Azure HighAvailability

Step-by-Step Guide: Application layer (OSI layer 7) load balancing with Azure Application Gateway (PowerShell Guide)

In my previous blog posts, I explained about two types of Azure solution to load balance web traffic.

• Azure Traffic Manager – If you are looking for DNS level load balancing which can distribute traffic to global endpoints, Azure traffic manager will be the product to look at. More info about deployment can be found on https://www.rebeladmin.com/2020/02/step-by-step-guide-dns-based-traffic-load-balancing-with-azure-traffic-manager/

• Azure Load Balancer – Azure load balancer works in layer 4 (transport layer) and can distribute network traffic to endpoints in the same Azure region. It can use to distribute internet traffic as well as internal traffic. More info about deployment can be found on https://www.rebeladmin.com/2020/01/step-step-guide-setup-azure-load-balancer-powershell-guide/

However, if you looking for Layer 7 (Application Layer) load balancing solution, Azure Application Gateway is the answer. Azure Application Gateway has the following features,

• Secure Sockets Layer (SSL/TLS) termination
• Autoscaling
• Zone redundancy
• Static VIP
• Web Application Firewall
• Ingress Controller for AKS
• URL-based routing
• Multiple-site hosting
• Redirection
• Session affinity
• Websocket and HTTP/2 traffic
• Connection draining
• Custom error pages
• Rewrite HTTP headers
• Sizing

More info about these features are available on https://docs.microsoft.com/en-us/azure/application-gateway/features

In this demo, I am going to show how we can setup URL-based routing using Azure Application Gateway.

To do that I will need to do the following tasks,

1. Setup new resource group
2. Create Virtual Networks
3. AG IP and frontend port configuration
4. Create Backend pool
5. Create listener and AG routing rule
6. Create Azure Application Gateway
7. Add Backend pools for videos and images
8. Add frontend port for the pool
9. Create Backend Listener
10. Create URL path map
11. Create routing rule
12. Create virtual machines
13. Add Web Content
14. Testing

For the configuration process, I will be using Azure PowerShell. Therefore, please make sure you have Azure PowerShell module installed. More info about it can find under https://docs.microsoft.com/en-us/powershell/azure/install-az-ps?view=azps-2.6.0

Setup new resource group

Launch PowerShell console and connect to Azure using Connect-AzAccount

Then create a new resource group using,

New-AzResourceGroup -Name REBELRG1 -Location “East US”

In the above, REBELRG1 is the resource group name and East US is the resource group location.

Create Virtual Networks

In this demo, I am going to use two back end servers. Before VM setup, let’s go ahead and create a new virtual network in REBELRG1 resource group.

$vmsubnet = New-AzVirtualNetworkSubnetConfig -Name vmsubnet -AddressPrefix “10.0.2.0/24”
$agsubnet = New-AzVirtualNetworkSubnetConfig -Name agsubnet -AddressPrefix “10.0.3.0/24”
New-AzVirtualNetwork -Name REBELVN1 -ResourceGroupName REBELRG1 -Location “East US” -AddressPrefix “10.0.0.0/16” -Subnet $vmsubnet, $agsubnet

In the above, REBELVN1 is the new virtual network name. It has 10.0.0.0/16 address space. It also has a new subnet 10.0.2.0/24 (vmsubnet) for virtual machines and 10.0.3.0/24 subnet (agsubnet) for the application gateway.

Create new public IP address

We require public ip address for Azure Application gateway. This will be the external contact point for the gateway. To create that,

New-AzPublicIpAddress -ResourceGroupName REBELRG1 -Location “East US” -Name REBELPublicIP01 -AllocationMethod Static -Sku Standard

In the above, we are creating a public IP address called REBELPublicIP01 with standard SKU. [Read more…] about Step-by-Step Guide: Application layer (OSI layer 7) load balancing with Azure Application Gateway (PowerShell Guide)

Step-by-Step Guide: How to setup an Azure load balancer? (PowerShell Guide)

In my previous blog post https://www.rebeladmin.com/2020/01/step-step-guide-setup-azure-load-balancer/, I explained how to setup an Azure load balancer. In that post, I used GUI method to set it up. In this post I am going to show how we can set azure load balancer using Azure PowerShell.

