Technical Blog | REBELADMIN

Learn about Active Directory and Various Azure Services

Azure Virtual Machine

Encrypt existing Azure Managed Disks using Server-Side Encryption (SSE) and Customer Managed Keys (CMK)

In my previous blog post, I have explained what is Server-Side Encryption (SSE) for Azure Managed Disks. If you didn’t read it yet, please go ahead and read it using this link. In there I have created a new virtual machine with encrypted managed disks. But sometimes we may have to do the same for the existing Azure Managed Disks. In this blog post, I am going to demonstrate how we can encrypt an existing data disk (Azure Managed Disk) using SSE and CMK.

Prerequisite

Before we go ahead with configuration, we need to make sure the following prerequisites are in place.

Azure Key Vault with DisKEncryptionSet – I have covered the configuration steps for this in my previous blog post https://www.rebeladmin.com/2021/01/encrypt-azure-managed-disks-using-server-side-encryption-sse-and-customer-managed-keys-cmk/. Please go ahead and configure the Azure Key Vault before we proceed further.

Azure PowerShell – For the configuration process, I will be using PowerShell. Therefore, please make sure you have an Azure PowerShell module installed. More info about it can find under https://docs.microsoft.com/en-us/powershell/azure/install-az-ps?view=azps-3.8.0

Verify Existing Windows VM Configuration

For the demo, I have created a new Windows VM called REBEL01 in East US Azure region. It is running windows server 2019 data center edition. It is using Standard_DS1_v2 VM size. This VM has two disks. REBEL01_OSDisk is OS disk and REBEL01DataDisk1 is Data Disk.

Virtual Machine Disk Encryption with Platform managed keys

As we can see above, the data disk is encrypted using platform managed keys. This is the default setup for Azure managed disks. My plan is to encrypt this disk with Customer Managed Key (CMK). We can’t encrypt the existing OS disk using the same method.

Detach Managed Disk

We can’t change the encryption of a disk that is attached to a running VM. So, we need to detach the disk first. To do that we can use the following commands,

$VM = Get-AzVM -ResourceGroupName “REBELRG1” -Name “REBEL01”
Remove-AzVMDataDisk -VM $VM -Name “REBEL01DataDisk1”

Detach Azure Managed Disk

Then we need to update the VM config using

Update-AzVM -ResourceGroupName “REBELRG1” -VM $VM

Update Azure Virtual Machine Configuration [Read more…] about Encrypt existing Azure Managed Disks using Server-Side Encryption (SSE) and Customer Managed Keys (CMK)

How to Deploy an Azure VM to Availability Zone? (PowerShell Guide)

Azure Availability Zones offers high availability for data and applications. In an Azure region, there can be one or more data centers. Azure Availability Zone is made out of one or more datacentres in the same Azure region, which have independent power, hardware, networking, and cooling. All Zone redundant service will replicate data and application across Availability Zone for high resilience. Each Azure region contains a minimum of three Azure Availability Zones.
More Information about Azure Availability Zones are available on https://docs.microsoft.com/en-us/azure/availability-zones/az-overview

We also can deploy Azure Virtual Machines into Azure Availability Zone for high availability. In this demo, I am going to demonstrate how we can deploy Azure Windows Virtual Machine to Azure Availability Zone by using Azure PowerShell.
Before we start, please make sure you have an Azure PowerShell module installed. More info about it can find under https://docs.microsoft.com/en-us/powershell/azure/install-az-ps?view=azps-3.8.0

Create Resource Groups

As the first part of the configuration, I am going to create a new resource group. To do that,

Launch PowerShell console and connect to Azure using Connect-AzAccount

Then create a new resource group using,

New-AzResourceGroup -Name REBELRGEUS -Location “East US”

Setup Azure Resource Group

In the above, I am creating a resource group called REBELRGEUS in East US Azure region.

Create Azure VNet

The next step is to create a new virtual network under REBELRGEUS resource group.

