if i said to you the words bandwidth
latency
throughput and connection what do you
think of
if you said networking you are right and
in this episode we're going to be
completing the planning of our
architecture design
from the az140 study guide by helping
you with your network capacity planning
for windows virtual desktop
[Applause]
i'm dean sefola and this is the azure
academy now network capacity is defined
as the amount of traffic that a network
can handle at any given time
so in the case of wvd there are multiple
networks that are involved so we're
going to need to vlan this discussion
there are three different networks and
two services that we're going to talk
about today in the area of wb capacity
so let's first just take 30 seconds so
we're all on the same page with how wvd
works
wvd uses something called reverse
connect
that allows your clients to connect over
the public internet to the wbd
service securely without the need of
public ip addresses in azure
everything starts with the client
authenticating to azure active directory
and that's great because that means all
the normal rules of azure ad
authentication apply including
conditional access and multi-factor
authentication
once your sign-in is complete you'll
receive an azure av
token just like any other workload and
then when you go to connect
to the service in your client that token
gets passed
to the web access role inside the wvd
service
which will then present you with a list
of remote applications and desktops that
you are allowed to use
when you click on one of those icons to
open that app or desktop
the token will be presented again to the
service at the wvd gateway
that will then make a certificate for
you and pass that onto your local system
and the gateway service will contact the
host pool find whatever session most
is currently available for that workload
and make an outbound
connection back to your client with the
connection complete your remote
application or desktop will open and you
can get to work
so let's talk about where the clients
come from and we have three networks to
consider
first is the internet then you may also
have a point-to-site network or a
client-based vpn the third kind of
network that's involved is your
on-premise network and that would be
connected to azure by a
virtual wan or an sd-wan solution
site-to-site
vpn or an azure express route now as i'm
sure you know the internet is the
world's
largest computer network but i'm sure
that you also know
that the laws of physics don't change
right so the further away
your client is from your destination the
longer it takes to get there if you had
a client
anywhere in the world and you wanted to
get to a website
say that's in the us and any one of
these clients that are anywhere here in
the world would have to travel over the
internet
all the networks and routers and
switches and all of that in order to
finally get to the destination of the
web server and then the data has to
travel
all the way back in order to present you
with the web page on your computer
and the further that you have to go
means the longer it takes and the more
chances that something could go wrong
so the issue in this case is not only
the distance but also the inefficiency
and unpredictability of the path because
you're going over the internet and
anything can happen anywhere in the
world that makes a problem for your
traffic
but also remember the more hops which is
the different locations your traffic has
to go
through to get to its destination means
that there's more
processing involved which adds latency
so what if we could make the path
shorter more direct or more efficient
that's why the wvd service is set up
with points of presence
all over the world so that no matter
where your client is
you should be relatively close to a wvd
entry point now once your data goes into
that entry point you're now
on the azure network which is much
smaller than the global
internet so routing can be much more
finely controlled it can be more
efficient and there's less hops to get
to your destination
and all of those connections over the
internet are secured and encrypted and
don't forget about the reverse
connection model
there is no inbound access into this
environment apart from
the wvd service now of course you've got
people who are working from home
or at a coffee shop or some kind of
remote office location somewhere
and they may be using a client based vpn
also known as a point
to site vpn and that's great and wvd
works in that scenario but there are
some things to think about
and first is latency a vpn is encrypted
which means the data comes into the
tunnel it has to be
encrypted comes out the other end it has
to be decrypted
so that adds extra processing and
therefore latency now it does also add
security so
that could be a good thing but remember
that reverse connect is encrypted as
well
makes that experience seem slower just
because of all of those
extra hops so finally there's the
corporate network scenario and that's
where you have
users in an office where they're
connected by a site-to-site vpn
or express route and this can also be a
good experience
depends where the users are and where
your session hosts are so let's assume
that you're a global company and you
have users that are in
france and your connection from your
local data centers
into azure is only in the us so the user
in france
get connected back to your data center
then from there
go up a vpn or express route into azure
and then they have to connect to their
virtual machines
and if those virtual machines are
located in france now they have to go
all the way back across the azure
backbone
to get to the france region so that they
can connect and you end up with this big
circle
worth of connectivity and that is
certainly not the most optimal path
so it would be much better if in france
they had a vpn or express route going
right to azure
where the vms are okay so laws of
physics don't change
the shortest path possible with the