In this demo, I am going to set up two virtual servers with IIS on it. Then I am going to set up Azure load balancer and load balance the web service access for external connections over TCP port 80.

To do that I will need to do the following tasks,

1. Setup new resource group

2. Setup two new windows VM

3. Setup IIS with sample web page

4. Create Azure load balancer

5. Create a backend pool

6. Create health probes

7. Create load balancer rule

8. Testing

Setup new resource group

1. Launch PowerShell console and connect to Azure using Connect-AzAccount

2. Then create a new resource group using,

New-AzResourceGroup -Name REBELRG1 -Location "East US"

In the above, REBELRG1 is the resource group name and East US is the resource group location.

Setup two new windows VM

1. In this demo, I am going to use two back end servers. Before VM setup, let's go ahead and create a new virtual network.

$vmsubnet = New-AzVirtualNetworkSubnetConfig -Name vmsubnet -AddressPrefix "10.0.2.0/24"

New-AzVirtualNetwork -Name REBELVN1 -ResourceGroupName REBELRG1 -Location "East US" -AddressPrefix "10.0.0.0/16" -Subnet $vmsubnet

In the above, REBELVN1 is the new virtual network name. It has 10.0.0.0/16 address space. It also has a new subnet 10.0.2.0/24 (vmsubnet) for virtual machines.

2. Then I need to create a new availability set. To add back end servers to load balancer, those VMs need to be in the same availability set.

New-AzAvailabilitySet -Location "East US" -Name "REBELAS1" -ResourceGroupName "REBELRG1" -Sku aligned -PlatformFaultDomainCount 2 -PlatformUpdateDomainCount 2

In above REBELAS1 is the availability group name. More info about scale sets can found here https://docs.microsoft.com/en-us/azure/virtual-machine-scale-sets/availability

3. As the next step of the configuration, I am going to create two new virtual machines under REBELRG1 resource group.

$mylogin = Get-Credential

New-AzVm -ResourceGroupName REBELRG1 -Name "REBELTVM01" -Location "East US" -VirtualNetworkName "REBELVN1" -SubnetName "vmsubnet" -addressprefix 10.0.2.0/24 -PublicIpAddressName "REBELTVM01IP1" -AvailabilitySetName "REBELAS1" -OpenPorts 3389,80 -Image win2019datacenter -Size Standard_D2s_v3 -Credential $mylogin

New-AzVm -ResourceGroupName REBELRG1 -Name "REBELTVM02" -Location "East US" -VirtualNetworkName "REBELVN1" -SubnetName "vmsubnet" -addressprefix 10.0.2.0/24 -PublicIpAddressName "REBELTVM02IP1" -AvailabilitySetName "REBELAS1" -OpenPorts 3389,80 -Image win2019datacenter -Size Standard_D2s_v3 -Credential $mylogin

In the above, I am creating two virtual machines called REBELTVM01 & REBELTVM02. It is running windows server 2019 data center edition. I have specified it using -Image parameter. It also using Standard_D2s_v3 vm size. For networking, It uses REBELVN1 virtual network and subnet 10.0.2.0/24. [Read more…] about Step-by-Step Guide: How to setup an Azure load balancer? (PowerShell Guide)

Step-by-Step Guide: How to setup Azure load balancer?

The role of a load balancer is to improve the availability of services by distributing the load to a pool of back end servers. When it comes to load balancing, Azure has a few different products to choose from.

• Azure Application Gateway – If you require a load balancer that can provide features such as SSL offloading, reverse proxy and works in the application layer (layer 7), Azure application gateway is the answer.

• Azure Traffic Manager – If you are looking for DNS level load balancing which can distribute traffic to global endpoints, Azure traffic manager will be the product to look at.

• Azure Load Balancer – Azure load balancer works in layer 4 (transport layer) and can distribute network traffic to endpoints in the same Azure region. It can use to distribute internet traffic as well as internal traffic. In this post, we are going to look into this service in detail.

