Post on 14-Feb-2017
transcript
Extending Your Premises to Microsoft Azure with Virtual Networks and ExpressRouteGanesh Srinivasan Jon OrmondAzure Networking Microsoft ITJai DesaiStorSimple
DCIM-B388
Virtual Networks and Connectivity
ExpressRoute
Microsoft IT and ExpressRoute
StorSimple and ExpressRoute
Agenda
Windows Azure hybrid offeringsCloud Customer Segment and workloads
Secure point-to-site connectivity
Virtual Network (Point-to-Site)
• Developers• POC Efforts• Small scale
deployments• Connect from
anywhereSecure site-to-site VPN connectivityVirtual Network (Site-to-Site)
• SMB, Enterprises• Connect to Azure
Compute• IaaS and PaaS workloads
Private site-to-site connectivity
ExpressRoute
• SMB & Enterprises• Mission critical workloads• Backup/DR, Media, HPC• Connect to all hardware
Virtual Network
<subnet X>
<subnet Y>
<subnet Z>
Virtual network Recap
DNS Server
Logical isolation with control over networkCreate subnets with your private IP addressesStable and persistent private IP addressesBring your own DNSUse Azure-provided DNSSecure VMs with input endpoint ACLs
Microsoft Azure
In-Region VNet to VNet
BackendVNet
Mid-TierVNet
FrontendVNetInternet
SecureCommunication
Microsoft Azure
Contoso US HQ Contoso East Asia
Connectivity between Virtual Networks
Multi-tier applications with strong isolation and secure cross-tier communicationVirtual networks may be in different subscriptions
Enables rich network topologies in the cloud
Multi-site VNet connectivityMultiple Site-to-Site connections
Multiple on-premises sites connect to same virtual network
Sites may be geographically dispersed
Connect up to 10 sites to a virtual network securely over IPsec
Connect to multiple
on-premises locations
Before
With multi-site Vnet Connectivity
VNet1US West
VNet2East Asia
One-to-oneconnection
VNet1US West
VNet2East Asia
Contoso NorthAm
HQ (10.0.0.0/16)Contoso NorthAm
HQ (10.0.0.0/16)Contoso East Asia
(10.3.0.0/16)
Cross-region VNet connectivityCross-region VNET connectivity to any Azure region
For HA and DR, customers create virtual networks in different Azure regionsScenario: SQL AlwaysOn sync to cross-region replicas
Connect to multiple on-premises
locations and to other VNets
Before
With multi-site and cross-region VNet to VNet
VNet1US West
VNet2East Asia
One-to-oneconnection
VNet1US West
VNet2East Asia
Contoso NorthAm
HQ (10.0.0.0/16)Contoso NorthAm
HQ (10.0.0.0/16)Contoso East Asia
(10.3.0.0/16)
Cross-subscription connectivityVirtual networks in different subscriptions can securely communicate using private IP addressesScenarios: Cross-division/dept. workload communication; B2B transactions in the cloud
Virtual Network VPN Ecosystem
ExpressRoute
Cloud on your WANAvoids risks from exposure to InternetAvoids complexity and added costsProvides lower latency, higher bandwidth and greater availability
Public Cloud
Private Netwo
rk
Customer DC
Customer site 1
Customer site 2
Public internet
Customers want Cloud on their networks
IPsec VPN over InternetGreater networking costs and higher latencyData traverses the Internet to reach public cloudLimited bandwidth
Public Cloud
Private Netwo
rk
Customer DC
Customer site 1
Customer site 2
Public internet
Security
Lower cost
Predictable performance
High throughput
What is ExpressRoute?
Connect your private network with Azure via secure, high-throughput, low latency connections bypassing the Internet
Azure
Private Networ
k
Customer DC
Customer site 1
Customer site 2
ExpressRoute
Enterprise workloads Dev/test lab BI/big data
Media Productivity apps
Storage, backup, and recovery
Hybrid apps
Virtual Network and ExpressRoute
Connect via an encrypted link over public internet
Peer at an ExpressRoute location, an Exchange Provider facility
Connection from WAN provided by Network Service Provider. Azure becomes another site on the customer’s WAN.
IPsec VPN over internet
Exchange provider
Network service provider
Customer DC
Virtual Network—Compute only.
ExpressRoute—Provides customer choice and includes access to
compute, storage, and other Azure services.
