "description": "This policy governs the approved VM images",

        "parameters": {

            "imageIds": {

                "type": "array",

                "metadata": {

                    "description": "The list of approved VM images",

                    "displayName": "Approved VM images"

                }

In above example, Approved VM images is policy display name and This policy governs the approved VM images is policy description

Policy Rule

It’s the heart of the policy. it is where it describes the policy using logical operators, conditions and effect

Under the policy rule following logical operators are supported. 

"not"

"allOf"

"anyOf"

It also accepts following conditions types

"equals"

"notEquals"

"like"

"notLike"

"match"

"notMatch"

"contains"

"notContains"

"in"

"notIn"

"containsKey"

"notContainsKey"

"exists"

Under a policy rule, following effects can use,

Deny – Generate event in audit log and fail the request

Audit – Only for auditing purpose and no request decision made

Append – Add additional fields to the request

AuditIfNotExists – Enable auditing if the resource not existing

DeployIfNotExists – Deploy if resource is not existing (at the moment this only supported in built-in policies)  

  "policyRule": {

            "if": {

                "allOf": [

                    {

                        "field": "type",

                        "equals": "Microsoft.Compute/virtualMachines"

                    },

                    {

                        "not": {

                            "field": "Microsoft.Compute/imageId",

                            "in": "[parameters('imageIds')]"

                        }

                    }

                ]

            },

            "then": {

                "effect": "deny"

            }

In above example, it uses if, not and then policy blocks been used. It checks images id of virtual machines and if it’s not matching it will deny request based on effect. 

More info about policy templates can be found under

https://docs.microsoft.com/en-us/azure/azure-policy/policy-definition

https://docs.microsoft.com/en-us/azure/azure-policy/json-samples

Policy Initiatives 

Azure Policy also allows to group policies together and apply it one scope. This is called Policy Initiative. This reduce the complexity of policy assignment. As an example, we can create policy initiative called “Infrastructure Security” and include all infrastructure security related policies to it.  

Using Azure Policy

Let’s see how we can use Azure Policy feature. 

1. Log in to Azure Portal as Global Administrator

2. Go to All Services and type Policy then click on policy tile. 

policy

3. Then it will open up the feature tile.

policy2

4. In my demo I am going to assign pre-built policy to restrict resource region. In order to assign policy, click on Assignment 

policy3

5. Then click on Assign Policy

policy4

6. Then in it will open up Assign Policy Wizard. Click on Policy to list and select the relevant policy. in my demo I am using policy called “Allowed Locations”. Select the policy from list and then click on select to complete the action. 

policy5

7. Under Name and Description fields define policy name and description which explain its characteristics. 

8. Under the Pricing Tier select the pricing tier for evaluation. 

9. Scope field defines the scope of the policy. it will be subscription in use. 

10. Using exclusion, we can exclude resource groups which not going to exclude from the policy. in this demo I am not going to exclude any.

policy6

11. Then under the Parameters I select the region I like to use for my resources (In my demo I am using Canada Central as the region). 

policy7

12. At the end click on Assign to complete the policy assignment process. 

policy8

13. Not it is time for testing. In my demo I am trying to create a storage account under west us region. When I do that it gives me error saying “There were validation errors. Click here to view details

policy9

When I click on it, it says it didn’t deploy as policy violation. (hope I will see more details when its GA)

policy10

Cool ha? It’s doing the job it supposed to do. Since policy effect is “deny” it should deny my request to create resource under other regions. 

Initiative Assignment

Assigning Initiative is same process as Policy assignment. But before do that you need initiative in place. There is only one in-built initiative in place currently. 

In order to create initiative,

1. Log in to Azure Portal as Global Administrator

2. Go to All Services and type Policy then click on policy tile. 

3. Then in policy feature window, click on Definition

policy11

4. After that click on Initiative definition option. 

policy12

5. in new window to start with, select Definition location. This is basically the targeted subscription. 