least amount of hops gives you the most
predictable results
and we need to keep an eye on latency
just to finish this section out and to
be clear
there's nothing wrong with any of these
approaches internet client vpn
site to site vpn they will all work it's
just a matter of understanding the
requirements
and what the users are doing so now
let's switch gears slightly and talk
about
network performance and your workloads
and how we can solve
all the problems i just talked about now
how do we figure out latency
let's say you're in a work from home
scenario you have a bunch of users who
are in a bunch of different locations
all around the world and you want to
figure out where best to put
your session host so that they can have
the lowest latency experience
well down in the video description i
have a resources
section that has multiple links for
documentation that i'm going to talk
about that's going to address these
issues
and one of them down there is the wbd
experience estimator
when you go to the web page it's going
to calculate all of the different azure
regions
latency from where you are so you can
see for me
the east u.s regions are the closest so
they have the lowest latency
so from my perspective if my company is
located in east u.s
i'd want to put my session host in the
east u.s region
so my users can get the best experience
now that doesn't
mean that you can't use something like
west u.s even though the latency is
higher
you certainly can especially in a
disaster recovery scenario but now you
have to ask yourself the question
what are the requirements of dr do i
have to have the exact same performance
in dr as i do in prague well if so then
going east u.s to west u.s
may not provide the best experience
maybe you need to look at east u.s too
or
south-central u.s so keep that in mind
and remember these
are round trip numbers and just to
repeat myself the session hosts and the
users should be as close as possible
and while i'm at it i'll also throw in
there your domain controllers because
remember
authentication is the first piece of the
puzzle so if your domain controllers are
not in azure and they're somewhere on
the other side of the world you are
going to have a very long
log on time and probably a lot of your
other subsequent requests that have to
hit your domain controller for
authentication
are going to make everything slower so
keep all your resources as close as
possible
to keep latency low so let's dig a
little bit deeper and talk about the
kinds
of workloads and the network
requirements then i've got a link down
in the description for a network
guidelines doc and in there we've got a
table for
recommended bandwidth for certain
workload types
now we covered what those workload types
are and what they mean
in our last episode so if you missed
that go back and check that one out
and something to keep in mind with these
workload types is your display
resolution
and that just makes sense if you're
transmitting video data at 720p
you have far less network requirements
than if you're doing it at
4k but this also means for all of you
work from home veterans that
video conferencing will have a big
impact and that's why wvd supports
teams with av redirection but that's
another episode
so be sure that you're subscribed and
you've hit the notification bell so you
don't miss out
i've got another link in the video
description for bandwidth requirements
to help you break down
all the different kinds of data from
graphics data to heartbeats
file transfers and more and what's
really nice here is you don't really
have to worry about any of this
and manage it you just need to be aware
of it in your network planning
because rdp is a protocol that's
designed to adjust to these things
on the fly but thinking about the rdp
protocol
i have a second service connection type
to talk to you about and this is our
last thing for this episode
and that is an even more direct way to
connect to wvd by something called
rdp short path now as i'm recording this
video this feature
is in preview but if you remember all
the way back to episode 0
i said when we looked at the skill sheet
that commonly used preview features
may appear on the test now i do have a
whole video digging deep on rdp
short path that you can go check out up
here so we're just going to do a high
level now
if you think back to that reverse
connect that we talked about earlier
after your authentication process was
finished you got your list of
applications from the wvd service
and then you had to go through the
handing the token to the gateway to get
the session host to make an outbound
connection to your client
an rdp short path steps in right there
and allows you to connect
more directly and efficiently see the
rdp protocol
is tcp based whereas rdp short path is
udp based which runs much more
efficiently there's less handshaking
less chatter going on
and that really helps for this type of
traffic so when you are on a
local network that's that third type
that we talked about direct connect on
the corporate network site to site vpn
express route connection that kind of
thing
you'd be able to configure your host to
accept connections
directly from your client so the client
sitting in the office
would make a connection to wvd and they
would authenticate get their token get
their list of applications
they go to open an app their client
machine would connect
directly over your express route to the
session host over the udp protocol
and all of this is still secured with
certificates and tls
oh so we've got five videos three
networks and two connection models under
your belt and you should be able to
successfully design
a wbd architecture based on somebody's
requirements
so click here if you want to dive deeper
on rdp short path with me
or you can click down here for the next
episode in the az140 study guide
we're going to talk about designing our
user identities and profiles
thanks for joining me and i'll see you
in that next episode happy learning