ExpressRoutepartner location
Customer site 1
Customer site 2
Customer site 3
WAN
Publicinternet
Publicinternet
PublicinternetCustomer site
Microsoft Azure
Microsoft Azure
Microsoft Azure
Exchange provider Network service provider scenario
Customer
Tiers/pricing
Customer already using co-location facility; or wants to meet Azure at Exchange Provider location for a simple point to point connection• Connect to Windows Azure directly through a virtual cross
connection• Higher flexibility• Control over routing• Place your hardware in the Exchange Provider’s datacenter• Throughput based tiers, data charges separate• Upto 10 GBps
Customer already getting managed WAN services (like MPLS VPN)• Connect to Windows Azure through VPN provider• Easy to onboard• Use your existing VPN to connect to Azure• Access from any site
• Throughput based tiers (with unlimited data)• Connection speeds of up to 1 GBps
ExpressRoute Flavors
ExpressRoutepartner location
Publicinternet
Customer site
Microsoft Azure
Customer site 1
Customer site 2
Customer site 3
WANPublic
internet
Microsoft Azure
ExpressRoute PartnersConnecting at an Exchange provider
Connecting via a Network service provider
ExpressRoutepartner location
Publicinternet
Customer site
Microsoft Azure
Customer site 1
Customer site 2
Customer site 3
WANPublic
internet
Microsoft Azure
ExpressRoute Bandwidth tiersExchange Provider ScnearioMonthly fee with included outbound data transfer.Unlimited inbound data transfer included
200 Mbps+
3TB/month
500 Mbps+
7.5TB /month
1 Gbps+
15TB /month
10 Gbps+
250TB /month
99.9% SLA
DedicatedCircuit uptime
Available Today• Washington D.C. • Silicon Valley, CA• London, UK
Coming Soon...• Additional sites in Europe,
Asia, and North America
Locations:
Global datacenters
ExpressRoute locations today
ExpressRoute locations
Customer ConnectivityAzurePublic services
Azure Compute
Azure Edge
Connectivity Provider
Infrastructure
Customer’s network
Customer’s dedicated connection
Traffic to public IP addresses in Windows AzureTraffic to Virtual Networks in Windows Azure
Public and Private peering
Contoso (10.0.0.0/16)
Exchange
AD/DNS
IIS ServersSQL Farm Proxy/Internet edge
Monitoring
ExpressRoute Circuit Microso
ft Azure
Storage SQL Websites
Direct internet trafficCross PremisesInternet bound
Azure service access
Contoso virtual networks/VMs
Azure public services
AD/DNS
Internet
Routing policy is customerchoice
2. Customer requests
connectivity through
Exchange Provider
1. Customer signs up for ExpressRoute
3. Customer gets s-key
Customer experience: Exchange provider workflow
Customer
Microsoft Azure
Exchange provider
4. Customer passes s-key and other details5. Customer configures
routing6. Customer links services
Customer signs up for ExpressRoute
Signs up for a Windows Azure subscriptionSigns up for ExpressRoute service
Customer requests connectivity through Exchange provider
Customer provided with list of connectivity providers, locations, and supported bandwidthsCustomer selects best option and makes a requestCustomer receives a service key (s-key) in response to the request
Customer configures routing between their premises and Azure
Customer sets up 2 pairs of BGP sessions (one for public peering and one for private peering)Customer specifies IP subnets for BGP sessions, AS number and MD5 hash (optional)
Customer links servicesLinks virtual networks to private peering BGP sessionsConnectivity to public peering services and NAT enabled as soon as BGP session has been configured
Configuration completeCustomer connects to all Azure services via ExpressRoute circuit
Exchange provider enables connection for customer
Customer passes service key (s-key) and other details to Exchange Provider necessary to facilitate peeringExchange Provider enables a pair of virtual crossconnects for customers per circuitExchange Provider sends confirmation to Microsoft (programmatically) and other customers
WAN
2. Customer requests
connectivity through Network
Service Provider
1. Customer signs up for ExpressRoute
3. Customer gets s-key
IXP
