>> Well, hi everybody.
My name is Daniel Gicklhorn,
I'm a Product Director
in the global networking team here in Azure.
In this session today,
I'm going to take you backstage with Azure Front Door
and show you how we use the set of global vantage points
that Front Doors deployed act on
Microsoft's global network to self-heal and optimize
a set of user experiences for services
that are using the Front Door platform.
I'm going to get started by setting some context about
Front Door in general before I take you behind the scenes,
just so that you understand a little bit more about the surface.
To get started, Front Door is a versatile service
that helps improve the security,
reliability, and performance of an application.
It is deployed across our global backbone
to about 180 edge locations around the world.
It's placed strategically about 30 milliseconds away
from end users to best optimize the user performance.
Connecting through, from end users
and user devices out on the Internet,
through the edge of our network
and down into Azure where your applications are running.
Front Door plays a really key role
in Cloud Architectures by serving
a perimeter security role to control access to an application
and protect against constant known threats.
It serves as a global load balancer that can help you
bake reliability into your application and fail over,
if in case you have some regional failure
and it provides content and application acceleration
to improve the performance of either content
you're delivering to websites or any kind of applications
that are HTTP-based that you're running on Azure.
Front Door is not a new service.
We've been developing it for the last eight years
and now about 80 percent of Microsoft SaaS services
that you're probably also using today,
run on Front Door, behind the scenes.
It's a platform that we're developing very quickly
and we're expanding to new locations around the world.
We've recently deployed quite a bit in Africa,
including in Morocco.
We're deploying about one new Edge site per week on average
to expand this global footprint to even more locations.
Front Door works by having a set of global advantage points,
meaning deployed in metros close to end users.
It's connected to our global Datacenters
via Microsoft Controlled Fiber.
This gives us a reliable path between our Edge
and local metros where devices sit, and our Datacenters.
Front Door really serves as the bridge at those sites between
end users devices and the application sitting on Azure.
Front Door uses Anycast technology
to drag traffic into the closest Edge site,
meaning it localizes it to the closest location.
Then it can see the full path
and end from that Edge site down to the Datacenter,
so when it serves as a global load balancer
it can make decisions about what's the best,
both reliability and performance wise location
or backend for it to route traffic to.
It can determine if there's some application failure all the way
through the infrastructure from the edge down to the application.
If it does detect an issue,
it can start to route traffic around those issues
and it can help an application auto-heal.
If your deployed in multiple regions,
then it can help you fail over across those very quickly.
The way it does this,
it uses HTTP instead of DNS.
Effectively it is able to make decisions much quicker.
DNS has this challenge where due to the fact
that it relies on wait times are TTLs to fail over,
it can often take a long time
to actually fail over across different backends.
In particular, this is worst with enterprise and mobile networks.
What I'm showing on the screen is an example of this,
where it took about an hour to fail over 95 percent of the users
for this application after an incident.
That means a lot in terms of the user experience that customers
get when delivering their application and how a service behaves,
performanly and reliability during outages or during fail overs.
It does this because as I said,
it's an HTTP service and it doesn't change
the client IP when it fails over.
It instead just makes
a routing decision to move traffic across backends.
This can really help building individual applications.
Behind that is a complex global system that Front Door sits upon.
What I talked about so far is really
the reliability that can help at the app level,
going behind the scenes.
Apart, that's not seen as well is
how Front Door really heals and end,
which includes the portion of Front Doors application
that controls and manages the connectivity between
end users devices out of the Internet and Front Door itself.
These are things that are generally
outside the Microsoft network and more difficult to control.
It starts with, as I mentioned,
Anycast that helps us auto-heal.
Connectivity coming into Azure
and make sure that we can route around
connectivity issues that happen out
on the internet quickly when possible.
But it has another trick up its sleeve,
where it is able to actually see this path
between end users devices and Azure itself.
It's able to act to mitigate
even partial failures or great failures across that path.
I'm going to get a little bit deeper into that.
The system we use for this is called Map of the Internet.
