-: Hi everyone, my name is Anavi Nahar
and I lead the Azure Load Balancer product group.
I'm glad you're watching today
as we learn more about Gateway Load Balancer.
We announced this at Ignite
and I'm so excited to share more.
We'll go into a few details
and set you up with ample resources to learn more,
given this as a 200 level session.
Here's the agenda.
I'll give you context on the customer pain points,
as well as partner pain points
we've heard from our customers and how we solved it.
Of course, we'll chat more about the scenarios,
as well as you'll hear from our partners.
Lastly, I'll talk through key takeaways
that I'd like you to take away from this session.
With that, let's jump in.
You've often heard about NVAs or network virtual appliances.
I'll use NVAs and appliances interchangeably.
But really, what are NVAs?
NVAs are network virtual appliances.
They serve a specific network virtualized function.
Think of your firewall, your DDoS protection application,
your application delivery controller, for example.
NVAs also run on Azure virtual machines
and customers love virtual appliances
because they're able to do advanced networking capabilities
and they also did this on premises,
so it brings that sense of consistency over to the cloud.
In addition, customers have built expertise over the years
and have teams who are very skilled
in specific NVAs, as well,
and they want to bring that over to the cloud with them.
Customers often also have contracts with appliance vendors.
What's a few examples of NVAs?
Firewalls, intrusion detection protection systems,
inline DDoS, IoT applications, and so many more.
Now that we know what NVAs are,
let's learn about how customers deploy NVAs in Azure.
Well, before Gateway Load Balancer,
there's three different models.
The paired model,
in this case when going from a source
to a specific destination,
you go through a pair or two NV appliances specifically.
As you can imagine,
if there's any issues with network virtual appliances,
the customer's business will suffer
as this is a single point of failure,
or a SPOF as we call it.
It's also a management overhead
because you have to individually manage these devices
and as you scale out,
things become a little bit more hard to manage.
Another map model is the dual LB model.
Dual meaning there's two Load Balancers,
an internal Load Balancer and an external Load Balancer,
so traffic going from the source to the destination
needs to be routed to this.
Even from the visual, you can understand
that it's a little bit more complex to set up.
As a result, troubleshooting is also harder
and errors, or human errors, are very expensive.
There's another set of customers that kind of just say,
hey, I'm going to do it myself.
It's too complicated.
I will do it with my own tools and my own scripts.
This is great,
but it adds up pretty quickly when it comes to cost.
Now, we've learned about all of the challenges
that customers face today with NVAs
and how to set them up in Azure.
So, we got together and decided to solve this problem
to prevent such challenges for our customers collectively.
I'm glad to introduce you to Azure Gateway Load Balancer.
Gateway Load Balancer
makes appliance integration into Azure super easy.
So, what is a Gateway Load Balancer?
A Gateway Load Balancer brings together
the key functionality of a gateway and a Load Balancer.
You can think of Gateway Load Balancer
as a single entry and exit point for traffic,
and that's the gateway piece of it,
coupled with the Load Balancer functionality.
Things like high scale, auto scale-out,
at distribution that you need for your packets,
as well as health checks.
So we'll only send traffic
to appliances in the backend that are healthy.
In addition, Gateway Load Balancer
will ensure flow symmetry.
What this means is that packets will take the same route.
This is key for specific NVAs,
especially stateful firewalls
that function on flow symmetry primarily.
All right, let's walk through the flow of what would happen.
So, let's say I have my application, as you see over there,
and it's chained to Gateway Load Balancer.
Traffic coming in from the internet
is unfiltered or untrusted
and so when it first hits my standard Load Balancer,
which is chained to the Gateway Load Balancer,
traffic will go to the gateway LB.
Now, the gateway LB encapsulates the traffic
using VXLAN, or Virtual Extensible LAN.
This is a protocol that enables network overlays
in a physical and virtual network.
Once traffic hits the Gateway Load Balancer,
Gateway Load Balancer with its health probe,
ensures traffic goes to the appropriate healthy appliance
in the backend.
