>> Hi. This is Steve Michelotti
of the Azure Government Engineering team.
Today, I'm joined by
Joseph Bloom of Microsoft Business Productivity,
as well as Paul Fisher of
the Microsoft Modern App Solution Center.
Today we're going to be talking about
secure development environment on Azure Government,
and this is part one of
a two-part video series on this topic.
So, welcome gentlemen.
So, why don't we start out by just giving
me a brief overview of what
are we talking about here today and why would
we perform development in this way?
>> Sure, Steve. So, the advantages that everything can be
secured using VPN and
still be put in Microsoft Azure Government,
including all of your source code as well as VSTS.
>> Okay, sounds good.
So, we already have Azure Governments,
so we have a higher compliance environment,
then we have to do our development.
Okay. So, tell me a little bit more.
Well, how are we going to approach this?
>> Well, additionally we're going to talk
about how we're going to set
up a development environment,
taking into account that many efforts on MAG also
have a corresponding effort on
networks that are not Internet-connected.
So, we're going to talk about an
automated testing realm where we
can put the code together in MAG,
automatically run unit and integration tests and
then bring the code over to disconnected environment,
and how we would set that up to have
automated builds within MAG.
>> Okay. So, I heard you mentioned unit tests,
integration tests,
sometimes maybe people might refer a secondary tests.
Tell me a little bit more about
that. What do you mean by that?
>> So, one of the things that we're going to
actually show you is how to use
Docker images as part
of our integration tests that you can spin up really,
really quick and it turned out really, really quick.
But you want to make sure, so,
we're basically going to be using
Microsoft Azure Government as
our development environment,
but that's not necessarily your target environments.
So, once we spin up the containers do all the testing,
you're kind of want to make sure you test
everything on your target environment once you're done,
just to make sure everything runs the way it should.
>> Okay.
So, when we're talking about a development environment,
not only are we talking about
developer workstations but also
setting up the builds as you guys have said.
>> Everything.
>> All right. That makes sense.
So, what's the first step?
>> So, you want to start out
by making sure you
understand what your requirements are going to be, okay?
That means how many boxes are we going to have?
How many developers are we going to have?
Because not only does it depend on space but bandwidth.
Bandwidth is going to be very, very important.
Now, we mentioned we're going to use point-to-site VPN,
but you could also use ExpressRoute or site-to-site.
Those are two other great ways to go.
Of course, ExpressRoute, a little more expensive,
dedicated communications provider, dedicated hardware,
but more reliable, doesn't use the public Internet.
Of course, site-to-site, similar,
over the public Internet,
but dedicated hardware needed with
a public IP and no NAT involved there.
But when you want to do your development from almost
anywhere and you want to
be able to get to your Azure resources,
which is what most developers want to do,
point-to-site is absolutely the right way to go.
It's easy, it's quick and it works beautifully.
>> That's great.
>> Additionally, you can actually give each developer
their own certificate to login into the VPN.
So, if a developer should leave the team,
you can then remove that certificate,
cutting them off from access
to Azure resources very quickly.
>> Absolutely.
>> I see. Okay. So, extra secure
environment for development. Okay. Makes sense.
>> So for small teams,
and we're going to set up our demo to
be more of a 10-person developer team,
maybe 20 machines in Azure, right?
The VPN will actually take
128 different users which is great,
but we're also going to have to talk
about throughput as we get into
the demo because depending on how many people you
actually have will depend on
what size gateway you want to choose.
So we can talk about that a little later.
>> All right. It sounds good.
>> But like Paul said, if somebody
joins the team or somebody leaves the team,
it's easy to set up a new certificate.
You give them a certificate, you give them
the software to hit the VPN and they're off and running,
or by the same token if they're
leaving, they're instantly removed.
>> Okay. So, if I get this straight,
we're giving them a certificate to
setup on their local laptop?
>> Correct.
>> Which will enable them to VPN to
their secure development machine in Azure Government.
>> Absolutely correct.
>> Which is inside the firewall.
>> Correct.
>> For the development environment.
Okay, I think I got it. Great.
>> Now, the only other thing that we want
to mention is, so,
since VSTS is not in that development environment,
in that VPN, you're going to want to use
dual-factor authentication to make
that just a little more secure.
So, the VPN plus the dual-factor,
everything should be really secure.
It should be really difficult for
social engineering to figure out what passwords are.
It kind of removes all of that.
>> Okay. So VSTS,
we're talking about Visual Studio Team System.
>> Absolutely.
>> Or Team Services, I guess.
>> Team Services.
>> The name has changed a couple of times,
and that's our source code repository as well
as we'll talk about
some build automation and a little bit.
How about we walk through setting it up?
>> Absolutely, Steve. So, here we are,
logged into the Azure MAG portal.
Let's go ahead and start by going into
"All Services" and down here to the network group,
and we will start by clicking "Virtual Networks".
