I am considering to use Azure Lab Services and I'm trying to find a way to create everything in it with no Public IPs but I can't find a way.
I noticed I can make the VMs from each lab to use private IP using a peered Vnet with a selected address space but when I create a lab it creates the Template VM with Public IP so I tried to search for a way to change it but there were no options on changing it neither in the Azure Lab Services site or in the infrastructure. I thought maybe using Azure CLI I could create a Lab using Azure Lab Services with no Public IP but this is all the CLI PowerShell commands I found.
I'd be really grateful if anyone knows if there's a way to create a Template VM without a Public IP or if there isn't yet I'd like to know it too.
This is by design in Azure Lab Services. Azure Lab Services is a SaaS solution, which means that the resources needed by Lab Services are handled for you. The lab account is hosted in your subscription. The student VMs, along with the resources needed to support the VMs are hosted in a subscription owned by Lab Services. Here is the basic architecture:
Each organization or school will set up their own network in a way that best fits their needs. Because Azure Lab Services runs in the public cloud, some extra configuration may be needed to allow students to access their VM when connecting from the campus network, like setting firewall rules that block RDP or SSH connections to machines outside their own network.
So, each lab uses a single public IP address and multiple ports. All VMs, both the template VM and student VMs, will use this public IP address. The public IP address will not change for the life of lab. However, each VM will have a different port number. The port numbers range from 49152 to 65535. The combination of public IP address and port number is used to connect instructor and students to the correct VM.
Here are some more FAQs about Azure Lab Services.
Creating a lab that uses a private ip is now possible with the April 2022 Update of Azure Lab Services, with some caveats. An advanced networking feature call vnet-injection allows users to have more control over the network used for the lab.
You can see advanced networking architecture diagram in the using shared server article. (Sorry, I can't post images yet.)
You would need to:
Create a virtual network in your subscription.
Create a subnet that is delegated to Microsoft.LabServices/labplans.
Create a lab plan with advanced networking and connect it to previously created subnet.
Create lab using the previous lab plan.
Update NSG to deny traffic through public ip.
CAVEAT: The 'connect' button Azure Lab Services website will no longer work for students. (Known issue on the team's backlog.) You will need to provide a separate rdp file for students to use. It would contain something like:
full address:s:10.0.0.1:3389
prompt for credentials:i:1
administrative session:i:1
Related
can anyone explain difference between Azure Application Gateway, Virtual Network Gateway, Virtual WAN, ExpressRoute, Arc and Private Link, please?
It seems to me all services are pretty similar helping with connecting either on-prem to Azure, in-Azure to in-Azure or public to Azure.
They're similar in that they all involve network traffic, but that's pretty much where the similarities end.
Application Gateway is a Layer 7 load balancing service with advanced features like SSL termination. It's used to route client requests to your applications.
Virtual Network Gateway is a VPN gateway for point-to-site (user) and site-to-site (office/datacenter) VPN connections to your own Azure VNETs. This would, for example, allow you to RDP into Azure VMs from your on-prem office using their private IPs.
ExpressRoute is similar to site-to-site, however it doesn't use IpSec tunnels, it's a dedicated, unencrypted connection from your location directly into Microsoft's backbone. (i.e. you don't traverse the public internet). There's no encryption and the connection is faster. This is a service you need to work with a 3rd party internet provider to implement.
Virtual WAN is more like a networking hub where there would be many site-to-site, point-to-site, ExpressRoute, etc... connections spanning a wide area (as the name implies). This would be for large enterpise organizations with many on-prem locations.
Arc is a means of adding your on-prem resources into Azure for management. e.g. you have a physical server somewhere and you want to manage it though ARM/portal.
Azure Private Link is a feature of many Azure services (storage, SQL PaaS, etc..) which allows you to create a private DNS record and assign a private IP address on your internal VNETs. This is used when you want to disable all public network access to a resource and only allow access from within your own VNET.
I have barely scratched the surface of the differences here, but suffice it to say, there are many differences. From this page, you can type the service name into the search and get more specific details on the offering. Hope this helps.
https://learn.microsoft.com/en-us/search/?terms=networking%20in%20azure
Im trying to Add existing virtual network on the screenshot above in Azure, but when I select the Subscription, the virtual network I want to connect to does not show up.