6. Under Name, define name for policy initiative. 

7. Under the category, you can either create new category or select existing one. 

policy13

8. After that click on available policy in left hand panel and click on Add it to initiative. 

policy14

9. Once it’s all done, click on Save to complete to process. 

policy15

10. Once it’s done, we can assign initiative, using Assignment | Assign Initiative Option

policy16

Create New Policy

Creating new policy is similar to creating initiative process. I can be done using Definition | Policy Definition option. 

policy17

policy18

Apart from that, using compliance option we can see the overall policy and initiative compliant status. It also allows to assign policies and initiative. 

policy19

This marks the end of this blog post. Hope it was useful for you. If you have any questions feel free to contact me on rebeladm@live.com also follow me on twitter @rebeladm to get updates about new blog posts.

Step-by-Step guide to configure Azure File Sync (preview)

In one of my previous blog post I have explained what is Azure File Share and how it can use to replace traditional on-premises file server. if you not read it yet please check it before we go further on this post as this feature is depend on Azure File Share. You can access article using http://www.rebeladmin.com/2018/03/step-step-guide-create-azure-file-share-map-windows-10/ 

With Azure File Sync we can make on-premises windows server to act as a cache copy holder for your Azure file share.  It allows users to access files locally using protocol such as SMB, NFS and FTPS. In this blog we going to look in to Azure file sync implementation.

Before we start configuration, we need to familiarizes with some terms associated with this feature. 

Azure File Sync Agent

It is an agent which we need to install in on-premises windows server in order to enable sync with Azure file share. It includes three components, 

1. FileSyncSvc.exe – This is the service responsible for monitoring changes in local server initiate sync with Azure file share. 

2. StorageSync.sys – This component is responsible for tiering files to Azure files. Cloud tiering is additional feature of Azure File Sync. It can use with not frequently used files greater than 64Kb. When this enabled, local file replaced with url to files in Azure file share. When user access it, in background it recalls the file from Azure file share. End user will not have any difference experience as it all happens in back end. 

3. PowerShell cmdlets – This helps to manage Microsoft.StorageSync Azure resource provider using PowerShell commands. These cmdlet files are located in

C:\Program Files\Azure\StorageSyncAgent\StorageSync.Management.PowerShell.Cmdlets.dll

C:\Program Files\Azure\StorageSyncAgent\StorageSync.Management.ServerCmdlets.dll

This agent is only supported in Windows server 2012 R2 / 2016 standard and datacenter versions only. It is not supported on core version either. 

Storage Sync Service 

According to Microsoft “The Storage Sync Service is the top-level Azure resource for Azure File Sync. The Storage Sync Service resource is a peer of the storage account resource, and can similarly be deployed to Azure resource groups. A distinct top-level resource from the storage account resource is required because the Storage Sync Service can create sync relationships with multiple storage accounts via multiple sync groups. A subscription can have multiple Storage Sync Service resources deployed.”

Sync group 

Sync group defines the boundaries of sync job. A sync group includes cloud endpoint and server end point. Storage sync service can have multiple sync group. 

Cloud endpoint

Cloud endpoint represent an Azure file share. One cloud endpoint can only have one file share which means one Azure file share responsible for one sync group. 

Server endpoint

Server endpoint represent the local server directory which will cache files from Azure file share. A one server can hold multiple server endpoints but one endpoint can’t be part of multiple sync groups. If it’s still added, it will merge with the files belongs to other endpoints in same sync group. 

Registered Server 

Registered server represents the trust relationship between on-premise server and storage sync service. It is one-to-one connection. However, one storage sync service can have many servers registered with it. 

Now we know the component and how each component involves in sync operation between Azure file share and on-premises server. Next step is to get it configured. 

Setup Azure File Share

As first step of the demo I am going to create Azure file share. Steps for this task is already explained on one of my previous blog post. http://www.rebeladmin.com/2018/03/step-step-guide-create-azure-file-share-map-windows-10/

Azure file sync preview feature is only supported in Australia East, Canada Central, East US, Southeast Asia, UK South, West Europe, West US regions. There for azure file share also need to be in same regions. 

For this demo I have created a file share called “rebelshare”. It is associated with westus region. 

async1

Create Storage Sync Service
 
1) Log in to Azure Portal as global administrator
2) Go to New | Create a resource | Azure File Sync (Preview) | Create
 
asyncnew1
 
3) In new window type name for sync service and select relevant resource group for it. if required can create new resource group. once you fill in info, click on create
 
asyncnew2
 
Install Azure File Sync Agent
 
Next step in configuration is to install azure file sync agent in on-premises server. In this demo I am using server which running windows server 2016 datacenter edition. 
 
