8. Creating hybrid connections

Hybrid connections allow us to create secure connections with Azure virtual networks (VNets). These connections can either be from on-premises or from other Azure VNets. Establishing connections to Azure VNets enables the exchange of secure network traffic with other services that are located in different Azure VNets, different subscriptions, or outside Azure (in different clouds or on-premises). Using secure connections removes the need for publicly exposed endpoints that present a potential security risk. This is especially important when we consider management, where opening public endpoints creates a security risk and presents a major issue. For example, if we consider managing virtual machines, it's a common practice to use either Remote Desktop Protocol (RDP) or PowerShell for management. Exposing these ports to public access presents a great risk. A best practice is to disable any kind of public access to such ports and use only access...

Technical requirements

For this chapter, the following are required:

• An Azure subscription
• Windows PowerShell

The code samples can be found at https://github.com/PacktPublishing/Azure-Networking-Cookbook-Second-Edition/tree/master/Chapter08.

Creating a Site-to-Site connection

A Site-to-Site connection is used to create a secure connection between an on-premises network and an Azure VNet. This connection is used to perform a number of different tasks, such as enabling hybrid connections or secure management. In a hybrid connection, we allow a service in one environment to connect to a service in another environment. For example, we could have an application in Azure that uses a database located in an on-premises environment. Secure management lets us limit management operations to being allowed only when coming from a secure and controlled environment, such as our local network.

Getting ready

Before you start, open your browser and go to the Azure portal at https://portal.azure.com.

How to do it...

To create a new Site-to-Site connection, we must follow these steps:

1. Locate the virtual network gateway (the one we created in Chapter 5, Local and virtual network gateways) and select Connections.
2. In...

Downloading the VPN device configuration from Azure

After creating the Azure side of the Site-to-Site connection, we still need to configure the local VPN device. The configuration depends upon the vendor and the device type. You can see all the supported devices at https://docs.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-devices. In some cases, there is an option to download configuration for a VPN device directly from the Azure portal.

Getting ready

Before you start, open the browser and go to the Azure portal at https://portal.azure.com.

How to do it...

To download the VPN device configuration, we must follow these steps:

1. Locate the Site-2-Site connection in the Azure portal. The Overview pane will be opened by default.
2. Select the Download configuration option from the top of the pane:
   

   Figure 8.5: Site-2-Site connection overview in the Azure portal

3. A new pane will open, and you will see that all the options in the pane are predefined:
   

   Figure...

Creating a Point-to-Site connection

Accessing resources in a secure way is important, and this must be performed securely. It's not always possible to perform this using a Site-to-Site connection, especially when we have to perform something out of work hours. In this case, we can use Point-to-Site to create a secure connection that can be established from anywhere.

Getting ready

To create a Point-to-Site connection, we'll need to generate a certificate that will be used for the connection. To create a certificate, we must follow these steps:

1. Execute the following PowerShell script to generate a certificate:

   $cert = New-SelfSignedCertificate -Type Custom '
   -KeySpec Signature '
   -Subject "CN=P2SRootCert" '
   -KeyExportPolicy Exportable '
   -HashAlgorithm sha256 -KeyLength 2048 '
   -CertStoreLocation "Cert:\CurrentUser\My" '
   -KeyUsageProperty Sign '
   -KeyUsage CertSign
   New-SelfSignedCertificate -Type Custom '...

Creating a VNet-to-VNet connection

Similar to the need to connect Azure VNets to resources on a local network, we may have the need to connect to resources in another Azure VNet. In such cases, we can create a VNet-to-VNet connection that will allow us to use services and endpoints in another VNet. This process is very similar to creating a Site-to-Site connection; the difference is that we don't require a local network gateway. Instead, we use two virtual network gateways, one for each VNet.

Getting ready

Before you start, open your browser and go to the Azure portal at https://portal.azure.com.

How to do it...

To create a VNet-to-VNet connection, we must follow these steps:

1. In the Azure portal, locate one of the virtual network gateways (associated with one of the VNets you are trying to connect to).
2. In the Virtual network gateway pane, select Connections and select Add to add a new connection:
   

   Figure 8.19: Adding a new connection

3. In the new pane...

Connecting VNets using network peering

Another way to connect two Azure VNets is to use network peering. This approach doesn't require the use of a virtual network gateway, so it's more economical to use it if the only requirement is to establish a connection between Azure VNets. Network peering uses the Microsoft backbone infrastructure to establish a connection between two VNets, and traffic is routed through private IP addresses only. However, this traffic is not encrypted; it's private traffic that stays on the Microsoft network, similar to what happens to traffic on the same Azure VNet.

Getting ready

Before you start, open your browser and go to the Azure portal at https://portal.azure.com.

How to do it...

To create network peering, we must take the following steps:

1. In the Azure portal, locate one of the VNets that you want to connect to.
2. In the Virtual network pane, select the Peerings option, and select Add to add a new connection:
   

   Figure...