in this video i go over two ip addresses in azure that you should know about
hello everyone this is Ciraltos and i'm travis in this video i'm going to go
over two ip addresses that are unique in
azure the wire server address and the azure
instance metadata service ip before we get started please subscribe
like and click the bell icon for updates of new content
if you subscribed thank you let's get started with what's referred to as the
wire server ip the ip address is 168.63.129.16
and enables communication between an azure vm and the azure service fabric
the first thing you may notice is that this is a public ip
it is but it's not accessible outside of azure microsoft needed a way to enable
communications between the azure service fabric and vms but they
couldn't use a non-routable 10 dot or 192.168 or 172.16 address
space because that could overlap with
customers own address space instead microsoft dedicated this public
ip as a special address that will not change all
communication between the wire server ip and the client is secure staying on the
azure network the wire server ip is used for
communication between azure and the vm agent the client requires outbound
communication to this ip address will report 80 443 and 32526
network security groups will not impact this traffic
but a client firewall will so if you enable a firewall on a client make sure
that traffic to this ip is open matter of
fact that gets to why you need to know about this ip
it's a publicly routable ip so it may be tempting to block traffic
to and from it on the client don't this ip needs to be available to the azure vm
for the agent to function properly and although all clients use the same ip
traffic is isolated between the one instance of the wire server ip and the
client the wire server ip also offers filtered
dns services it filters the dns request to only the
host names in your subscription matter of fact we can take a look at how
it handles things like private endpoints with nslookup let's
take a look at that now in this quick lab i'm going to show you
how the wire service ip can be used to resolve dns requests
specific to your domain i have a couple private endpoints for azure files
one of them is in my internal dns and the other isn't we can see this by
running ns lookup against the two private
endpoints let's start by going into nslookup
and you can see the address is set to my private dns server
i'm going to enter in the first hostname this one is in dns
and it found it and gave me back an ip address
let's enter in the second one and remember this one is not in my dns
here it's telling us it can't find that host i got a response from the first but
not the second that's because the first host name is in my internal dns server
if you want to see more about how i set these up take a look at my video on
private endpoints and smb file shares here's the dns server
and you can see privatelink.file.cor.net only has one host name in it for the cir
file test01 here we are back at the client
what i'm going to do next is change the dns server to the wire server ip address
i'll do that by typing in server and then the ip address
now all dns queries will go to that ip address
i'll enter in that first hostname again
there's the response just like before but now if i
enter in that second one
we got the private ip back for that as well
using the wire server ip address to resolve host names in azure
will give me back those private ip addresses even if i don't have them in
my internal dns server in theory you could set up a conditional
forwarder to send all private link.file.cor.windows.net
queries to the wire server ip but remember only azure vms have access to
that ip host outside of azure would not be able
to resolve the host name in that domain because they don't have
access to the wire server ip cool some other important things it does
if the service is behind a load balancer the health probe comes from the wire
server ip be sure not to block inbound traffic
from that ip address also it's the dhcp server for the azure
vm it's also used for vm agent heartbeat
messages for all these reasons it's important to
allow communication between the wire server ip and the azure
vm let's move on to the next ip the azure
instance metadata service the azure instance metadata service ip
address is 169.254.169.254. it's used to retrieve metadata about a
vm and the azure services it can be helpful
if you want to run an automation job and pull details about the azure
environment from inside the vm or if you need to pull information for
support like the wire server ip address it's not
available from outside the vm but instead of using a dedicated public
ip like wire service the azure instance metadata service or
imds as i'll call it going forward is a private non-routable 169 ip
the imds is a rest endpoint available only from inside the vm in addition to
using it to collect metadata it can also be useful to identify scheduled
maintenance events for example if microsoft predicts a host
failure and needs to move services there may be a scheduled maintenance
event indicated i say there may be because the amount of
time is dependent on the actual risk of the predicted outage but if some type
of maintenance is scheduled this is where you'd identify it
identifying scheduled maintenance is useful because you could redeploy the vm
on your own schedule and prevent an unplanned outage the best
way to understand is to see it in action let's take a look
now let's start this demo by taking a look
at the data we can view from the imds endpoint we'll start with
an overview first i'm going to use the
invoke rest method to get the information and assign it to
the metadata variable
now if i view the metadata variable we've got it but it's not really
formatted well we can view it as json which is formatted a little easier to
read by piping the data into the convert to
json command okay so that's better but not perfect
but this is a rest endpoint we can use postman to create
and view the api calls i just published a video on using
postman and rest apis with powershell you can take a look at that if you're
interested but i'm going to grab this url and also notice the metadata equals
true in the header so now i'm going to go into postman i'm
going to paste that url in so there the only key value pair it has
is the api version i'm going to go to headers and add the
metadata and true okay now let's send that
let's see what we get back
here it is here is the output from that rest api call
we can view things like the location the name
all sorts of information is available from this rest endpoint
i'm going to go back to code next and i have an example here of
if we just want to retrieve the os here i formatted the url
for the metadata instant compute and sku so we're drilling down into the specific
sku and if i run this
here it's displaying 2019 data center so now i have the sku information
another piece of useful information we can get
is any events that are going on that may interrupt services on this
vm so if i scroll down here i have a url that's getting all the
scheduled events so the first thing i'm going to do is
clear this out
and then i'll run this
and it shows no schedule events let's create one i'm going to go into the
portal and i'm going to restart this vm and if i just keep running this
within a minute or two it should show a schedule
event of a restart there it is so now we can see we have a
restart event
and eventually this machine is going to shut down and i won't be able to access
it but before that happens i'm going to run
that same query in postman i'll create a new project
enter the url and then go to the headers and we have to add that metadata equals
true
now we get a nicer format of that that is how you query the imds rest endpoint
to get information about the environment and schedule events
there you have it the wire server ip is for vm
agent communication dns and load balancing communication
while the imds is to gather metadata about your vm instance including
schedule events i hope you found this helpful if so
please subscribe like and all that good stuff
thanks for watching