Before install agent,
 
Log in to server and disabled Internet Explorer Enhanced Security Configuration for administrators and users. This can re-enable after installation. 
 
async2
 
Verify PowerShell version its running. At least it need to run version 5.1
 
Install Azure PowerShell Module – Guide for it available in https://docs.microsoft.com/powershell/azure/install-azurerm-ps 
 
async3
 
Once above in place, go and download file sync agent from https://www.microsoft.com/en-us/download/details.aspx?id=55988
 
Once download is completed, double click to start the installation. In initial page, click Next to continue.
 
async4
 
In next page, accept the license agreement and click on Next.
 
After that in next window we can select the path for installation.
 
async5
 
In next window it asks in future how you need to update the agent version. It can be done using windows update. 
 
async6
 
In next window, keep default settings and click on Install to begin installation. 
 
Once installation is completed, it opens up Azure File Sync agent wizard. First step is to register the server. in window click on Sign in to start the process. 
 
async7
 
Then sign in using your Azure global administrator account. 
 
async8
 
In next window select the Azure Subscription, Resource group, Storage Sync service and click on Register
 
async9
 
Then it will ask again for login, once it is done it will complete the registration process. 
 
async10
 
Create Sync Group
 
Next step of the process is to create sync group. to do that.
 
1) Log in to Azure Portal as global administrator
2) Go to All Services and search for Storage Sync Services
3) In Storage Sync Services page click on the Storage Sync Service we created on earlier step. 
 
async11
 
4) In new window click on Sync Group icon.
 
async12
 
5) In next window, define name for sync group and select the subscription. Then select the storage account and Azure file share. At the end click on Create
 
async13
 
6) Once group is added, click on the new group
 
async14
 
7) In new window, click on add server endpoint option. 
 
async15
 
8) Then in new window select the registered server from the list and then define folder path for local cache copy. In my demo I am using E:\share path. I also enable cloud tiering feature. Once info is in click on create
 
async16
 
9) After initial sync we can see same files in two endpoints. 
 
async17
async18
 
10) You also can review status of endpoint sync using Storage Sync Services | Sync_Account | Sync_group

async19
 
This marks the end of this blog post. If you have any questions feel free to contact me on rebeladm@live.com also follow me on twitter @rebeladm to get updates about new blog posts.

Step-by-Step guide to create Azure file share and Map it in Windows 10

Azure Files is a managed, cloud based file share that can access via SMB protocol. Once you create Azure File share it can be access from anyware using Windows, Linux or macOS. It can also can be mapped as a shared drive to the system.

Azure Files have following benefits, 

Simple – Easy to setup and easy to manage. It also can use with Azure Backup and Azure File Sync. It got everything to use as replacement for on-premises file server. 

Future Proof – When people are moving on-premises workload to Azure, sometime applications needed access to file shares. Azure Files allows to facilitate that requirements easily. Also, if you are maintaining on-premises file servers, when windows versions change, you need to upgrade those as well. Azure File is fully managed service which means no need to worry about versions.  

Reliable – High Availability of on-premises file share depend on many things such as power, File Sync between servers, Bandwidth etc. but with Azure Files you do not need to worry about it as it was already designed and operate with as high available service. You do not need to worry about keeping sync servers in different geographical locations either. 

Integration – Azure Files uses industry standard SMB protocol. It can be manage using Azure CLI, PowerShell, file system I/O APIs, Azure Storage Client Libraries and Azure Storage REST API. There for it allow developers to integrate it with existing systems or new systems easily. 

Let’s see how we can create Azure File Share and map it with Windows 10 PC.

In my demo I am going to use PowerShell for the setup. This is fully supported to setup via Azure Portal. 