Customer experience: network service provider workflow
Customer
MicrosoftMicrosoft Azure
Network Service Provider
4. Customer passes s-key and other details5. Customer links services
Customer signs up for ExpressRoute
Signs up for a Windows Azure subscriptionSigns up for ExpressRoute service
Customer requests connectivity through NSP
Customer provided with list of connectivity providers, locations, and supported bandwidthsCustomer selects best option and makes a requestCustomer receives a service key (s-key) in response to the request
Customer links servicesLinks virtual networks to private peering
BGP sessionConnectivity to public peering services and NAT enabled as soon as BGP session has been configured
Configuration completeCustomer connects to all Azure services via ExpressRoute circuit from WAN
NSP enables connection for customer
Customer passes on service key (s-key) to NSP along with other details necessary to facilitate peering and routingNSP enables connectivity and configures routes for both public and private peering sessionsNSP sends confirmation to Microsoft (programmatically) and customer
ExpressRoute Demo
ExpressRoute and SharePoint DRActive DirectorySharePoint
WEB
Equinix – Silicon Valley
Active Directory
SharePoint App
F5 BIG IP Load Balancer
SharePoint App
SQL Witness
SQL Primary
SharePoint WEB
SQL Always On
AVSET: SPWEB AVSET: SPAPP SQL Replica AVSET: AD
ExpressRoute Circuit (1Gps)
Sync Commit for Auto-Failover
Domain Controller
Microsoft Azure - West US
ExpressRoute and Microsoft ITJon OrmondDirector MSIT NetworkingMicrosoft IT
100k+ Users on Office 365 Exchange110+
Modern Apps Delivered
300k System Center managed devices
180k+Users
40kMSIT Servers in On-Prem Data Centers
The Microsoft IT Environment
513Site locations (113 countries)
<10%LOB apps run in PaaS today
1m+Devices hit the Microsoft network
210kSharePoint Sites in the Cloud
1,300+LOB apps managed by IT
4.5m Remote connections/ month
75kMSFT employees on Yammer
80%LOB apps in Azure in 5 years
153kManaged Windows 8.1 Systems
200k+Unique devices connect to wireless/day
Enterprise First & Best Program
95%In the Cloud, WAP and Azure, in 5 years
21,470Wireless Access Points
2,302Routers
22gbSustained Internet Traffic
7,241Ethernet Switches
12,055Total Managed Network Devices
939SAN Switches
288Firewalls
131Load Balancers
>24M ft2Wireless Coverage
519Wireless Controllers
49,152Strands of Dark Fiber (Puget Sound Campus)
600Managed Circuits
9IT Datacenters
Network Infrastructure Services
Demo: Bridging Microsoft CorpNet and Azure using ExpressRouteJon Ormond
StorSimple and ExpressRouteJai DesaiWW TSP – StorSimpleMicrosoft Corporation
Storage Challenges Are BroadUntested Disaster Recovery
Primary Storage
Disk-Based Backup Storage
Tape Infrastructure and Management
Archival Storage
Replicated Storage for
DR
Offsite Facility for
Georesilience
Data Management Complexity
Backup IssuesData Growth and Footprint
Storage Today = Complex & Expensive
Equipment Sprawl
StorSimple Hybrid Cloud Storage Solution
Thin, ReducedSnapshots Cloud Snapshots Recover from Cloud
to any DCAutomated
Cloud-as-a-TierEnterprise
SAN Storage
Primary Storage
Disk-based Backup Storage
Tape Infrastructure & Management
Archival Storage
Replicated Storage for DR
Offsite Facility for Geo-resilience
Reduce storage TCO by 60-80%
Microsoft Azure
Cust
omer
DC
/ Exp
ress
Rout
e Pa
rtne
r Lo
cati
onStorSimple Overview
StorSimple connects Windows, Hyper-V and VMware servers to Azure Storage in minutes with no application modificationStorSimple Benefits• Consolidates primary, archive, backup, DR
thru seamless integration with Microsoft Azure
• Integrated data management and protection through tiering, de-dupe/compression, cloud snapshots
• DR testing and revolutionary performance for DR
Application Servers
Inactive Primary Data + Backup + Archive + DR
Speed of SSD/SAS
Warm data on SAS Local Tier
Most Active Data on SSD
StorSimple
Azure Public Storage
Microsoft Azure
LAN connection
ISP or ExpressRoute
ExpressRoute to Microsoft Azure• Predictable network performance (reliability)• High throughput (up to 10G)• Low cost of connectivity
