{"id":106,"date":"2018-06-19T10:34:32","date_gmt":"2018-06-19T09:34:32","guid":{"rendered":"http:\/\/www.lucidusit.co.uk\/?p=106"},"modified":"2020-11-19T00:50:17","modified_gmt":"2020-11-19T00:50:17","slug":"azure-hybrid","status":"publish","type":"post","link":"http:\/\/www.lucidusit.co.uk\/2018\/06\/19\/azure-hybrid\/","title":{"rendered":"Azure Hybrid Infrastructure"},"content":{"rendered":"
As one of my first steps into the world of ‘Azure’, I wanted to take a look at the idea of transition. This tutorial is taking the approach from an ‘Azure’ starter and scoped to the technical implementation.<\/p>\n
During the same time, I am looking to also write the business ‘why’ case; why would I as a business do this and what are the benefits and flaws\u2026 lets be straight; I work with technology and am not a salesman, there are two sides to the coin, no matter whom tries to hide the fact.<\/p>\n
I want to keep my onsite services, but extend into Azure as a seamless hybrid approach, looking at how the various service opportunities can communicate and the how to ‘best plan for the future’ from a varying point of view. So, first topic to cover is connecting the world of Azure to my onsite infrastructure with the use of a Site-to-Site VPN.<\/p>\n
Now, the saying ‘a picture can paint a thousand words’ is my approach in most of my personal learning; I also think this seems to work with most people and therefore let’s start with a picture:<\/p>\n
<\/p>\n
Not quite the correct hair colour (also a little too much). But this is my mindset in approaching Azure, with the amount of terminology and abbreviations; saying that, I think this is the same with any new technology, so rather than focus on a list of terms at the start, I will summarise at the end of the tutorial, rather than the start.<\/p>\n
Do not worry if you do not understand each element or term, as you proceed through the tutorial.<\/p>\n
Example data has been used in the table and will be used throughout the tutorial, however the hope is by the end, that you will understand exactly what the particular data is used for.<\/p>\n
Virtual Network<\/strong><\/td>\n<\/td>\n | <\/td>\n<\/tr>\n | \u00a0Item<\/strong><\/td>\n | Setting<\/strong><\/td>\n | Description<\/strong><\/td>\n<\/tr>\n | Virtual Network Name<\/td>\n | VNet01<\/td>\n | This is our segment of the pie in the virtual azure world; a piece we are cutting out for ourselves<\/td>\n<\/tr>\n | Address Space<\/td>\n | 10.10.0.0\/16<\/td>\n | <\/td>\n<\/tr>\n | Subnets<\/td>\n | <\/td>\n | <\/td>\n<\/tr>\n | VSubnet01<\/td>\n | 10.10.1.0\/24<\/td>\n | <\/td>\n<\/tr>\n | VSubnet01<\/td>\n | 10.10.2.0\/24<\/td>\n | <\/td>\n<\/tr>\n | Resource Group<\/td>\n | VNetwork<\/td>\n | <\/td>\n<\/tr>\n | Location<\/td>\n | West Europe<\/td>\n | <\/td>\n<\/tr>\n | Custom DNS<\/strong><\/td>\n | <\/td>\n | <\/td>\n<\/tr>\n | DNS Server<\/td>\n | \u00a08.8.8.8<\/td>\n | <\/td>\n<\/tr>\n | Gateway Subnet<\/strong><\/td>\n | <\/td>\n | <\/td>\n<\/tr>\n | GatewaySubnet<\/td>\n | 10.10.0.0\/28<\/td>\n | <\/td>\n<\/tr>\n | Virtual Network Gateway<\/strong><\/td>\n | \u00a0<\/strong><\/td>\n | <\/td>\n<\/tr>\n | Gateway Name<\/td>\n | VNetGW<\/td>\n | <\/td>\n<\/tr>\n | Public IP<\/td>\n | VNetGWIP<\/td>\n | <\/td>\n<\/tr>\n | Gateway Type<\/td>\n | VPN<\/td>\n | <\/td>\n<\/tr>\n | Connection Type<\/td>\n | <\/td>\n | <\/td>\n<\/tr>\n | VPN Type<\/td>\n | Policy-based<\/td>\n | <\/td>\n<\/tr>\n | Location<\/td>\n | West Europe<\/td>\n | <\/td>\n<\/tr>\n | Local Network gateway<\/strong><\/td>\n | <\/td>\n | <\/td>\n<\/tr>\n | Local Network Gateway Name<\/td>\n | VNetGWSite<\/td>\n | <\/td>\n<\/tr>\n | On Site VPN Public IP<\/td>\n | 81.174.152.37<\/td>\n | <\/td>\n<\/tr>\n | Address Space<\/td>\n | 192.168.2.0\/24<\/td>\n | <\/td>\n<\/tr>\n | Location<\/td>\n | West Europe<\/td>\n | <\/td>\n<\/tr>\n | VNetGW01 Connection <\/strong><\/td>\n | <\/td>\n | <\/td>\n<\/tr>\n | Connection Name<\/td>\n | cnnSite<\/td>\n | <\/td>\n<\/tr>\n | Connection Type<\/td>\n | Site-to-site (IPsec)<\/td>\n | <\/td>\n<\/tr>\n | Virtual Network Gateway<\/td>\n | VNetGW<\/td>\n | <\/td>\n<\/tr>\n | Gateway Type<\/td>\n | VPN<\/td>\n | <\/td>\n<\/tr>\n | Local Network Gateway<\/td>\n | VNetGWSite<\/td>\n | <\/td>\n<\/tr>\n | Shared Key<\/td>\n | GR0C413M3<\/td>\n | <\/td>\n<\/tr>\n | Resource Group<\/td>\n | Vnetwork<\/td>\n | <\/td>\n<\/tr>\n | Location<\/td>\n | West Europe<\/td>\n | <\/td>\n<\/tr>\n | SOPHOS UTM: IPSec Remote Gateway<\/strong><\/td>\n | <\/td>\n | <\/td>\n<\/tr>\n | Name<\/td>\n | MSAzureVPN<\/td>\n | <\/td>\n<\/tr>\n | On Site VPN Public IP<\/td>\n | 52.174.148.52<\/td>\n | <\/td>\n<\/tr>\n | Shared Key<\/td>\n | GR0C413M3<\/td>\n | <\/td>\n<\/tr>\n | Remote Network Name<\/td>\n | MSAzureNetwork<\/td>\n | <\/td>\n<\/tr>\n | Remote Network Name<\/td>\n | 10.10.0.0.\/16<\/td>\n | <\/td>\n<\/tr>\n | SOPHOS UTM: IPSec Policy <\/strong><\/td>\n | <\/td>\n | <\/td>\n<\/tr>\n | Name<\/td>\n | MSAzurePolicy<\/td>\n | <\/td>\n<\/tr>\n | IKE Encryption algorythm<\/td>\n | AES 256<\/td>\n | <\/td>\n<\/tr>\n | IKE Authentication algorythm<\/td>\n | SHA1<\/td>\n | <\/td>\n<\/tr>\n | IKE SA lifetime<\/td>\n | 28800<\/td>\n | <\/td>\n<\/tr>\n | IKE DH group<\/td>\n | Group 2: MODP 1024<\/td>\n | <\/td>\n<\/tr>\n | IPsec encryption algorythm<\/td>\n | AES 256<\/td>\n | <\/td>\n<\/tr>\n | IPsec Authentication algorythm<\/td>\n | SHA1<\/td>\n | <\/td>\n<\/tr>\n | IPSec SA lifetime<\/td>\n | 3600<\/td>\n | <\/td>\n<\/tr>\n | IPsec PFS group<\/td>\n | None<\/td>\n | <\/td>\n<\/tr>\n | Strict policy<\/td>\n | unchecked<\/td>\n | <\/td>\n<\/tr>\n | Compression<\/td>\n | unchecked<\/td>\n | <\/td>\n<\/tr>\n | SOPHOS UTM: IPSec Connection <\/strong><\/td>\n | <\/td>\n | <\/td>\n<\/tr>\n | Name<\/td>\n | MSAzureConnection<\/td>\n | <\/td>\n<\/tr>\n | Remote Gateway<\/td>\n | MSAzureVPN<\/td>\n | <\/td>\n<\/tr>\n | Local Interface<\/td>\n | External (WAN)<\/td>\n | <\/td>\n<\/tr>\n | Policy<\/td>\n | MSAzurePolicy<\/td>\n | <\/td>\n<\/tr>\n | Local Networks<\/td>\n | Internal (my local)<\/td>\n | <\/td>\n<\/tr>\n | Automatic firewall rules<\/td>\n | Checked<\/td>\n | <\/td>\n<\/tr>\n | Strict routing<\/td>\n | unchecked<\/td>\n | <\/td>\n<\/tr>\n | Bind tunnel to local interface<\/td>\n | unchecked<\/td>\n | <\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n | <\/p>\n Setup<\/h2>\nMy setup is a little different than most, but in the simplest form:<\/p>\n [Example Visio Placeholder]<\/p>\n Process<\/h2>\nCreate the Virtual network, think of it like your physical network infrastructure, initially without the logical part\u2026. A bit like you have just made yourself a little box inside the cloud\u2026. Has to be somewhere. Whilst create\u00a0 e.g. VNetwork01:<\/p>\n |