Then, traffic is sent to the appliance
and whatever application it's running,
whether that's a firewall, inline DDoS,
even packet filtering then occurs.
Once that advanced filtering is completed,
the traffic is then rerouted to the application
and then it's sent to your end application instance
in the backend pool.
As you can see, the source and the destination
have no idea that the Gateway Load Balancer
is even in the path,
so it's transparent to both the source and the destination,
making it super lightweight.
Let's delve a little bit deeper
into the Gateway Load Balancer benefits.
Gateway Load Balancer is super easy to set up.
This is my personal favorite benefit of it.
Of course, I'm a little bit biased,
but all you need is a simple click
to chain or reference your application
to a Gateway Load Balancer frontend.
Since you're able to use appliances
that you're already familiar with and like,
customers can leverage existing skillsets
that they've built with these appliances
with Gateway Load Balancer.
Since it's fully native
and leveraging our software defined networking stack,
you can take advantage of the full scale of Microsoft.
In addition, it's completely transparent.
There's no actual invasive changes
that are needed to your network
when you insert the Gateway Load Balancer.
It's truly taking the concept of service chaining
or that bump in the wire technology
and bringing it to life in the cloud.
You need no manual or error prone updates,
making troubleshooting a lot easier.
Another benefit is scale.
With VMSS, an auto-scale will automatically take care
of scaling in or scaling out
with respect to the nature of your traffic.
Gateway Load Balancer
also enhances your appliance's availability.
Not only that, the Gateway Load Balancer
can be referenced across virtual networks
and across regions.
This is super beneficial for deployments at scale,
because then you no longer have to worry
about these boundaries
with respect to virtual networks or even regions.
Now that we learned
about the benefits of Gateway Load Balancer,
let's delve into the scenarios.
Before we delve into the scenarios,
let's learn about where network virtual appliances,
or NVAs, are inserted in the cloud.
Usually, customers insert them North South,
which is from internet to VNet or VNet to internet.
And this is not just return traffic,
it's even traffic that's starting from your virtual network,
or is being sourced from your virtual network,
as well as East to West
from one VNet to another, for example.
So, let's take the scenario
of North South traffic inspection.
So in this case,
I have my two applications as an end customer,
as well as I've chained them to my Gateway Load Balancer
in the provider subscription that you see.
So any traffic coming in from an untrusted source,
well first hit my standard Load Balancers front end.
Since this is chained to my Gateway Load Balancer,
all of the traffic will transparently be routed
to a healthy instance in the backend of the gateway LB.
The gateway LB will carry forward the VXLAN encapsulation,
as I mentioned,
and the appliance provider would decapsulate.
What this means is that the provider
is able to see the full traffic
as it was originally intended.
As a result, traffic will go from the same instance
back to the application, maintaining flow symmetry.
Now this concept
or this routing pattern that I just walked you through
has plethora of applications,
whether that's in the firewall,
whether that's in packet inspection,
inline DDoS, port mirroring,
or even advanced analytics and port mirroring technologies.
Some of our customers are even using it for visualization.
What's more, with Gateway Load Balancer,
you can even build your own custom appliance.
Let's say your favorite appliance
is not doing what you need it to,
but you've built your own custom appliance
for your unique needs.
As a result, with Gateway Load Balancer,
you can bring your own appliance into Azure
and have exactly the bump
in the wire technology that you need.
What this means is any traffic
going from any source to any destination
goes first through your appliance
and so you don't have to worry
about things like management at all.
As you know, Microsoft is a partner-focused company.
We win together with our partners.
So, for the launch of gateway LB,
we've partnered with more than 10 partners
and continue to expand.
We have partners ranging from network security,
firewalls, traffic inspection, traffic visualization,
and so many more.
Gateway Load Balancer not only is beneficial
for our customers,
but it's also beneficial for our partners.
First and foremost,
the simplification of appliance deployments.
Gone are the days
where you need a long, detailed deployment guide
that you need to study in order to figure out
how to deploy in the cloud.
Since this is cloud native, we have the benefits
of our software-defined networking stack,
making this highly available and highly scalable.