$vmsubnet = New-AzVirtualNetworkSubnetConfig -Name vmsubnet -AddressPrefix “10.0.2.0/24”
New-AzVirtualNetwork -Name REBELVN1 -ResourceGroupName REBELRGEUS -Location “East US” -AddressPrefix “10.0.0.0/16” -Subnet $vmsubnet

Create Azure Virtual Network

In the above, REBELVN1 is the new virtual network name. It has 10.0.0.0/16 address space. It also has a new subnet 10.0.2.0/24 (vmsubnet) for virtual machines. [Read more…] about How to Deploy an Azure VM to Availability Zone? (PowerShell Guide)

Step-by-Step Guide: How to use Azure Bastion with VNet Peering? (Using Azure Portal)

In my previous blog post, I demonstrate how to setup Azure Bastion with Global VNet peering. This blog post can access using this link. In there I used Azure PowerShell for the configuration. Some of the readers asked if it’s possible to set up similar using Azure Portal. Therefore, I am writing this blog post to demonstrate how we can set up Azure Bastion with VNet peering by using the Azure Portal. The only difference in here is, instead of Global VNet peering, I am using VNet peering (with in Azure Region). This will also confirm that Azure Bastion works with Global VNet peering as well as VNet peering.
Demo Environment

The following diagram explains what we going to set up in this demo.

Demo Setup

Here we are going to create three resource groups in the same Azure region. Each resource group will have its own Azure virtual network. For the connectivity, we will be using the hub-and-spoke network model. EUSVnet1 & EUSVnet2 will be Spoke virtual networks and BASVnet1 will be the Hub virtual network. Both Spoke virtual networks will have VNet peering with Hub virtual network. We will enable Azure Bastion service on hub virtual network (BASVnet1) and try to connect to virtual machines hosted in Spoke virtual networks. I have summarized virtual network configuration as follows,

Resource Group Azure Virtual Network Address Space Azure Region
EUSRG1 EUSVnet1 10.15.0.0/16 East US
EUSRG2 EUSVnet2 10.75.0.0/16 East US
BASRG1 BASVnet1 10.2.0.0/16 East US

Create Resource Groups

As the first part of the configuration, I am going to create three new resource groups. To do that,

1. Log in to Azure Portal (https://portal.azure.com) as Global Administrator
2. Search for the Resource groups using the search function

Search for Azure Resource Groups

3. Then click on + Add

Add new Azure Resource Group Option

4. It will open up a new window. In the form type name for Resource group and select East US as Azure region. Then click on Review + create

Azure Resource Group Settings

5. Once the validation is completed, click on Create to complete the resource group setup.

Validate Azure Resource Group Configuration

6. Follow the same method and create EUSRG2 & BASRG1 Resource Groups.

Create Additional Azure Resource Groups [Read more…] about Step-by-Step Guide: How to use Azure Bastion with VNet Peering? (Using Azure Portal)

How to replicate Azure VM to a secondary Azure Region?

When it comes to Disaster recovery solutions, most of the time we select a different physical site as a backup/replication target. This is because if the primary site is down, we still have a copy of data safe on different site. We also can do the same with Azure VM. By using Azure Site Recovery Service, we can simply replicate existing Azure VM to a secondary Azure Region.

Let’s go ahead and see how we can do this.

For the configuration process, I will be using PowerShell as well as GUI. Therefore, please make sure you have an Azure PowerShell module installed. More info about it can find under https://docs.microsoft.com/en-us/powershell/azure/install-az-ps?view=azps-3.8.0

Create an Azure VM to use as Source

I like to begin the configuration process by creating a Test VM. To do that,
1. Launch PowerShell console and connect to Azure using Connect-AzAccount
2. Then create a new resource group using,

New-AzResourceGroup -Name REBELRG1 -Location “East US”

Azure resource group for Source Azure VM

In the above, REBELRG1 is the resource group name and its created-in East US Azure region.

3. The next step is to create a new virtual network under REBELRG1 resource group.

$vmsubnet = New-AzVirtualNetworkSubnetConfig -Name vmsubnet -AddressPrefix “10.0.2.0/24”
New-AzVirtualNetwork -Name REBELVN1 -ResourceGroupName REBELRG1 -Location “East US” -AddressPrefix “10.0.0.0/16” -Subnet $vmsubnet

Azure virtual network for source

In the above, REBELVN1 is the new virtual network name. It has 10.0.0.0/16 address space. It also has a new subnet 10.0.2.0/24 (vmsubnet) for virtual machines.

