Azure Cloud Networking

As we saw in Chapter 11, AWS Cloud Networking, cloud-based networking helps us connect our organization’s cloud-based resources. A virtual network (VNet) can be used to segment and secure our virtual machines. It can also connect our on-premise resources to the cloud. As the first pioneer in this space, AWS is often regarded as the market leader, with the biggest market share. In this chapter, we will look at another important public cloud provider, Microsoft Azure, focusing on their cloud-based network products.

Microsoft Azure originally started as a project codenamed “Project Red Dog” in 2008 and was publicly released on February 1, 2010. At the time, it was named “Windows Azure” before being renamed “Microsoft Azure” in 2014. Since AWS released its first product, S3, in 2006, it essentially had a 6-year lead over Microsoft Azure. Attempting to catch up with AWS was no small task, even for a company with...

Azure and AWS network service comparison

When Azure launched, they were more focused on Software-as-a-Service (SaaS) and Platform-as-a-Service (PaaS), with less of a focus on Infrastructure-as-a-Service (IaaS). For SaaS and PaaS, the networking services at the lower layers are often abstracted away from the user. For example, the SaaS offering of Office 365 is often offered as a remotely hosted endpoint that can be reached over the public internet. The PaaS offering of building web applications using Azure App Service is often done via a fully managed process, via popular frameworks such as .NET or Node.js.

The IaaS offering, on the other hand, requires us to build our infrastructure in the Azure cloud. As the undisputed leader in the space, much of the target audience already has experience with AWS. To help with the transition, Azure provides an “AWS to Azure Service Comparison” (https://docs.microsoft.com/en-us/azure/architecture/aws-professional/services) on...

Azure setup

Setting up an Azure account is straightforward. Just like AWS, there are many services and incentives that Azure offers to attract users in the highly competitive public cloud market. Please check out the https://azure.microsoft.com/en-us/free/ page for the latest offerings. At the time of writing, Azure is offering many popular services free for 12 months and 40+ other services as always free:

Figure 12.2: Azure portal (source: https://azure.microsoft.com/en-us/free/)

After the account is created, we can see the services available on the Azure portal at https://portal.azure.com:

Figure 12.3: Azure services

The web pages might change by the time you read this chapter. They are generally intuitive navigation changes that are easy to maneuver, even if they look a little different.

Before any service can be launched, however, we will need to provide a payment method. This is done by adding a subscription service:

Figure...

Join our book community on Discord

https://packt.link/PyNetCommunity

Cloud computing is one of the major trends in computing today and has been for many years. Public cloud providers have transformed the start-up industry and what it means to launch a service from scratch. We no longer need to build our own infrastructure; we can pay public cloud providers to rent a portion of their resources for our infrastructure needs. Nowadays, walking around any technology conferences or meetups, we will be hard-pressed to find someone who has not learned about, used, or built services based in the cloud. Cloud computing is here, and we better get used to working with it.

There are several cloud computing service models, roughly divided into Software-as-a-Service (SaaS)(https://en.wikipedia.org/wiki/Software_as_a_service), Platform-as-a-Service (PaaS) (https://en.wikipedia.org/wiki/Cloud_computing#Platform_as_a_service_(PaaS)), and Infrastructure-as-a-Service...

AWS Setup

If you do not already have an AWS account and wish to follow along with these examples, please log on to https://aws.amazon.com/ and sign up. The process is pretty straightforward; you will need a credit card and some way to verify your identity, such as a mobile phone that can accept text messages.

A good thing about AWS when we are just getting started is that they offer many services in a free tier (https://aws.amazon.com/free/), where you can use the services for free up to a certain level. For example, we will use the Elastic Compute Cloud (EC2) service in this chapter; the free tier for EC2 is the first 750 hours per month for its t2.micro or t3.micro instances for the first 12 months.

I recommend always starting with the free tier and gradually increasing your tier when the need arises. Please check the AWS site for the latest offerings:

Figure 1: AWS free tier (source: https://aws.amazon.com/free/)

Once you have an account...

AWS Network Overview

When we discuss AWS services, we need to start at the top, with Regions and Availability Zones (AZs). They have big implications for all of our services. At the time of writing this book, AWS listed 27 geographic regions and 87 AZs worldwide. In the words of AWS Global Cloud Infrastructure (https://aws.amazon.com/about-aws/global-infrastructure/):

"The AWS Cloud infrastructure is built around Regions and Availability Zones (AZs). AWS Regions provide multiple, physically separated and isolated Availability Zones which are connected with low latency, high throughput, and highly redundant networking."

For a nice visualization of AWS Regions that can be filtered by AZ, Region, and so on, please check out: https://aws.amazon.com/about-aws/global-infrastructure/regions_az/.