So, we need to set up a brand new virtual network
for our development team,
and we do that by clicking the "Add" button.
Then let's go ahead and give it a name,
and we'll move down here and given an address space.
You can given any address space you want.
I'm actually going to give it a very
narrow address space because,
like I said before, we're going
to plan on having about 10 developers.
>> Okay. So, I heard you say you can set
up any address space you want. Did I hear that right?
>> That is correct. Now, one of
the things you should make sure is that there's not
another virtual network with the same address space.
That's the only gotcha.
>> Okay. Sounds good.
>> So, we're going to go ahead and
select our subscription,
and we're going to go ahead and set
up a resource group name,
and we're going to keep the location in Virginia,
and we're only going to have
one subnet for use in the development.
So, we're just going to call this developments.
>> So, subnets are the thing
where I can create different subnets,
maybe if I want a data tier versus a business tier,
but for here we're just going to do
one subnet for our environment?
>> That's correct, Steve. You can have as many
of those subnets as you'd like.
>> Okay. Cool.
>> So, let's go ahead and give our subnet a range,
and if you notice underneath of
both the address space and
the address space for the subnet,
it's actually telling you how many addresses
you have which is a really nice feature.
>> Make sense there.
>> So, we're just going to go ahead and click "Create".
>> So, that was pretty easy.
Just a couple of text boxes and a
couple of clicks and boom, we've got a Vnet setup.
>> That's right. So, now,
there's still a little more configuration.
So, as you see, the Vnet we just created is here.
So, we need to come in here,
and if we take a look at subnets
like we were just talking about,
there's our development subnet.
Now, we need to have a gateway subnet set up.
There's only going to be one of
these and we're just going to
go ahead and pick the default values.
>> So, you pick the default values on the gateway.
Are there different skews on the gateway subnet?
>> That's for the gateway itself.
>> That's for gateway itself.
>> The subnet itself is just the IP value.
>> Got you. All right.
>> So, you see that we've got 123 addresses available for
our development subnet and 11 for
our gateway and a 10-person team. That's perfect.
>> Okay, and with a single subnet,
123 addresses mean that
all 123 machines that are
using those addresses can
actually talk to each other directly.
>> Great, great. All right. Simple.
>> So, if you wanted to have
your own DNS, you certainly could,
you just click "DNS" and select "Custom",
but if you go with the default,
Azure takes care of everything for you,
so there's nothing else to do.
>> All right. Cool.
>> So, now that the the VPN is set up,
let's actually hop out and create the gateway.
So, again, back to "All services" down to
the "Networking" section and
over to "Virtual Network Gateways".
>> All right, so we're still in
the networking section as you pointed out.
>> That's correct.
>> Okay.
>> So, we're just going to go
ahead and add a new gateway.
We'll just go ahead and give this a name,
again VPN not ExpressRoute.
>> Okay.
>> Route based, which is the default.
Now, here's what we're talked about the SKUs.
>> Okay.
>> Currently, there are four possible SKUs.
So, you can have max hook up,
but if you choose Basic,
Basic doesn't support Mac.
The other thing you need to think about is
bandwidth as we mentioned before.
Now, for a small team
the GW1 has 650 megabits of bandwidth,
which is probably enough.
If you needed more, you should go up,
but realize there's going to be
a cost the higher up you go in gateway size.
>> Okay. So, these different SKUs,
we document all of
these different SKUs on our documentation page.
>> Actually it is.
>> We're not sure about the number of
megabits or whatever we can always go
consult there and we can get the best balance.
>> That's a great point. You can
actually click the little eye above
that and it'll take you to
learn more and will take you right there,
actually happened to have this in
right here in our PowerPoint.
So, let's just take a look at that real quick.
>> Okay, great.
>> So, like I said, for
a small team less than 10 probably okay.
No Mac support.
>> Okay.
>> If you want Mac support, you've
got to go with GW1, GW2, GW3.
>> And what do we mean by Mac support?
>> So, Apple Macintosh.
>> Okay.
>> So, Apple Macintosh,
the Basic SKU only supports SSTP.
>> Okay.
>> Secure Site Tunneling Protocol while
the other SKUs support SSTP as well as IKEv2,
which is what Mac
use in order to connect to the virtual network.
>> So, I don't have a team,
we have Mac, we have Windows machines all good.
>> All good,.
>> All good.
>> As long as you pick one of the higher SKUs.
>> Okay.
>> All right.
>> Great.
>> So, again we're going to go with the GW1,
which is 650 megabits that
should be more than enough for our team of 10.
>> Okay.
>> So, let's hop back here to the demo.
Now, we've got to choose the
virtual network that we already set up,
so we'll just select that there's our VNet1,
and we're also going to need a public IP,
which is how we're going to be able to talk to you.
Our gateway, so we just go ahead
and we'll just give it a name, and click OK.