Elastic, On-demand, Cost-effective
StorSimple E2E ArchitecturePublic
internet
Microsoft Azure
Azure Compute
Connectivity Provider
Infrastructure
Azure Edge
Dedicated connection
(Up to 10Gbps)
Traffic to public IP addresses in Microsoft Azure
Traffic to Virtual Networks in Microsoft Azure
ExpressRoute partner location
(Equinix)Customer
data center
iSCSI
Switch
VMs Eth NIC
Physical or Virtual servers
SwitchHost-
side NIC
Azure NIC
Virtual Router
Virtual Router
/ WAN
Public BLOB Storage
Note: MPIO configuration not shown. StorSimple supports MPIO
Demo: StorSimple in action
Microsoft AzureExpressRoute
StorSimple Use Case – File Shares/Archives
All applications
NAS
SAN
Primary Storage
Disk-based Backup Storage
Tape Infrastructure & Management
Archival Storage
Offsite Facility for Geo-resilience
Tier 1, Tier 2, Tier 3 data
• Primary storage & Cloud-as-a-tier• Integrated data protection• Automatic archiving• Disaster recovery• Cloud economics
FC/iSCSI
iSCSI
Applications using Tier 1
data
Tier 1 data
Tier 2 / Tier 3 data
Primary + Backup + Archive + DR
Existing and New Colocation Customers
Applications using Tier 2/ Tier 3 dataEx
pres
sRou
te
Part
ner
Loca
tion
Expr
essR
oute
Pa
rtne
r Lo
cati
on
StorSimple Use Case – Azure Compute
Microsoft Azure
Public BLOB Storage
Customer Data Center 1
Customer-owned
StorSimple
ExpressRoute Partner Location Equinix
ExpressRoute
Internet or ExpressRoute
Azure Compute
Virtual network
Customer Data Center 2
Internet or ExpressRoute
Deployment Scenarios• File shares• Collaboration
Public peering
Private peering
StorSimple Use Case – Disaster Recovery
Application Servers
StorSimple
Customer Data Center 1
Microsoft Azure
Public BLOB Storage
Customer Data Center 2
Customer DC
Disaster
ExpressRoute
Customer-owned StorSimple
ExpressRoute Partner Location Equinix
Internet or ExpressRoute 1. Data backup
(protection) using StorSimple cloud snapshots
Azure Compute
Virtual network
3. Customer spins up app in Azure VM
2. DR using StorSimple
4. Azure VM uses StorSimple for data storage
Internet or ExpressRoute
5. Customer productivity restored
Useful ContactsExpressRoute Sales: ExpressRouteSales@microsoft.com StorSimple: storagesales@microsoft.com
DocumentationExpressRoute
Azure ExpressRoute overviewAzure ExpressRoute technical overviewAzure ExpressRoute FAQsAzure ExpressRoute API reference for customersAzure PowerShell cmdlet reference for customers
Case Study: MSIT Case studyStorSimple: http://microsoft.com/storsimple
Call To Action
What’s new in Windows Azure IaaSWhat’s new in Windows Azure NetworkingBuilding highly available and scalable applications in Windows AzureExtending your premises to Windows Azure with Virtual Networks and ExpressRouteExpressRoute: Connecting private and public clouds through Exchange ProvidersExpressRoute: Connecting private and public clouds through WAN providersSecurity and Windows Azure IaaSRunning your Dev/Test in Windows AzurePublic Cloud Security: Surviving in a Hostile Multitenant Environment Disaster Recovery and Windows Azure IaaSIaaS: Hosting a Microsoft SharePoint 2013 Farm on Windows AzureOracle in Windows Azure
Related Sessions
Come Visit Us in the Microsoft Solutions Experience!Look for Datacenter and Infrastructure Management
TechExpo Level 1 Hall CD
For More InformationWindows Server 2012 R2http://technet.microsoft.com/en-US/evalcenter/dn205286
Windows Server
Microsoft Azure
Microsoft Azurehttp://azure.microsoft.com/en-us/
System Center
System Center 2012 R2http://technet.microsoft.com/en-US/evalcenter/dn205295
Azure Pack Azure Packhttp://www.microsoft.com/en-us/server-cloud/products/windows-azure-pack
ResourcesLearning
Microsoft Certification & Training Resourceswww.microsoft.com/learning
msdnResources for Developers
http://microsoft.com/msdn
TechNetResources for IT Professionals
http://microsoft.com/technet
Sessions on Demandhttp://channel9.msdn.com/Events/TechEd
Complete an evaluation and enter to win!
Evaluate this session
Scan this QR code to evaluate this session.
© 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.