Some of the services AWS offers are global (such as the IAM user we created), but most of the services are Region-based. The Regions are geographic...

Virtual Private Cloud

Amazon VPC (https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html) enables customers to launch AWS resources in a virtual network dedicated to the customer's account. It is truly a customizable network that allows you to define your IP address range, add and delete subnets, create routes, add VPN gateways, associate security policies, connect EC2 instances to your own data center, and much more.

In the early days, when VPC was unavailable, all EC2 instances in an AZ were on a single, flat network that was shared among all customers. How comfortable would the customer be with putting their information in the cloud? Not very, I'd imagine. Between the launch of EC2 in 2007 and the launch of VPC in 2009, VPC functions were some of the most requested features of AWS.

The packets leaving your EC2 host in a VPC are intercepted by the Hypervisor. The Hypervisor will check the packets against a mapping service that understands your...

Direct Connect and VPN

Up to this point, our VPC has been a self-contained network that resides in the AWS network. It is flexible and functional, but to access the resources inside the VPC, we will need to access them with their internet-facing services, such as SSH and HTTPS.

In this section, we will look at the ways AWS allows us to connect to the VPC from our private network: an IPSec VPN gateway and Direct Connect.

VPN Gateways

The first way to connect our on-premise network to VPC is with traditional IPSec VPN connections. We will need a publicly accessible device to establish VPN connections to AWS's VPN devices.

The customer gateway needs to support route-based IPSec VPNs where the VPN connection is treated as a connection that a routing protocol and normal user traffic can traverse. Currently, AWS recommends using BGP to exchange routes.

On the VPC side, we can follow a similar routing table where we can route a particular subnet toward the virtual private...

Network Scaling Services

In this section, we will look at some of the network services AWS offers. Many of these services do not have direct network implications, such as DNS and content distribution networks. They are relevant in our discussion due to their close relationship with the network and the application's performance.

Elastic Load Balancing

Elastic Load Balancing (ELB) allows incoming traffic from the internet to be automatically distributed across multiple EC2 instances. Like load balancers in the physical world, this allows us to have better redundancy and fault tolerance while reducing the per-server load. ELB comes in two flavors: application and network Load Balancing.

The Application Load Balancer handles web traffic via HTTP and HTTPS; the Network Load Balancer operates on a TCP level. If your application runs on HTTP or HTTPS, it is generally a good idea to go with the application load balancer. Otherwise, using...

Other AWS network services

There are lots of other AWS network services that we do not have the space to cover here. Some of the more ones are listed in this section:

• AWS Transit VPC (https://aws.amazon.com/blogs/aws/aws-solution-transit-vpc/): This is a way to connect multiple VPCs to a common VPC that serves as a transit center. This is a relatively new service, but it can minimize the number of connections that you need to set up and manage. This can also serve as a tool when you need to share resources between separate AWS accounts.
• Amazon GuardDuty (https://aws.amazon.com/guardduty/): This is a managed threat detection service that continuously monitors for malicious or unauthorized behavior to help protect our AWS workloads. It monitors API calls or potentially unauthorized deployments.
• AWS WAF (https://aws.amazon.com/waf/): This is a web application firewall that helps protect web applications from common exploits. We can...

Summary

In this chapter, we looked at AWS cloud networking services. We reviewed the AWS network definitions of Region, Availability Zone, edge locations, and Transit Center. By understanding the overall AWS network, gives us a good idea of some of the limitations and constraints of the other AWS network services. Throughout this chapter, we used the AWS CLI, the Python Boto3 library, and CloudFormation to automate some tasks.

We covered AWS Virtual Private Cloud in depth, with the configuration of the route table and route targets. The example on security groups and network ACLs took care of the security for our VPC. We also looked at EIPs and NAT gateways about allowing external access.

There are two ways to connect AWS VPC to on-premise networks: Direct Connect and IPSec VPN. We briefly looked at each and the advantages of using them. Toward the end of this chapter, we looked at network scaling services offered by AWS, including Elastic Load Balancing, Route 53 DNS,...

Summary

In this chapter, we took a look at the various Azure cloud network services. We discussed the Azure global network and various aspects of virtual networks. We used both the Azure CLI and the Python SDK to create, update, and manage those network services. When we need to extend Azure services to an on-premise data center, we can use either VPN or ExpressRoute for connectivity. We also briefly looked at various Azure network products and services.

In the next chapter, we will revisit the data analysis pipeline with an all-in-one stack: the Elastic Stack.

Join our book community

To join our community for this book – where you can share feedback, ask questions to the author, and learn about new releases – follow the QR code below:

https://packt.link/networkautomationcommunity