There we go and our
subscription and location should be the same.
Now, notice at the very, very bottom,
it's warning you, it's going to take 45 minutes to set up
>> Okay.
>> It usually takes a little longer,
but it does take a while,
this is the longest part of the whole installation.
>> Okay.
>> So, we're going to go ahead and switch over
to something we've already got setup, to show you.
>> Plan for your lunch break as what you tell us.
>> There you go. So, let's go ahead
and switch over to our resource.
>> So, we have some already set up,
Martha Stewart quick bake oven and here we go
>> That's absolutely correct.
>> So, let's go ahead into our gateway,
which is what takes so long to set up.
We're going to go into Point-to-site configuration.
As you can see, this has already been set up for us,
so we're going to say "Configure now,"
and again we need to give it an IP address,
so we're going to do.
>> What does this IP address we need to give it here?
>> So, this is how we're going to be able to
talk to the gateway from outside.
>> Okay.
>> So, let's set that up and click "Save. "
It should take just a second.
>> Okay.
>> Now, if you notice here, under tunnel type
like Paul was just saying we have SSTP and IKEv2,
we going to unselect the IKEv2
because we don't have any Mac in this case.
>> Okay.
>> If you did,
just leave it checked and you're good to go.
>> Sounds good.
>> Okay. So, now that that's set up,
the next thing we need to do is
actually create our certs.
You can do this in a couple of different ways,
if you want to set up your own
certificate authority, you could,
you could use Open SSL,
you can use Make Certs,
but the way I've chosen to do it is a little easier.
>> Easier is always good.
>> Easier is always good,
so, we're going to go ahead.
I wrote a little PowerShell script,
and let's just go ahead and take a look
at this real quick.
So, it's not very complex,
so it's going to log us into the Azure portal.
Then let's go select Our Subscription.
It's going to go ahead and make a Root Certificate,
and then associated with that Root Certificate,
it's going to be a Client Certificate.
Then it's going to take that Root Certificate,
it's going to 64-bit and code it,
and push it up to the MAG portal,
as part of the Point-to-site configuration.
>> Okay.
>> Registering that certificate to
that gateway. That's all this does.
>> They are known as self-signed certificate.
>> Absolutely, so let's
hop back into our portal once again,
and one more time we're going to go to
something that has everything all set up for us.
Here we are back to
the gateway portion, and Point-to-site configuration.
>> Okay.
>> Now, as you can see, I've got
two Root Certificates already set up and ready to go.
>> So, this is an example of one,
where the PowerShell script was
run and the Root Certificates were set up.
>> Absolutely correct.
>> Okay.
>> So, the thing we need to do now is
download the VPN client.
>> Yeah.
>> Bring it down to your local.
I'm going to show you what that looks like real quick.
I've got it sitting down here,
there's the zip file that you're going to get.
Okay, and when you expand that real quick,
you're going to get three directories.
A generic directory, a 64-bit directory
and a 32-bit directory.
>> Depending on what machine I
have that I need the VPN into,
I can select the appropriate VPN client.
>> Absolutely, we're going to go ahead and select
the 64-bit because that's what
we are, and double-click it.
Select "More Information," and click
"Run," and then "Yes,"
and just like that the VPN client is all set up.
>> In fact, if you take a look down here,
there is our DEMOVNet3 all ready to go.
>> Wow, that's amazing.
>> It's really fast.
>> So, you can literally just get it
right from the Azure portal as a developer,
I can install it on my machine in seconds,
and I'm securely connecting to my environment.
>> Absolutely, and just like we talked about before,
if somebody were to leave your team,
it's just as easy to get rid of them.
You come over here, you select one of these certificates,
and you hit "Remove," and
now they can no longer access the VPN.
>> Okay.
>> It's that easy.
>> So, does removing the certificates
also remove their access to the Azure portal?
>> Actually good point, Paul.
No, it doesn't. It just removes access to the VPN.
If you want to remove access to the portal,
you have to have somebody with
admin rights go into the portal,
and remove them as well so that they
can completely not see the project at all.
>> Which makes sense,
I mean it's pretty standard practice.
>> Absolutely.
>> Okay.
>> So, that's pretty much it.
So, you set up the VPN,
you add your subnets,
you add the Gateway,
you create your certificates,
you associate the certificates,
you download the VPN client and everybody's ready to go.
>> Awesome. So, basically what we've done
here is we've created our secure environment,
we've got it all in a VNet or securely
connecting to that VPN as you just said,
and I can log into my development machine,
or even do our builds.
>> Absolutely.
>> That's what we're going to cover in
Part Two in the next video.
>> Absolutely.
>> Okay. So, that wraps up our first video
here on setting up a secure development environment.
We have another video coming up, Part Two.
We'll talk about actually setting up the build.
So, this has been Steve Michelotti with Joseph Bloom,
and Paul Fisher. Thanks for watching