3.15 Integrating with On-Premises Networks

Video Activity
Join over 3 million cybersecurity professionals advancing their career
Sign up with
Required fields are marked with an *

Already have an account? Sign In »

18 hours 58 minutes
Video Transcription
Welcome back. This episode starts our next section on advanced networking by discussing how we integrate with on premises networks.
The objectives include understanding what virtual network it was our understanding, the different apologies we have available to us and then reviewing some of the skews we have available to us.
So we've talked previously about some basic networked apologies for connecting are on premises networks toe azure, But let's go into some details now
First, Howard, these connections made
for this. We have a virtual network gateway. These gateways are one or more specialized virtual machines that are deployed to a sub net dedicated for hosting these types of gateways. These gateways are one or more specialized virtual machines that are deployed to a sub Nate dedicated for hosting these gateways
thes virtual network Gateway Virtual machines are configured with round tables, and Gateway Service is for the type of gateway that was being provisioned.
These virtual machines do not need to be configured directly by you, and only virtual network gateways should be deployed to this dedicated sub net, called the Gateway Sub net. When creating a virtual network eight way, we have two options a VP and Gateway and an express route gateway. We'll discuss more on these two apologies to use later on in this episode.
Speaking of art apologies, the slide is from on earlier episode where we discussed an introduction to virtual networking. We have a couple of topology is available to us first over the VPN, or virtual private network. We have a point to site and site the site topology, and then we have a topology using express route. Let's discuss these in a little bit more detail.
First, we have a point to cite Point to cite VPN connection creates an encrypted connection between the Azure virtual network and a single remote system.
The V B in connection is initiated from the root system to the VP and Gateway and Azure. This is similar to Phoebe and technology that you might already be using to connect to your on premises network when you're not in the office.
This solution does not require any on premises infrastructure. You can use the same VPN gateway as your site to site connections, which will cover in this next slide.
A site to site VPN connection is used in a cross purposes Topology.
This is where you are connecting your on premises, data center and networks directly to the virtual networks in Azure.
This will connect multiple systems, and the site to your azure resource is
this requires that you haven't on premises VPN device with a probable public i p address.
This VPN connection is made using Upset or i k e version one or two. You can also connect multiple sites by creating another connection to the VP and Gateway Mazur. This allows connecting multiple on premises sites to the same gateway. So, for example, on the left of our diagram,
we could have another data center or remote site connecting to the same VP and gateway in Azure
as long as the site has its own on premises VPN device capable of making the connection. In addition to on premises data centers, you can also make a site to site B P in connection between azure virtual networks, much like you can with appearing connection.
Our last apology is express route. This allows connecting your on premises data center through a connective ity provider directly to the Microsoft Cloud, and it's service's, including Azure Office 3 65 and dynamic CR M online
express route. Connections do not go over the Internet, so they're considered more secure and reliable, with faster speeds and lower, Leighton sees
here in the stable, we have some of the BP and Gateway skews that are available to us now. I don't feel it's necessary to memorize everything in this table, but I want to point out a couple of things just to think about first. The Basics Q has very limited tunnels that are available to it, and it does not support I. K E Version two or open VP and connections.
It also does not support the border Gateway Protocol, or BTP, and it is not zone redundant
after that. Our next three skews V, P and G W one through three.
The main thing that notice here is those air not zone redundant. Whereas we have a new ski down here with a Z at the end of it, that is zone redundant,
meaning If a zone goes down in the azure region and other zones are available, the gateway will stay up and still be available and be able to process connections. So just understand the limitations of the basics. Q. And that We also have skews available to us that our zone redundant,
very similar to our express route, skews. We do have a basic one, but it's pretty much deprecate ID at this point. And much like our VP excuse, we have a standard, high performance and ultra performance, and to the right, we have e r. Gateway 12 and three ese meeting. This is the zone redundant version of the skew available to us
when we're configuring a VPN gateway. We do have a couple of options and will see this in the next episode with our demo of creating a virtual network gateway. The first is Route based versus policy based for the VP and type.
The difference here is Route based is going to use routing and 14 tables to direct traffic through multiple I P. SEC tunnels, whereas policy based is gonna route traffic through the VPN based on network prefix, is like
Tenn dot to 0.0.0 dot zero slash 16. Next is enabling active active mode as your VP and Gateway deployments consist of two instances of the V EMS and are deployed in an active standby configuration
in the event of a maintenance activity or unplanned issues on the active instance, the standby instance will take over enabling active active means. Both instances of virtual machines will be used simultaneously.
Last there is an option to configure the B G p A s n or autonomous system number for the gateway.
This value is for identifying a set of Internet credible I P prefixes that belonged to a network or collection of networks.
By default, Azure is assigned a default ascent of 65515 and we probably won't be configuring this typically. But just know that the option is there and available for you,
so that does it for the basic of our virtual network gateways. Like I said, coming up in the next episode will go through a demo of creating one
when it in this episode with a quick quiz question. What are the two gateway type options when creating a virtual network? Eight way.
These two options go along with art. Apologies are available to a VPN virtual network, gateway and an express route Gateway
Coming up. Next, we'll have our demo where we configure a virtual network gateway. See you in the next episode
Up Next