- Coming up, we'll take a look
at your options for connecting your on-premises data center
and workloads to Azure.
We start by looking at how you can establish connectivity
with Azure Virtual Network to connect
your general workloads, including the protection
of your resources with Azure Firewall.
We'll then take things to the next level
with a look at establishing your own resilient
and secure private connection to Azure
from your main sites with ExpressRoute,
including new options with ExpressRoute Direct
at 100 gigabits which provides you fast transfer
speeds from your data center to the cloud.
ExpressRoute Global Reach, which allows you to leverage
Microsoft global network to connect your sites together,
and will show you how you can connect thousands
of branch offices by automating the configuration
and connectivity off your branch sites
at scale with the Azure Virtual WAN service.
The first step to any hybrid configuration
between your data center and Azure
is setting up network connection.
The Azure Virtual Network, or Vnet,
is your network in the cloud,
connecting all your cloud resources within a region
or between regions.
It can also become a bridge for hybrid connectivity
to connect you on-premises resources.
So let's start with how you can create
a virtual network in Azure.
So here I am going to search for Vnet.
Then within virtual network, I'll go ahead and create one.
I'll give it a name, address space,
assign a resource group, choose a location.
The subnet here needs to work
with the address space we just entered.
Along with options for DDoS protection,
service endpoints and firewall.
Next you need to set up a virtual network gateway.
Just search for Gateway and add one.
Now this can be over the public internet
or you can have a dedicated connection via ExpressRoute.
We'll leave the default standard.
Select the VNet we just created.
Create a new IP address, and create.
Once I have a basic network configured along with my gateway
I can then set a bidirectional communication
using a few connection options.
To do that I'll search for connections.
Create a connection.
I have a few options:
VNet to VNet, Site-to-site, or ExpressRoute.
Then I'll go ahead and select a resource group here.
I'll leave the other defaults and click OK.
Next I'll choose my virtual network gateway.
I'll select an appropriate ExpressRoute circuit
that I created in advance.
Give it a connection name.
Now once I create this connection
I'll have secure bidirectional communication
with my network.
Now, let's get back to the VNet we created earlier.
We'll create a network level firewall
for the virtual network we just created.
This will protect all of my Azure resources
like my virtual machines and even VM scale sets,
against unwanted inbound or outbound connections
in this network.
So let me show you how to set up a firewall.
I'll click on the Vnet.
I'll select firewall, create a firewall.
Add a new one.
Here I need to select a resource group.
Give it a name, select the VNet I built.
That will pull in the address space, then I'll create one.
That's going to take a moment to provision.
When it's complete within rules,
I can block or allow connections.
I'll block the TCP Protocol over port 443, and click on add.
Now, this is a stateful firewall as a service,
with built-in high availability
and unrestricted cloud scale.
As a network admin I can centrally manage
network connectivity using policies
across subscription and virtual networks.
In addition to the built in Azure Firewall
you can also use other network virtual appliances
available in the Azure marketplace.
Not as I was setting up
my virtual network gateway and connections,
I showed you where the options were
to use an ExpressRoute connection.
If you're new to ExpressRoute,
it lets you exchange your on-premises networks
into the Microsoft cloud over a private connection
facilitated by a connectivity provider.
You can use ExpressRoute to connect to
Microsoft Cloud Services and it's a great option
for a dedicated, low-latency connection between
your existing WAN and Microsoft.
We have a number of options for connectivity.
You can connect via your Telco or ISP,
your data center provider or with
the new ExpressRoute Direct.
You can have your own direct port inside
the Microsoft network, allowing up to
100 gigabits per second bandwidth.
ExpressRoute Direct is available in select locations.
Now you'll remember earlier that I configured ExpressRoute
for my virtual gateway and connection.
Here we are going to use the Direct option.
With ExpressRoute Direct, your connection
is consistently fast,
and to show what a direct connection can do,
here I have spun up 12 VM's and I am performing
450 gigabytes of data ingestion into Azure.
I'm letting the transfer happen in real time
and you'll see once it starts
the throughput ranges between six and nine
gigabytes per second per VM.