I had a google but couldn't find much to help, can anyone help me understand why my azure vnet cannot be attached at the moment and what needs to be changed on it to allow me to add it?
Virtual Network Rule has some limitations, you need to make your environment does not contain any of the following:
You can only add virtual network which has the same geographic region with your Azure logical SQL server. For example, if my logical SQL server is in Southeast Asia but my virtual network in East US then I will not be able to see it listed when adding a rule.
Rule can only be applied with Azure Resource Manager.
Rules cannot be applied with S2S VPN or ExpressRoute.
Moreover, to fully utilize virtual network rule, you need to also enable Microsoft.SQL service endpoint on your subnet. Click Service endpoints > Add. Choose service and subnet you want to enable service endpoint. Currently (as of this answer) only Storage and Azure SQL are available. Note that this is not actually required to do here, when adding existing virtual network (from logical server) you are given an option to enable service endpoint.
On Azure, I have a two-VM set (both classic), whereby my web application resides on one VM, my database on another. Both map to the same DNS and belong to the same Resource Group, but both are acting as standalone cloud services at the moment. Let me explain: currently the web application communicates with the database over the public DNS. However, I need them to be on the same lan, so I can de-risk security and improve latency.
I know for a fact that they're not part of a virtual network because when I try to affix a static private IP to my database VM, I'm shown the following prompt in the portal:
This virtual machine can't be configured with a static private IP
address because it's not deployed in a virtual network.
How should I proceed to fix this misconfiguration and what should my next concrete step be? The website is live, and I don't want to risk service interruption. Ideally, both VMs should be in the same virtual network, and should communicate with eachother via a static internal IP. Please forgive my ignorance. Any help would be greatly appreciated.
I guess i'll be the bearer of bad news. You have to delete both VMs while keeping the VHDs in the storage account, then recreate the VMs (reattaching the disks) in the Virtual Network.
Since these are Classic VMs you can use the old Portal when re-creating them. You'll find the VHDs under "My Disks" in the VM creation workflow.
Alternatively, just restrict the inbound access with an ACL on the database Endpoint. Allow the VIP of the first VM and deny everything else. This is good enough for almost any scenario, since if your Web Server gets compromised it's game over. It makes no difference how they exfiltrate stuff off your database (over a VNET or over VIP).
Here's the relevant documentation page for setting up Endpoint ACLs:
https://azure.microsoft.com/en-us/documentation/articles/virtual-machines-windows-classic-setup-endpoints/
I set up 2 virtual machines on 2 BizSpark accounts (team members). One is for a web application and another for PostgreSQL database. Currently I connect to the Postgres server via public IP address. Is there a way to set up virtual network between the 2 servers on different accounts/subscriptionIds using the new Azure Portal?
Virtual networks do not span subscriptions (regardless of subscription type). You can still set up IP filtering on the input endpoints (or inbound network security rules, for ARM-based deployments) to only allow traffic from your source web application, since traffic is coming from a virtual machine.
Or you can also setup Vnet based Site to Site VPN between the 2 Virtual networks.
Here is some guidance : https://azure.microsoft.com/en-us/documentation/articles/virtual-networks-configure-vnet-to-vnet-connection/
I saw two solutions for that that you can use in your case:
1) PaaS instead of IaaS
2) If VPN is absolutely mandatory, some of BizSpark startups are using OpenVPN for a few subscriptions and it works.
We want to run MongoDB and some custom services on Azure Iaas VMs and connect to them with our roles but we do not want to have public IP exposure on the VMs.
If possible what is the best way of doing this?
If not possible is this on the roadmap?
We can add the VM's under the same cloud service and they can communicate happily, the roles are in same deployment so they communicate, but issue between the vm's and roles. We appreciate that the Iaas stuff is still in preview.
Thanks
If you have your Windows Azure Web/Worker Role and Windows Azure Virtual Machine in the same DC you can access them directly using internal IP address using Virtual Networking (Vnet) using internal Endpoints. To achieve it first you would need to create a Virtual Network and then add your Virtual Machine to this VNet. VNet will give your internal IP address and your Web/Worker Role can communicate to this internal IP address.
You can not do mix mode deployment directly from Windows Azure Preview Portal (it is not supported in preview yet) however you can use PowerShell VNet cmdlets to get it configured and working. To need further assistance with VNet team you can contact them directly here.