Mod 3 - Understand Azure Networking Flashcards
VNet
Creates a block of IPs that can be specified to smaller subnets. Ex. West US region use 192.168.0.0/26»192.168.1.0/24
How many and which IPs does azure reserve?
Ex. 10.1.0.0/24» reserves .1-.3, first useable is .4
Can VNets have connectivity to another VNet by default?
VNets don’t have connectivity from one VNet to another even if in same region.
Can all VMs on different subnets in a VNet communicate to each other by default
By default all VMs on different subnets in a VNet can communicate to each other ex. Ping and has outbound internet access, doesn’t have inbound unless you setup network security group.
Service Endpoint
A virtual network service endpoint provides the identity of your virtual network to the Azure service. Once you enable service endpoints in your virtual network, you can add a virtual network rule to secure the Azure service resources to your virtual network
can deploy this to Give resource private IP addr on the VNet so other resources on the VNet can connect to it privately, not all resources can support this option ex. Two MS SQL servers need to be in the same region
Do PaaS Storage accounts gets FQDN by default
Yes, PaaS Storage accounts by default gets FQDN which resolves to Public IP, so VMs in a subnet connect outbound to public IP to connect to storage account. Not a good idea for security.
What field do you configure your VNet address block in?
- Address Space
How do you deploy a VNET in azure GUI
- Search for Virtual Networks in Azure Portal
- Click Create
a. Basics
i. Set Sub and RG field
ii. Set Name and region
b. IP Address
i. Set address space
ii. Add subnets
c. Publish
Will a VM default to Private or Public IP of VNET during setup
private IP of VNET
What year or newer VNETs use the new Resource Manager VNET deployment model?
2019 or newer. only older VNETs use classic mode
what is VNET Peering
Peering allows two virtual networks to connect directly to each other.
Network traffic between peered networks is private, and travels on the Microsoft backbone network, never entering the public internet
Why is VNET Peering useful?
Useful for setting up a quick connection to another VNET
Does Peering use VPN encryptions ex. IPSec
No, this is L2 traffic so uses MACsec, frames have encryption
How do you setup peering in azure gui
Go to VNET settings»Pick Peering setting»Add Peering»Set all options to Allow traffic between VNETS
Site to Site VPN
: encrypted logical tunnel that routes traffic privately between two networks with tech such as IPSEC. With azure can use these to connect on-prem hosts to VMs on azure cloud
Point to Site VPN
VPN connection that connects directly to remote GW
Why use P2S VPN
Used for remote users that travel and need VPN connection directly to azure cloud OR for a few on-prem users who need direct connection
what is VNET Gateway
Represents end-point remote firewall connects to
what subnet does VNET Gateway use
Uses it’s own Gateway subnet with a Public IP. On-Prem FW connects to Public IP of this GW
when is a Gateway Subnet created
Deployed when you create a VNET GW
Local Network Gateway
GW deployed in Azure and represents on-prem FW
how is Local Network Gateway used
VNET GW sees this and knows what is the remote peer to connect to. Builds a connection logically to local network GW which is on-prem FW. Specifies what the public IP it’s connecting to and the private subnets allowed to come in from the on-prem network
what are the three Requirements for Azure to establish S2S
- VNET GW
- Gateway Subnet
- Local Network Gateway
WHAT are two key things for VNET GW config
a. Need to configure S2S(site to site)/ IPSEC Parameters (HAGLE acronym) on GW
i. Hashing algorithm
ii. Authentication method(Pre shared key)
iii. Group( Diffe-Heilmann group)
iv. Lifetime
v. Encryption algorithm
b. Remote Peer NOT configured on VNET GW
What are the two example uses for Express Route
- Used for large companies
- Used for SLA’s that require extra security and speed
Is ExpressRoute cheap?
No, * Expensive
what is expressroute
Creates a direct connection to azure backbone infrastructure via an ISP with a dedicated circuit
can you use Azure DNS to buy a domain name
NO
what are the 5 benefits of azure DNS
- Reliability and performance
-uses anycast networking - Security
-uses RBAC, resource locking - Ease of Use
-can sue automation ex. az cli - Customizable virtual networks
-supports private DNS domains - Alias records
what is AzureDNS and how does it affect VMs
Service for a VNET that allows you set what DNS servers exist for the VNET. Any VM deployed in the VNET now will get directed to those DNS servers