4. As the next step of the configuration, I am going to create a new virtual machine under REBELRG1 resource group. This will be used for testing purposes.

$mylogin = Get-Credential
New-AzVm -ResourceGroupName REBELRG1 -Name “REBELTVM01” -Location “East US” -VirtualNetworkName “REBELVN1” -SubnetName “vmsubnet” -addressprefix 10.0.2.0/24 -PublicIpAddressName “REBELVM01IP1” -OpenPorts 3389 -Image win2019datacenter -Size Standard_D2s_v3 -Credential $mylogin

Create Azure VM

In the above, I am creating a virtual machine called REBELTVM01 in East US Azure region. It is running windows server 2019 data center edition. I have specified it using -Image parameter. It also using Standard_D2s_v3 vm size. For networking, it uses REBELVN1 virtual network and subnet 10.0.2.0/24.

5. Then I log in to the VM and created a folder and a file to use later for testing.

New-Item -Path ‘C:\REBELTest’ -ItemType Directory
New-Item -Path ‘C:\REBELTest\Test1.txt’ -ItemType File

Create test files for Azure replication testing [Read more…] about How to replicate Azure VM to a secondary Azure Region?

Step-by-Step Guide: Create Azure Windows Virtual Machine from a Snapshot (PowerShell Guide)

Virtual Machine Snapshots are the quickest way to recover a virtual machine from a disaster. Snapshot is a copy of the virtual machines’ disk file at a given point of time. There are situations where we may need to get certain data out from snapshot without restoring a complete virtual machine. The best way to do that is to create a virtual machine from the snapshot and then retrieve the relevant data. The same method also can use to test application upgrades or risky changes without affecting production servers. In this demo, I am going to demonstrate how we can create an Azure windows virtual machine from a snapshot.

For the configuration process, I will be using PowerShell. Therefore, please make sure you have an Azure PowerShell module installed. More info about it available on this link.

As part of the configuration, I am going to do following,

1. Create a new resource group
2. Create a new virtual network
3. Create Azure windows virtual machine
4. Log in to the new virtual machine and create few test files
5. Create snapshot
6. Create another virtual machine using the snapshot
7. Log in to this new Azure windows virtual machine and verify it has the test files created in original VM.

Create new Azure windows virtual machine

Let’s start the configuration process by creating a new resource group.

1. Launch PowerShell console and connect to Azure using Connect-AzAccount as Global Administrator
2. Then create a new resource group using,

New-AzResourceGroup -Name REBELRG1 -Location “East US”

create new azure resource group

In the above, REBELRG1 is the resource group names and East US is the Azure region.

3. The next step is to create a new virtual network under REBELRG1 resource group.

$vmsubnet = New-AzVirtualNetworkSubnetConfig -Name vmsubnet -AddressPrefix “10.0.2.0/24”

New-AzVirtualNetwork -Name REBELVN1 -ResourceGroupName REBELRG1 -Location “East US” -AddressPrefix “10.0.0.0/16” -Subnet $vmsubnet

create new azure virtual network

In the above, REBELVN1 is the new virtual network name. It has 10.0.0.0/16 address space. It also has a new subnet 10.0.2.0/24 (vmsubnet) for virtual machines

4. As the next step of the configuration, I am going to create a new virtual machine under REBELRG1 resource group. This will be used for testing purposes.

$mylogin = Get-Credential

New-AzVm -ResourceGroupName REBELRG1 -Name “REBELTVM01” -Location “East US” -VirtualNetworkName “REBELVN1” -SubnetName “vmsubnet” -addressprefix 10.0.2.0/24 -PublicIpAddressName “REBELVM01IP1” -OpenPorts 3389 -Image win2019datacenter -Size Standard_D2s_v3 -Credential $mylogin

create new Azure windows virtual machine

In the above, I am creating a virtual machine called REBELTVM01 in East US Azure region. It is running windows server 2019 data center edition. I have specified it using -Image parameter. It also using Standard_D2s_v3 vm size. For networking, it uses REBELVN1 virtual network and subnet 10.0.2.0/24. [Read more…] about Step-by-Step Guide: Create Azure Windows Virtual Machine from a Snapshot (PowerShell Guide)