It's deployed in fact,
in many Microsoft products that you may be using today.
Office Windows, others.
It is a service that collects information
about network telemetry and monitors
global internet performance
and user experience when it comes to the Internet
or network connectivity across hundreds of millions
of devices in real-time.
It's connected to our global when and in the case of degradation,
it is able to make decisions based on
what expected client performance should be.
It can disambiguate between wired
and wireless connections and networks.
It can determine whether an issue is sustained or transient.
It can make decisions to fail traffic over,
across different paths if it has them available.
It takes this data.
What you're seeing on the screen is in fact a map of one day.
Every green dot is a sample data point that we plotted,
but one day of users sending information into the system.
It's done in a privacy centric way and very carefully.
But provides us a really clear view of
how do we deliver
the most reliable performance services on the internet,
and how do we take applications
that are running on Front Door
and make them more performant and reliable.
This data comes in, it's turned into a set of signals.
We group all of these users by their geographic location
and the infrastructure that they use to connect to Microsoft,
either the networks, ISPs and things on the internet.
That data then goes through
a set of machine-learning algorithms
that process that data
and decide if there's an alternative path available,
can we take it?
Based on that, our network makes
automated routing decisions to move traffic around,
degradation when it can.
That provides a level of auto-healing for us
so that in the case of these sorts of issues,
we can effectively route around
even partial failures out on the Internet,
which happen incredibly frequently.
In addition to large-scale internet how ditches
which happen quite frequently as well,
when you start to operate with services
that look at every geography across the globe.
That's the Map of the Internet.
It's something we've been developing
alongside Front Door for a while,
and it's something that if you're using the Front Door platform,
you don't necessarily get to see up front
because it's doing it behind the scenes
to make your application experience better.
What I'm going to talk about next is
how do you use a similar service
or part of the Map of the Internet service
for your own applications to make decisions leveraging
the technology that we've built here just with your own data?
Let's pretend to just start,
that you're a operating a service
that has users in many geographies in a given region.
You have users that are distributed across a wide area,
some on desktop devices,
some on mobile devices,
and you're trying to understand
the difference between those users.
Let's pretend you get an email
from your leadership that says, hey,
I want to understand the difference in performance
when I make some network decision
or something that will change the performance
of web requests going to one endpoint or another,
say you're deciding on using new security services
or you're trying to make
a decision going from On-Prem to Cloud,
what are the changes in performance?
Internet Analyzer is a service that we've provided.
You can access it through the Azure marketplace.
Effectively, all you have to do to use it is sign up.
It'll give you a link that you embed in your web experience.
It is limited to web experiences today.
But once you've done that,
you deploy a small image to the two different web endpoints
or experiences that you have,
and that way we can basically pull that image as a test object.
Effectively, the Internet Analyzer service moves
with views of your web page,
distributes that JavaScript to your end users,
and then runs a series of tests
validating the performance between various different endpoints.
That then gives us information to share with you
and we move it into a central location
where you can then consume it yourself.
What you get is a set of scorecards
that help you make decisions
both in terms of monitoring behavior over time,
as well as information about the differences
between effectively AB endpoints in your test.
This is something that we use internally to make decisions
and part of the Map of the Internet service
itself as we start to look at changes in the network.
But it's something that we've exposed to you
because we know that reliability performance,
platform management is really key.
It's something that you don't have to look at
just at a global scope,
but you can actually drill down and access it at
a regional scope as well or be able to split it by country.
That's a quick look into
the Azure Front Door service and Map of the Internet
and how it helps behind the scenes
to improve the reliability of services
that are using our Cloud products like Front Door.
Thank you for your time.
There's a few links on the screen right now
that'll help you get more information.
Thanks for taking the time with me.
>> Hey Daniel, this stuff is super interesting.
We have a bunch of questions in chat.
I'm wondering if you could stick around
so we could ask you for a good five minutes,
maybe even more if you're up for it.
>> Absolutely.