Like many other load balancers, Azure load balancer also has the following components.

• Frontend/Virtual IP address – This is the load balancer IP address that works as a front door to clients. After clients initiate connections to a frontend IP address, the traffic will be distributed to the back-end servers.

• Server pool – The back-end application servers will be group together in a pool to serve an incoming request from a load balancer.

• Rules – The incoming traffic will be distributed to the backend servers according to the rules defined in the load balancer.

• Probes – If a back-end server is down, load balancer needs to know. Then it can stop distributing traffic to the faulty server. The load balancer uses probs to detect the health of the back-end servers.

• Inbound NAT rules – Inbound NAT rules define how the traffic is forward from the load balancer to the back-end server.

In this post, I am going to demonstrate how we can load balance a web application using Azure standard load balancer. This demo includes the following tasks,

1. Setup new resource group

2. Setup two new windows VM

3. Setup IIS with sample web page

4. Create Azure load balancer

5. Create a backend pool

6. Create health probes

7. Create load balancer rule

8. Testing

Setup new resource group

Let's go ahead and start the setup process by creating new Azure resource group.

For the configuration process, I will be using Azure PowerShell. Therefore, please make sure you have an Azure PowerShell module installed. More info about it can find under https://docs.microsoft.com/en-us/powershell/azure/install-az-ps?view=azps-2.6.0

1. Launch PowerShell console and connect to Azure using Connect-AzAccount

2. Then create a new resource group using,

New-AzResourceGroup -Name REBELRG1 -Location "East US"

In the above, REBELRG1 is the resource group name and East US is the resource group location.

Setup two new windows VM

1. In this demo, I am going to use two back end servers. Before VM setup, let's go ahead and create a new virtual network.

$vmsubnet = New-AzVirtualNetworkSubnetConfig -Name vmsubnet -AddressPrefix "10.0.2.0/24"

New-AzVirtualNetwork -Name REBELVN1 -ResourceGroupName REBELRG1 -Location "East US" -AddressPrefix "10.0.0.0/16" -Subnet $vmsubnet

In the above, REBELVN1 is the new virtual network name. It has 10.0.0.0/16 address space. It also has a new subnet 10.0.2.0/24 (vmsubnet) for virtual machines.

2. Then I need to create a new availability set. To add back end servers to load balancer, those VMs need to be in the same availability set.

New-AzAvailabilitySet -Location "EastUS" -Name "REBELAS1" -ResourceGroupName "REBELRG1" -Sku aligned -PlatformFaultDomainCount 2 -PlatformUpdateDomainCount 2

In above REBELAS1 is the availability group name. More info about scale sets can found here https://docs.microsoft.com/en-us/azure/virtual-machine-scale-sets/availability

3. As the next step of the configuration, I am going to create two new virtual machines under REBELRG1 resource group.

$mylogin = Get-Credential

New-AzVm -ResourceGroupName REBELRG1 -Name "REBELTVM02" -Location "East US" -VirtualNetworkName "REBELVN1" -SubnetName "vmsubnet" -addressprefix 10.0.2.0/24 -PublicIpAddressName "REBELTVM02IP1" -AvailabilitySetName "REBELAS1" -OpenPorts 3389,80 -Image win2019datacenter -Size Standard_D2s_v3 -Credential $mylogin

Step-by-Step Guide to protect Azure VM using Azure Backup

Azure Backup is capable of replacing typical on-premises backup solutions. It is cloud-based, secure, reliable solution. It has four components which can use to backup different types of data.

Component

Protected data

Can use with On-premises?

Can use with Azure?

Azure Backup (MARS) agent

Files, Folders, System State

Yes

System Center DPM

Files, Folders, Volumes,

VMs, Applications, Workloads, System State

Yes

Azure Backup Server

Files, Folders, Volumes,

VMs, Applications, Workloads, System State

Yes

Azure IaaS VM Backup

VMs, All disks (using PowerShell)

Yes

More details about azure backup and components limitations can be find on https://docs.microsoft.com/en-us/azure/backup/backup-introduction-to-azure-backup

In this article we are going to look in to Azure VM backup (Azure IaaS VM Backup).