Setup Storage Account

1) Log in to Azure Portal using Global Admin Account

2) Click on Cloud Shell in right hand corner

file1

3) Make sure PowerShell console loaded. Same thing can be done by directly connecting to Azure using Azure PowerShell module. https://docs.microsoft.com/en-us/powershell/azure/install-azurerm-ps?view=azurermps-5.4.0

file2

4) Before create storage account I need to find info about my resource group that I am going to use. to do that run Get-AzureRmResourceGroup it will list down the group details along with the location. 

file3

5) Once we retrieve info, we can create new storage account using,

New-AzureRmStorageAccount -ResourceGroupName therebeladmin `

  -Name rebelsa1 `

  -Location northcentralus `

  -SkuName Standard_LRS

In above, -ResourceGroupName specify the resource group name that storage account will belongs to. -Name defines the name of the storage account.  -Location defines the location for storage account. -SkuName defines the storage types. 

Standard_LRS – Locally-redundant storage.

Standard_ZRS – Zone-redundant storage.

Standard_GRS – Geo-redundant storage.

Standard_RAGRS – Read access geo-redundant storage.

Premium_LRS – Premium locally-redundant storage.

file4

Setup Azure File Share

1) Now we have storage account, before we create share, we need to find out storage access key for the account. To do that we can use

Get-AzureRmStorageAccountKey -ResourceGroupName "therebeladmin" -AccountName "rebelsa1"

file5

2) Now we can create file share called “rebelshare” using 

$SAContext = New-AzureStorageContext “rebelsa1” “<storage key>”

New-AzureStorageShare rebelshare -Context $SAContext

In above, rebelsa1 is the storage key and <storage key> need to replace by storage account key found on previous step.

file6

In here it used the default quote which is 5tb. 

Map it to Windows 10 

To map folder to the Windows PC, we can use following PowerShell command,

net use R: \\rebelsa1.file.core.windows.net\rebelshare <storage key> /user:Azure\rebelsa1

In above, it will map the Azure File share we created as R:\ drive. <storage key> need to replace with Azure storage key.

file7

in above I successfully map the share and copied file from my local C: drive. 

Note – In order to map this, share you need to have communication to Azure via SMB ports. If your firewalls blocking it, you will not able to map the drive. This is bit of an issue if you using the map drive in most of public wifi networks. However, you still can access the share using portal. 

This marks the end of this blog post. If you have any questions feel free to contact me on rebeladm@live.com also follow me on twitter @rebeladm to get updates about new blog posts.

How to re-enable Network Interface in Azure VM?

In Hyper-V or VMware virtualization environment, Enable/Disable NIC in a VM is not a big deal. Even if you do not have NIC or valid IP configure, administrators still can connect to VM as it does have “Console” access. Few weeks ago, I received an email from one of my regular blog readers. He accidently disabled NIC in azure vm and he lost RDP access to it. since there is no console access like other on-premises virtualization solution, of cause he was panicking. In this blog post I am going to share what you can do to re-enable your Azure VM NIC in such scenario. 

In my demo setup, I have an active azure VM running with 10.5.2.33 private IP address. 

ip1

I logged in to VM as administrator and disable the NIC.

Now I need to regain the RDP access to server. in order to do that, log in to Azure Portal as Global Administrator and click on Cloud Shell button in right hand top corner. 

ip2

When window load up makes sure you are using PowerShell option. 

ip3

Now we need to find out the NIC details of the VM that we having issues with. We can do this using,

Get-AzureRmNetworkInterface -ResourceGroupName "REBELADMIN-DEMO" 

In this command, -ResourceGroupName represent the resource group that VM belongs to. In my demo setup I only have one VM under that resource group.  but if you have more VMs it can be hard to find the relevant info. In that case I recommend to use portal itself to view this info.

In here, note down the network interface name, IP address and allocation method you using. 

ip4

Now, we need to assign a new IP address to the same nic from same subnet. It can be done using,

$Nic = Get-AzureRmNetworkInterface -ResourceGroupName "REBELADMIN-DEMO" -Name "rebeladmin-vm1123"

$Nic.IpConfigurations[0].PrivateIpAddress = "10.5.2.34"

$Nic.IpConfigurations[0].PrivateIpAllocationMethod = "Static"

$Nic.Tag = @{Name = "Name"; Value = "Value"}

Set-AzureRmNetworkInterface -NetworkInterface $Nic

In above commands, rebeladmin-vm1123 represent the network interface name. 10.5.2.34 is the new ip address for the network interface. PrivateIpAllocationMethod define the ip allocation method. Set-AzureRmNetworkInterface cmdlet sets the network interface configuration. 