>> Okay. The first question I want to ask
based on the things that have been
submitted to us is, somebody asked,
and I'm curious about this too,
when you say that Azure Front Door helps us route around outages,
what outages are we talking about?
What do we actually handle?
>> Yeah, that's a great question, David.
There have been many different types of infrastructure outages
that Map of the Internet has helped us route around in the past.
Everything from fibers being dragged off the sea floor
to the Super Bowl or large-scale sporting events
that congest the Internet
and cause Internet service providers to show
degradation to Microsoft itself
having regional issues and things like that
that allow us to detect those
and make decisions quickly to mitigate.
>> Okay, cool.
Well, there's a follow-up product question I want to ask,
somebody is asking, thank you very much
for your question [inaudible],
is Azure Front Door like other CDNs?
Can it be used like other CDNs
like some of our competitors
like Akamai and other people
like that who do CDN stuff?
>> Yeah. Also a great question.
Yeah. Front Door is itself a CDN.
It's something where that we grew out of
Microsoft's Enterprise routes
and so it is something that from
a CDN competency perspective is the place where we started.
It is a general purpose platform,
you can use it like other CDNs.
But it's something that we're continuing to develop on,
really focused on Cloud-first scenarios
and Cloud-native access agility and management,
something that we will build on over the next few years as well.
>> Cool. Okay. To go a little slightly more technical,
Dishon was asking, where do we find latency benchmarks
for Front Door if they want to do that?
I wonder if this has to do with the Internet
and Internet Analyzer stuff that you're talking about as well.
>> Yeah. That's something that we do have coming soon.
There are a couple of sources out there
that have done latency benchmarks independently.
We're currently working with a couple of different providers
as our new version of the products,
Front Door standard and premium come out
early next year to provide
more standardized public latency benchmarking.
>> Cool. By the way, those little bling noises you hear,
because I get them too, are people asking questions.
We're going to do our best to get as many of
the questions as we can during this time
before we have to move over to our next session.
Let's do some more questions.
Here's a really fun one from Andrea.
What clients are sending the telemetry for Map of the Internet?
Where are we getting that data from?
>> Yeah. Also great a question.
There are a combination of different,
basically rich and thin client experiences.
It's deployed in Windows builds that are more recent.
It's deployed in Office,
but also in a collection of web experiences.
The diversity of different types of clients
that we have sending us information,
again, in a very privacy centric way,
gives us the ability to see
very basic web experience telemetry all the way
up through what you'd be experiencing connecting through say,
an Outlook or a desktop-based application in Office.
>> I know that I'm excited the fact that we can take all that data
and with Internet gone Analyzer
and with just the routing functionality,
use it for good.
It's cool to collect data,
but it's even cooler to actually use it
for people's best purposes.
More questions are coming in,
but we're going to have to wrap very soon.
I guess the next question that I see here
and then maybe we'll wrap
and we'll start moving towards
the next session is one around expansion.
You had said something
about the fact that we're expanding the network,
the points of presence.
Can you say a little bit more about that?
I didn't remember the exact start you gave.
>> Yeah. Right now we're expanding in about one new site per week.
Sometimes those are an existing metros for reliability.
Sometimes there are new metros.
We've gone to a lot of new geographies in the last 18 months.
We continue to expand.
Part of the benefit of the Map of the Internet service gives us
visibility into where we should expand to improve user experience.
It is a place we're making lots of investments.
If you saw the map that I shared on the second slide,
there are a lot of places in the globe
and still don't have little white dots,
and as we expand to meet more users where they are,
we will continue to move both our CDN or Front Door locations,
as well as our global network into lots of new metros over time.
>> Awesome.
Well, we got a bunch more questions and they're in the chat.
If you have a moment, Daniel,
really appreciate if you would drop in the chat and answer.
I know you've been on camera,
so it's hard to do both at the same time.
Thank you so much for this behind the scenes at this stuff.
With that, I think we can say thank you very much for reliability
and now we get to move on
to another pillar of the Well-Architected Framework.