How Azure VM Backup works?

Azure VM backup doesn’t need any special agent installed in VM. It also does not need to have any additional components (backup server) install either to enable backup. When very first backup job is triggered, it installs backup extension inside the VM. If its Windows VM, it installs VMSnapshot extension and if its Linux VM, it installs VMSnapshotLinux extension. VM must be in running state in order to install extension. After extension in place, it takes point-in-time snapshot of the VM. If VM is not running during backup window, it takes snapshot of VM storage. If its windows VM, backup service uses Volume Shadow Copy Service (VSS) to get consistence snapshot of VM disk. If its Linux VM, users can create custom scripts to run before and after backup job to keep application consistency. Once snapshot is taken it will transfer to the backup vault. Service can identify the recent changes and only transfer the block of data which changed from last backup. Once the data transfer completes snapshot will removed and recovery point will be created.

Image Source: https://docs.microsoft.com/en-us/azure/backup/media/backup-azure-vms-introduction/vmbackup-architecture.png

Performance of backup depends on,

1) Storage account limitations

2) Number of disks in VM

3) Backup Schedule – if all jobs running in same time it can create traffic jam

According to Microsoft following are recommended when you use Azure backup for Azure VMs. Reference: https://docs.microsoft.com/en-us/azure/backup/backup-azure-vms-introduction

1) Do not schedule more than 40 VMs to backup same time.

2) Schedule VMs backup when minimum IOPs been used in your environment (In relevant storage accounts).

3) Better not to back up more than 20 disks in single storage account. If you have more than 20 disks in single storage account spread those VMs across the multiple policies to maintain required IOPS.

4) Do not restore a VM running on Premium storage to same storage account. Also try to avoid restore while backup process is running on same storage account.

5) For Premium VM backup, ensure that storage account that hosts premium disks has at least 50% free space for staging snapshot for a successful backup.

6) Linux VM needs python 2.7 enabled for backup.

Next step is to see this in action.

1) Log in to Azure Portal as Global Administrator

2) First step is to create Azure Recovery Service Vault. In order to do that, go to All Services and click on Recovery Service vaults under storage section.

3) Then click on Add in new window

4) It will open up wizard and there provide vault name, subscription, resource group and location. Once done, click on Create.

5) Now we have vault created, next step is to create backup policy. To do that click on vault we just created from the Recovery service vault window.

6) Then click on Backup Policies

7) There is default policy from Azure VM backup. It backup VMs daily and keep it for 30 days.

8) I am going to create new policy to do backup every day at 01:00 am and keep it for 7 days. To do that click on add option in policy window.

9) Then select the policy type. for VMs, it should be Azure Virtual Machine

10) In next window we can define time and retention period of data. Once done with the details click on Create.

11) Next step of the configuration is to enable backup. In order to do that, go to the VM you like to backup. Then click on the option Backup

12) Then in new window select the vault and policy we created before and then click on enable backup

13) Once it is done we can run backup by going in to same backup window. If you like to take ad-hoc backup, click on Backup Now

14) We can see the progress of the backup job by clicking View All Jobs

15) Once backup jobs completed we can see the status of it in same backup window.

16) To test the restore I installed Acrobat Reader in this server and created test folder in desktop.

17) Now I am going to do a restore to an earlier day. To do that go to VM backup page, then click on Restore VM

18) In next window it asks which backup to restore. I am selecting back up from 3 days.

19) In next window it allows me to restore it as new VM or as disk. In here I am going to restore it as new VM

20) Once selection is done click on Restore to begin the process.

21) We also can check the status of the job using backup job window.

22) Once restore completed, I can see a new VM.

23) Once log in to the VM I can’t see the folder and application I installed, as expected.

This marks the end of this blog post. If you have any questions feel free to contact me on rebeladm@live.com also follow me on twitter @rebeladm to get updates about new blog posts.