ip5

Great!! Now I got my RDP access back with new IP address.

ip6

But it is not the original IP it had, now we can change it back with,

$Nic2 = Get-AzureRmNetworkInterface -ResourceGroupName "REBELADMIN-DEMO" -Name "rebeladmin-vm1123"

$Nic2.IpConfigurations[0].PrivateIpAddress = "10.5.2.33"

$Nic2.IpConfigurations[0].PrivateIpAllocationMethod = "Static"

$Nic2.Tag = @{Name = "Name"; Value = "Value"}

Set-AzureRmNetworkInterface -NetworkInterface $Nic2

ip7

Once it is applied, I can access server via RDP and now it has same private IP address it had.

ip8

If you using dynamic IP allocation method, you need to make it static, then change the ip and go back to dynamic mode. 

This marks the end of this blog post. If you have any questions feel free to contact me on rebeladm@live.com also follow me on twitter @rebeladm to get updates about new blog posts.

Step-by-Step Guide to setup Just-in-Time VM Access in Azure

In most common scenarios hackers targets open ports in servers to gain access. It can be web server port, RDP ports, SQL ports etc. If genuine users also use same ports to access the system it’s hard to keep these ports closed. There are other methods such as firewalls that we can use to secure the access but it will still keep the ports open. when it comes to public clouds, its increase your infrastructure’s public facing part. Its clients, administrators may access services over the internet mostly. In that case it will give more time and room for attackers to target open ports. 

Azure Just-in-Time VM Access is a great option to control this. As an example, if engineers need to do work in their VM’s mostly they RDP in to the system. Let’s assume they work 1 hour per day on servers. so, keeping port open for 24 hours not giving any benefits rather than risk. Using Just-in-Time VM Access we can limit the time it keeps RDP ports open. 

When Just-in-Time VM Access enabled, we can define what VM and what ports will be controlled. In most scenarios you do not need to control access to ports used by your applications or services. It will be more in to ports related to management tasks. This all done by using azure network security group rules. You can find more about NSG using https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-nsg

When this feature used with VM, upon access request to a protected port, it will first check if the user have access permission to it using Azure Role based access control (RBAC). If it all good, then NSG automatically configure to allow access with the time you specified. Once it reached the allowed time limit, NSG will automatically revert configuration in to original state. 

This feature is still on preview but it is not too early to check its capabilities. Also, this feature is only can use with VMs created using Azure Resource Manager (ARM). 

Configuration

1. Log in to Azure Portal using Global Administrator account. 

2. Go to Security Center > Just-In-Time VM Access 

jvm1

3. Then it will load the default page.

jvm2

4. Click on Recommended Tab. It will list down the VMs you have. 

jvm3

5. In order to enable JIT access, put a tick on the VM you like to protect and then click on Enable JIT on button. if need you can do it for multiple VMs in same time. 

jvm4

6. Then it lists down the default ports protected with JIT access. 

jvm5

7. We still can adjust settings for these services. As an example, I need to limit port 3389 (RDP) port Max request time to 1 hour. By default, it is 3 hours. In order to do that click on rule for 3389 and change Max request time value to 1 hour. To apply changes, click on OK at the end.

jvm6

8. In next window we can see the new value, click on Save to save the config. 

jvm7

9. If need we also can add our own ports to protection. Let’s assume we need to protect port 8080 access. To do that click on Add button in access configuration page. 

jvm8

10. Then type port details in the window. Under Protocol we can select TCP, UDP or Any based-on requirement. Under Allowed source IPs access can controlled based on request or specific IP range. Max request time option is to limit the hours. Minimum time we can select is 1 hour. Once changes are done click on OK to apply changes

jvm9

11. Then click on Save to save the config. 

12. After that, once we go to feature home page we can see the protected VM under Configured tab.

jvm10

13. If need to edit the current configuration it can do using Edit option as below. 

jvm11

14. Now configuration is done. Let’s test it out. According to my configuration I have RDP port protected. To request access, select the VM with tick box and then click on request access option. 

jvm12

15. In next window, I am only going to request access to RDP port. To do that select the correct rule and click on On tab under toggle. Then click on Open Ports button. 

jvm13

16. Then in the feature home page we can see it got 1 approved requests.

jvm14

17. After configuration yes, I can access the server via RDP for 1 hour.

jvm15

18. After one hour, I can’t initiate another new RDP connection. Using Activity log we can view logs related to past activities. 

jvm16

jvm17

This marks the end of this blog post. Hope now you have better understanding what is JIT VM access and how to use it. If you have any questions feel free to contact me on rebeladm@live.com also follow me on twitter @rebeladm to get updates about new blog posts.