Partners are able to build appliances
as they really needed to or intended to,
as a managed service.
Gateway Load Balancer removes friction
from building in the cloud for our partners.
They don't have to worry about scale.
They don't have to worry about availability.
They can just focus on their key area of expertise,
which is building amazing appliances.
Now, instead of me telling you how beneficial it is,
why don't I let one of our partners, Laura
from Trend Micro, tell you all about it instead.
Laura: Trend Micro is really excited
to be a launch partner for Azure Gateway Load Balancer
with our cloud network security solution,
Trend Micro Cloud One Network Security.
This solution provides IPS and virtual patching to customers
and is all about the easy deployment experience.
So, this diagram here shows a common customer environment
or deployment model.
The customer hosts web servers
behind a public Load Balancer,
but due to misconfiguration
or running a vulnerable web server,
these web servers become victims
and exposed to the internet and can be easily attacked.
And now, with the Azure Gateway Load Balancer
and service chaining integration,
it's even easier for our customers to deploy this on Azure.
So, you can go right to the marketplace,
find Trend Micro Cloud One Network Security.
We want to deploy the network security scale set VM
with Gateway Load Balancer
and get started with the configurations.
What's really great is that a lot of these
stick with the defaults,
your virtual network information
and that information is all going to come in automatically.
So then you'll go through some validations,
make sure everything works exactly as expected.
Great, green light. Validation passed and then we'll deploy.
Deployment doesn't take too long,
but we've sped it up with a little bit of movie magic,
just to show you here.
And deployment is complete.
The last step is to do the single click Azure deployment
of service chaining.
And that's really important
because it helps our Cloud One Network Security appliance
keep that transparent inspection capability
to protect both inbound and outbound traffic.
What's really great about this
is even an existing environment
can connect to the Gateway Load Balancer
without any redeployment, keeping it super simple.
So, once the public Load Balancer
is chained to Gateway Load Balancer,
both the inbound and outbound traffic is protected
by Cloud One Network Security.
And we're going to run the same Metasploit
to attack the web server, but you're going to see, it fails,
and that's because the attacker
fails to create an interpreter session
to the vulnerable web server,
even if the vulnerability still exists
because of our virtual patching capabilities.
And you'll see here in the log files
where we were able to stop this.
This is how Azure Gateway Load Balancer
with service chaining
makes it even easier for our shared customers
to deploy Cloud One Network Security.
Thanks.
Anavi: Thanks, Laura.
That's great to see the difference
and the power of gateway LB
and Trend Micro's cloud security solution.
If you're a partner
and you would like to integrate with Gateway Load Balancer,
we'd love to hear from you.
Of course, your appliance needs to support VXLAN technology,
as I mentioned previously,
but feel free to reach out to GWLB,
which is the shorthand for Gateway Load Balancer.
So, GWLBpartners@microsoft.com.
We're super excited to hear from you
and I hope you'll reach out.
All right, let's wrap up.
With the gateway SKU, we now have three SKUs
of the Azure Load Balancer portfolio.
Basic, as the name suggests,
for primitive or basic applications at small-scale.
Standard, for highly performant
and ultra-low latency applications
that you're trying to build in the cloud,
taking the benefits of zone redundancy and resiliency
at both a regional and a global scale.
And finally, we learned deeply about Gateway Load Balancer,
catered specifically
for network virtual appliance insertion,
making it transparent and easy to manage
for a variety of scenarios.
To summarize, Gateway Load Balancer
is a single entry and exit point for all your traffic.
With Gateway Load Balancer,
a fully managed and distributed service,
inserting appliances into the network path is super easy.
Simple.
It's also completely transparent
and enables your appliances to be highly available.
Gateway Load Balancer is available in all Azure regions,
government cloud regions, as well as China cloud regions.
You can get started with using Gateway Load Balancer
through the Azure portal, CLI or your favorite client.
To learn more about Gateway Load Balancer,
go to aka.ms/gatewaylb.
We're excited to hear from you
about all the different and new scenarios
you're going to build with gateway LB.
Thanks so much for listening.