Azure virtual machine scale sets – part 02 – Deploy Application to scale set

In my previous post Azure virtual machine scale sets – part 01, we learned what is VM scale set and how we can create a scale set in Azure. if you not read it yet please go through it before we start on this post as reset of the steps in this post depend on it https://www.rebeladmin.com/2018/04/azure-virtual-machine-scale-sets-part-01/

In this post we are going to deploy a sample application to scale set. In my previous post I have created a new scale set using,

New-AzureRmVmss `

-ResourceGroupName "rebelResourceGroup" `

-Location "canadacentral" `

-VMScaleSetName "rebelScaleSet" `

-VirtualNetworkName "rebelVnet" `

-SubnetName "rebelSubnet" `

-PublicIpAddressName "rebelPublicIPAddress" `

-LoadBalancerName "rebelLoadBalancer" `

-BackendPort "80" `

-VmSize "Standard_DS3_v2" `

-ImageName "Win2012Datacenter" `

-InstanceCount "4" `

-UpgradePolicy "Automatic"

In above it created an Azure Load balancer and TCP port 80 been load balanced among 4 instances. Under Azure Load Balancer | Inbound NAT rules it does have default rules for port 3389 and 5985. Those ports are mapped to custom TCP ports in order to give external access.

As an example, in above sample, I can RDP to instance0 using 52.237.8.186:50000. Likewise, we can connect to each instance and install apps if need. instead of that we can use centralized remote deployment, so the configuration is same across the instance.

In my config I didn’t use static ip address. You can find public ip address by running following azure PowerShell command,

Get-AzureRmPublicIpAddress -ResourceGroupName rebelResourceGroup | Select IpAddress

In order to push application, first need to prepare app config. in my demo I got a file in GitHub repository.

$customConfig = @{

"fileUris" = (,"https://raw.githubusercontent.com/rebeladm/rebeladm/master/simplewebapp.ps1");

"commandToExecute" = "powershell -ExecutionPolicy Unrestricted -File simplewebapp.ps1"

}

My config is very simple one. In PowerShell script I have following,

Add-WindowsFeature Web-Server

Set-Content -Path "C:\inetpub\wwwroot\Default.htm" -Value "Test webapp running on host $($env:computername) !"

It will install IIS and then create HTML file which will print text with the instance name.

As next step lets go and retrieve info about scale set,

$vmss = Get-AzureRmVmss `

-ResourceGroupName "rebelResourceGroup" `

-VMScaleSetName "rebelScaleSet"

After that, lets create custom script extension

$vmss = Add-AzureRmVmssExtension `

-VirtualMachineScaleSet $scaleconfig `

-Name "customScript" `

-Publisher "Microsoft.Compute" `

-Type "CustomScriptExtension" `

-TypeHandlerVersion 1.8 `

-Setting $customConfig

In above,

–Publisher specifies the name of the extension publisher. This can find using Get-AzureRmVMImagePublisher

–Type specify the extension type. we can use Get-AzureRmVMExtensionImageType find the extension type.

–TypeHandlerVersion specify the extension version. It can view using Get-AzureRmVMExtensionImage.

Next step of the configuration is to update scale set with the custom extension,

Update-AzureRmVmss `

-ResourceGroupName "rebelResourceGroup" `

-Name "rebelScaleSet" `

-VirtualMachineScaleSet $vmss

Now it is time to do testing. Let’s go to public IP address and see if it’s got the app we submit.

As I refresh we can see the instance number get updated. That means script is successfully running on scale set as expected.

This marks the end of this blog post. If you have any questions feel free to contact me on rebeladm@live.com also follow me on twitter @rebeladm to get updates about new blog posts.

Azure HighAvailability

Step-by-Step Guide: Application layer (OSI layer 7) load balancing with Azure Application Gateway (PowerShell Guide)

Step-by-Step Guide: How to setup an Azure load balancer? (PowerShell Guide)

Step-by-Step Guide: How to setup Azure load balancer?

Step-by-Step Guide to protect Azure VM using Azure Backup

Azure virtual machine scale sets – part 02 – Deploy Application to scale set

Recent Posts

About Rebeladmin.com

Azure HighAvailability

Footer

Recent Posts

About Rebeladmin.com

Social Media

Tags