Step-by-Step guide to create VM with Azure Accelerated networking

In my previous post I have explained what is Azure Accelerated networking and how it works. If you didn’t read it yet, you can do it using http://www.rebeladmin.com/2018/01/azure-accelerated-networking/ . In this post I am going to show how we can create VM with AN and verify its actions. 

There are few limitations we need to aware before we use Azure Accelerated networking. 

1. Can’t use with existing VMs – In order to use AN feature, Virtual machines must be created with Accelerated Networking enabled. This feature cannot enable in existing VMs. 

2. A NIC with AN cannot attached to an existing VM –  A NIC with AN enabled only can attached during the VM creation process. It is not possible to attach it to existing VM. 

3. Azure Resource Manager only – This feature only can use with AR. It can’t use in classic portal. 

In my demo I am going to create new VM in new resource group with Azure Accelerated networking enable. Please note this feature can only enable using Azure CLI and Azure PowerShell.

Here I am going to use Azure CLI. More info about Azure CLI can be found in my blog post http://www.rebeladmin.com/2017/08/step-step-guide-start-azure-cli-2-0/ 

1. As first step I am going to create new resource group called ANTest in westus region. 

az group create --name ANTest --location westus

an1

2. Then we need to create virtual network. In demo I am creating virtual network called ANTestVNet with address space 10.10.0.0/16

az network vnet create --name ANTestVNet --resource-group ANTest --location westus --address-prefix 10.10.0.0/16

an2

3. Next step is to create a subnet under selected address space. In my demo I am creating 10.10.20.0/24 subnet with name ANTestsub1

az network vnet subnet create --address-prefix 10.10.20.0/24 --name ANTestsub1 --resource-group ANTest --vnet-name ANTestVNet

an3

4. I like to access this vm from internet so I need a public ip attached to it. 

az network public-ip create --name ANTestpubip1 --resource-group ANTest --location westus --allocation-method dynamic

in above I am using dynamically assigned ip rather than static public ip.

an4

5. Now we have everything ready to create NIC. This is the most important part of the job. So the command I am using for it is,

az network nic create --resource-group ANTest --name ANTestNic1 --vnet-name ANTestVNet --subnet ANTestsub1 --accelerated-networking true --public-ip-address ANTestpubip1

in above ANTestNic1 is the NIC name. –accelerated-networking true is the command to enable AN feature. 

an5

6. Next step is to create VM with this new NIC attached. Please note there are only some OS and VM templates support this AN feature. So, make sure you select the correct size. if you use unsupported template, you can’t change enable AN by just changing the template. In my demo I am creating windows server 2016 server with Standard_DS4_v2 vm template.

az vm create --resource-group ANTest --location westus --nics ANTestNic1 --name REBELVM101 --image win2016datacenter --size Standard_DS4_v2 --admin-username rebeladmin --admin-password L0nd0n3322$

an6

once it is completed we can log in to VM and verify. Once this feature enabled you will be able to see Mellanox ConnectX-3 Virtual Function Ethernet Adapter in device manager.

an7

Let’s see how it affecting performance. I do have 2 VM created using old method and I am transferring a folder with 10Gb data between them. So, let’s see how the performance looks like. 

an8

an9

And when I do transfer same file between 2 VM with AN enabled I get following performance. 

an10

an11

It’s pretty amazing ha??? 

This marks the end of this blog post. Hope this was useful. If you have any questions feel free to contact me on rebeladm@live.com also follow me on twitter @rebeladm to get updates about new blog posts.