Where this gets even better is if you are a
multi-site environment with offices located
across regions or continents.
You can join them together using ExpressRoute Global Reach.
This allows you to link your ExpressRoutes circuits together
to make a private network between you on-premises sites.
This is particularly useful if you need to use
different providers.
For example you may have linked
all your main sites in the US,
but your service provider or Telco doesn't operate
in a few countries within Asia.
With ExpressRoute Global Reach
you can work with an alternative ExpressRoute provider
and Microsoft will connect your branches there
to the ones in the US using our global network
which spans 54 regions, more than 100,000 miles of fiber,
and 135 Edge sites.
Let's show this in action.
We'll start off in the Azure portal
and I've already created a virtual network
with all the connections I need.
Here I have two servers in two different locations,
and they are connected to their local networks.
I'm going to try and have each server ping the other server.
We'll start with the left server
pinging the server on the right,
and then right pinging the server on the left.
To get these two servers to talk to one another
we'll enable our Global Reach connectivity
and will do that by PowerShell.
I create the pairing connection, get the relevant circuits.
Add a global reach connection.
Then initialize our ExpressRoute connection.
And now, I'll run the script.
And you'll see that servers can talk to each other.
So in just a few seconds I have connected one
remote data center with my other remote data center.
One last thing I want to show you
is how you can also automate connections
from your smaller branch sites to the Azure global network.
This allows you to attach in some cases
thousands of branch offices to the cloud
without requiring advanced skills
to configure the connection at the branch site.
Think of Azure Virtual WAN as a hub
capable of connecting VNets and branch sites
or even mobile users, using the internet
using VPN or via a private connection with ExpressRoute.
And, you can monitor them all from the Azure portal.
Let's go ahead and create a virtual WAN resource.
Let's give it a name.
Let's pick a resource group.
In my case I'll create a new one.
Then let's click refresh, and there it is.
So now you have a Virtual WAN.
Next I'm going to walk you through a software solution
with Netfoundry as the WAN, but you can use your favorite
VPN device solution and you can check out our list
of Virtual WAN partners at the link shown.
First we'll register the Netfoundry controller as an app.
We'll click this resource groups access control.
Then we'll add a roll for the Netfoundry controller.
Let's pick the contributor access here.
Let's locate the Netfoundry app ID
and provide it the permission to access Azure Virtual WAN.
So now let's get into the Netfoundry management dashboard.
I'm clicking into my subscription.
We'll plug in all the details of the app we just created.
That includes our subscription ID,
app ID, tenant ID and key.
Then we locate our Azure Virtual WAN.
This enables our Netfoundry controller to ride into Azure.
Next you can select all your branches
and push that information into Azure.
So now I'm back in Azure.
When I hit refresh you will see our branches are flowing in.
From here we'll need to create a hub.
Let's put in the location.
Let's put in a private address space.
This should not overlap with your on-premises address space.
Now select all your branches,
and associate them with the hub we just created.
In my case I select the first branch,
select the hub and click confirm.
This fires off a back-end process
where the VPN gateways are created
and the configuration file is generated.
The Netfoundry controller periodically
pulls and download this configuration
and applies it to the branch sites
as a result of which the branches,
they come up connected.
Now you may have resources in Azure
that you want to connect to.
So let's go ahead and attach that resource VNET
to the hub.
Click on virtual network connection, add a connection.
Give it a name.
Pick your hub.
Pick the VNet that you want to connect to your hub,
then click OK.
So let's wrap it up, in your overview plate here,
as you can see, we see all our hubs including the
West US branch that we just connected.
So that was an overview of networking options in Azure
and recent updates to our ExpressRoute services.
You can get started by setting up an Azure trial
to configure a hybrid network and firewall.
ExpressRoute Direct and ExpressRoute Global Reach are
available today.
You can learn more at the link shown.
And finally if you're exploring setting up
internet-based connectivity, try Azure Virtual WAN,
and you can check to see supported partner appliance
devices at the link shown.
Thanks for watching.
(upbeat music)