[MUSIC]
>> Hello, everyone. In this episode of Business Series,
we'll be discussing on Networking & Security.
Before we start, let me introduce myself.
I am Sudheesh Narayanaswamy.
I work as a senior PM manager
with Azure Database for MySQL Server.
Now let's see what all we will cover in this session today.
We look how we can connect to Azure Database for
MySQL using public access and private access,
discuss on LS & SSL,
Enterprise-grade security, compliance and privacy.
We have two options to connect to Azure Database for MySQL Server.
One is a public access usually used for development workloads or
smaller workloads that you filter
the connections coming to the service using the firewall rules.
The other is the private access,
which actually is used by customers,
those who need high security and isolation.
In public access,
we use a public endpoint to connect to Azure Database for MySQL.
Whichever IP address is allowed in the firewall rules,
those clients can only connect to the service.
The service name is publicly resolvable
and the traffic goes through Internet pathways and it is
not flowing through the private network.
Now coming to private access,
the server is integrated with a VNet.
The subnet in which will be hosting the service on those
VNet needs to be
delegated to Microsoft.DBforMySQL/flexibleServers.
The name resolution is taken
care with the help of private DNS zones.
The network traffic is completely
over the private network and is highly isolated.
Now, let's check the VNet architecture in detail.
In this picture, you can see that
we have a Subnet 1 under VNet 1,
which is dedicated for Azure Database for MySQL Flexible Server.
You can host more than one Azure Database for
MySQL Flexible Server under the same delegated VNet.
If you're connecting from the same VNet,
you can directly connect it to the service.
If you're connecting from a different VNet,
you have to use VNet peering.
You can either use local peering or
global peering based on the location of your VNet.
For name resolution, we use
private DNS zones which gets created and
also the virtual link to link the private DNS zone to
the VNet in which your client application in.
You can use a network security group to control
the access to the Azure Database for MySQL Flexible Service VNet.
If you're connecting from on-premises,
then you can use either ExpressRoute or VPN to connect to
the VNet in which the Azure Database for MySQL Server is hosted.
Now let's see how we can create and connect to Azure Database for
MySQL Flexible Server with private access and public access.
In the Azure portal, once you give the project details,
the Basics page like the server name,
compute and SKU version, username,
password, etc., you will be taken to the Networking page.
In the Networking page, you will get an option either
to choose public or private access.
If you are using public access,
you would have to also give the firewall rule.
This firewall rule, where you can specify
a firewall rule name and IP address, to make sure that you allow
that specific IP address to connect to your server.
You can use this allow public access from any network service
from Azure to make sure that any services in Azure,
any clients which are running in
Azure can be allowed to connect to the server.
If you are using private access,
then you would have to specify the VNet which you have delegated,
or you can create a new virtual network and
delegate a subnet to Azure Database for MySQL Flexible Server.
You can also specify the private DNS zone,
or create a new private DNS zone for the server with the name
private.mysql.database.azure.com which will help
you to resolve the name of the server.
Once you give these details,
you can click "Next" and then do add "Review + Create" option.
Now this is how you can create
either a private access server or a public access server.
Once the server is created, on the Networking page,
you will see whether you have
enabled public access or private access.
If you have enabled public access,
if you want to add more firewall rules,
you can add it up here and
then saving that particular firewall rule.
Or if you want to delete any IP
addresses not to give access to the server,
that can also be done here.
In case of private access servers,
you will see this option as private access.
It will give you the details about
the VNet and the subnet in which it is hosted which is
a delegated subnet and then it will also talk about
the private DNS zone in which the host entry is recorded.
Now, if you go to the VNet,
you can find there are two subnet of which
one of the subnet is delegated to Azure Database
for MySQL Server and this is 172.129.1.0/24 subnet,
which has been allocated.
Now if you move to the private DNS zone
which is created for the server,
you can see that servername.private.mysql.database.azure.com,
you can see a host entry in that particular subnet,
where an IP address is allocated.
This IP address is not static.
It can change, so make sure that you use
the DNS name resolutions when connecting to the servers.
Azure Database for MySQL Server supports client connecting to
the service using secure socket layer with TLS encryption.
By default, the SSL is on and the TLS version configured is 1.2.
There are different configuration you can set for
the SSL and TLS from the Server Parameters page.
The options and how it will
behave is detailed in this table below.
Now let's check on the enterprise level security,
compliance, and privacy.
All data and backups are
encrypted with FIPS 140-2 cryptographic algorithm.
All backups are encrypted using AES 256-bit encryption.
For the data in motion,
we use SSL with TLS and for network security,
we can isolate and make
the traffic private using the VNet integration.
These are the resources which is there in
the description as well which details on
the networking and security principles with
Azure Database for MySQL Flexible Server.
Thank you. If you have any questions,
feel free to write back to us in the e-mail mentioned below.
[MUSIC]