Azure Accelerated Networking

Early January Microsoft announced general availability of Azure Accelerated Networking (AN). It is now available for all the regions. This will improve the VM’s performance as its offloading software-define networking from CPU to FPGA-based SmartNICs. To make it more interesting, it can provide up to 30Gbps networking throughput without any additional charge. 

How it works? 

If you worked with Hyper-V clusters, System Center virtualization manager (SCVMM) you may probably aware how virtual switches works. It works as a middle man between virtual machines and physical network to provide greater control over “Communication”. It allows to move workloads between physical hosts, control traffic and isolation using policies, flexible hardware upgrades etc. Azure also uses virtual switches similar to hyper-v. 

accelerated-networking
Image source: https://docs.microsoft.com/en-us/azure/virtual-network/media/create-vm-accelerated-networking/accelerated-networking.png 
 
You also can read more about it using this link
 
As you can see in the above image without accelerate networking, traffic always need to pass through the virtual switch and physical hosts before it reaches the physical switch. When Accelerated networking in place, network traffic is directly handled by physical switch by bypassing host and the virtual switch. All the policies you used with virtual switches now can offload to hardware. As it removes the dependency of host to process the packet, we will be able to see lower latency. If there is no AN, Virtual switch process all the policies applying to network traffic. Since it is software based of cause it is need to handle by CPU. But the performance of it depend on the CPU utilization and number of policies. With AN, policies will no longer rely on CPU and it handle by the dedicated hardware. This will reduce jitter. 
 
Limitations 
 
There are few limitations applying to this feature. 
 
1. Can’t use with existing VMs – In order to use AN features, Virtual machines must be created with Accelerated Networking enabled. This feature cannot enable in existing VMs. 
2. A NIC with AN cannot attached to an existing VM –  A NIC with AN enabled only can attached during the VM creation process. It is not possible to attach it to existing VM. 
3. Azure Resource Manager only – This feature only can use with ARM. It can’t use in classic portal. 
 
Supported VM Instances 
 
Azure Accelerated Networking is supported on D/DSv2, D/DSv3, E/ESv3, F/Fs/Fsv2, and Ms/Mms Azure VM series. 

Supported Operating Systems
 
Azure Accelerated Networking is supported on both Linux and Windows operating systems such as, 
 
Windows Server 2016
Windows Server 2012R2
Ubuntu 16.04
Red Hat Enterprise Linux 7.4
CentOS 7.4
SUSE Linux Enterprise Server 12 SP3
 
This marks the end of this blog post. Hope this was useful. In next post I will demonstrate how to create VM with AN feature. If you have any questions feel free to contact me on rebeladm@live.com also follow me on twitter @rebeladm to get updates about new blog posts.

Azure DDoS Protection Preview in Action

DDoS attacks are the most commonly using method by attackers against resources which can access via internet. It can be website or application. DDoS attack can crash or slowdown service or application by sending large amount of access requests in short period of time. This applies to public cloud as well. There for Microsoft recently released Azure DDoS protection service to protect workloads in azure from DDoS attacks. This is currently in preview but it is not too early to check its capabilities. 

This feature comes as two versions,

Basic – This comes as part of the Azure subscription without any additional cost. This is same level of real time monitoring and mitigation applies to Microsoft services. This is applying to Azure global network across all region. This applies to Azure IPv4 and IPv6 public ip addresses. 

Standard – This comes with additional traffic monitoring and machine leaning algorithms tunes specifically to protect Azure virtual networks resources such as azure application gateway, azure load balancer. Real time monitoring data is available via Azure Monitor. Users also can enable alerting for the events. Standard protection is coming with additional fee. This applies to Azure IPv4 public ip addresses.

According to Microsoft, under standard subscription following type of DDoS attacks will be prevented. 

Volumetric attacks: The attack's goal is to flood the network layer with a substantial amount of seemingly legitimate traffic. It includes UDP floods, amplification floods, and other spoofed-packet floods. DDoS Protection Standard mitigates these potential multi-gigabyte attacks by absorbing and scrubbing them, leveraging Azure’s global network scale, automatically.

Protocol attacks: These attacks render a target inaccessible by exploiting a weakness in the layer 3 and layer 4 protocol stack. It includes, SYN flood attacks, reflection attacks, and other protocol attacks. DDoS Protection Standard mitigates these attacks, differentiating between malicious and legitimate traffic, by interacting with the client and blocking malicious traffic.

Application layer attacks: These attacks target web application packets to disrupt the transmission of data between hosts. It includes HTTP protocol violations, SQL injection, cross-site scripting, and other layer 7 attacks. Use the Azure Application Gateway web application firewall, with DDoS Protection Standard, to provide defense against these attacks.

Also, Standard version features include,

Native platform integration: Natively integrated into Azure and includes configuration through the Azure portal and PowerShell. DDoS Protection Standard understands your resources and resource configuration.

Always-on traffic monitoring: Your application traffic patterns are monitored 24 hour a day, 7 days a week, looking for indicators of DDoS attacks. Mitigation is performed when protection policies are exceeded.

Turn-key protection: Simplified configuration immediately protects all resources on a virtual network as soon as DDoS Protection Standard is enabled. No intervention or user definition is required. DDoS Protection Standard instantly and automatically mitigates the attack, once it is detected.

Adaptive tuning: Intelligent traffic profiling learns your application’s traffic over time, and selects and updates the profile that is the most suitable for your service. The profile adjusts as traffic changes over time.

Layer 3 to layer 7 protection: Provides full stack DDoS protection, when used with an application gateway.

Extensive mitigation scale: Over 60 different attack types can be mitigated, with global capacity, to protect against the largest known DDoS attacks.

Attack metrics: Summarized metrics from each attack are accessible through Azure Monitor.

Attack alerting: Alerts can be configured at the start and stop of an attack, and over the attack’s duration, using built-in attack metrics. Alerts integrate into your operational software like Microsoft Operations Management Suite, Splunk, Azure Storage, Email, and the Azure portal.

Cost guarantee: Data-transfer and application scale-out service credits for documented DDoS attacks.

Let’s see how we can get this feature enable and configure. 

In order to enable Azure DDoS Protection Preview service, first you need to request it using http://aka.ms/ddosprotection . This feature also only available for East US, East US 2, West US, West Central US, North Europe, West Europe, Japan West, Japan East, East Asia, and Southeast Asia regions.

Enable DDoS Protection Standard Preview in Existing Virtual Network 
 
1. Once you receive the confirmation email from Azure team, log in to Azure portal https://portal.azure.com as global administrator.
2. Then go to Virtual Networks and click on the Virtual Network that you like to enable DDoS protection. 
 
ddos1
 
3. Then in properties window click on DDoS protection option. 
 
ddos2
 
4. In next window, click on Enabled and then click on Save to enable the feature. 
 
ddos3

Enable DDoS Protection Standard Preview in New Virtual Network
 
1. Once you receive the confirmation email from Azure team, log in to Azure portal https://portal.azure.com as global administrator.
2. Then go to Virtual Networks and click on Add
 
ddos4
 
3. In new page, provide relevant info for virtual network, select a region which support by DDoS feature and then click on Enabled under DDoS protection.
 
ddos5
 
4. At the end click on Create to complete the process. 
 
DDoS Monitoring 
 
Using Monitoring metrics, we can review historical DDoS threat related data for selected resources. Also, we can configure email alerts for events. 
In order to do so,
 
1. Log in to Azure portal https://portal.azure.com as global administrator.
2. Then go to Metrics | Monitor
 
ddos6
 
3. In the page select the relevant subscription, resource group, resource type and resource to view the relevant data. 
 
ddos7
 
4. Then under the available metrics you can select the metrics you like to review. In my demo I am going to use Under DDoS attack or not metric which going to show all the data. 
 
ddos8
 
5. Then it will show the relevant metrics. Using Time Range window, we can change the time and review specific data sets. 
 
ddos9
 
6. Using Char Type option we can change the view of the chart. 
 
ddos10
 
7. In order to configure alerts, click on No alerts configured for this resource. Click to add an alert option
 
ddos11
 
8. Then it opens up window where you can customize metric type, condition, threshold and notification type. 
 
ddos12
 
As you can see the setup, configuration and maintenance of Azure DDoS Protection is straightforward. This marks the end of this blog post. Hope this was useful. If you have any questions feel free to contact me on rebeladm@live.com also follow me on twitter @rebeladm to get updates about new blog posts.