Tag Archives: Azure Network

Speaking with Thomas Naunheim at GermanyClouds Meetup about Azure Governance Best Practices

In the past Thomas Naunheim and I do a lot of architecture and designing prinicple for integrating Azure in company environments. We have the idea to create a Azure Governance Best Practices session in the last couple of months to give the community our insights and best practices for Starting/Integrating Azure environments. The goal is to give you insights, where you can find the best documentations to start with a Cloud journey and which technical Azure features help to bring and hold your environment in an compliant and secure state.

The session contains the following topics:

  • Cloud Adoption Framework
  • Well-architecture Framework
  • Insights about Azure Policies and Azure Security Center
  • Azure Enterprise Scale architecture
  • Azure Ops
  • Identity and Access Management

We are exited to hold the session at the GermanyClouds Meetup on november 26. Did you interested in this topics or you are in the beginning or implementig phase, join us. We will happy to see you there and get your questions.

The session will not been recorded.

Azure Bastion now supports VNET Peering

Azure Bastion is a service to avoid deployment own Jumphosts and reach Azure VMs over the Management Ports (SSH and RDP) in a secure way without the need to assign Public IPs directly to Azure VMs.

Azure Bastion got a really big improvement and now supports Azure VNET Peering. This includes all VNET peering models, inside a single subscription and VNET peering across different subscriptions.

Continue reading Azure Bastion now supports VNET Peering

Azure VPN AAD P2S Error Server did not respond properly to vpn control packets resolved

In the last few days I have created some Azure Landingzones. To secure access to Azure resources within the landing zone with different users, customers use a P2S connection through the Azure VPN Gateway using Azure AD for authentication.

Sometimes I see some mistakes in the Azure VPN Point-to-site configuration blade that results in the Error: “Server did not respond properly to vpn control packets” when trying to connect to the VPN Gateway over the Azure VPN Client.

These error messages are often due to incorrect settings in the basic settings. To resolve this issue it is really important to configure the three points: Tenant & Audience & Issuer correctly.

Please pay close attention to the following settings:

  • The Tenant field must be specified in the following notation “https://login.microsoftonline.com/your-Azuread-Tenant-ID-here/” at the end do not miss the backslash /
  • Audience field must be only contains the Enterprise Application ID of the Azure VPN client (this is the same for all Tenants) “41b23e61-6c1e-4545-b367-cd054e0ed4b4” without any other characters or spaces
  • The Issuer field must be specified in the following notation “https://sts.windows.net/your-Azuread-Tenant-ID-here/” at the end do not miss the backslash /

Please be aware of the difference between the Tenant- (begins with https://login….) and Issuer field (begins with https://sts.win…).

Please contact me if you have any questions or if you find further errors and solutions 🙂

Links

I am pleased to support the MS Ignite as an ATE (Ask The Experts)

Short note, I am pleased to announce that I support some Microsoft Ignite sessions as an ATE (Ask the Experts). Which this means? I support the Product Team in the Live sessions with answer additional questions. There are many possibilities to get in touch with the Microsoft Product owner of each service, so view the Session scheduler and join relevant sessions to ask the Product owner about services, features, possibilities and more.

I will support the following sessions:

Ask the Expert: disk storage, core compute and networking on Tuesday

Septemper 22 | 9:15 PM – 9:45 PM CEST

Ask the Expert: Be prepared for what´s next: kick start your cloud journey with Azure Migrate Program

September 23 | 10:45 PM – 11:15 PM CEST

Passed Azure Administrator Associate Exam Az-104

I reveived a cool mail some days ago with an information, that I had passed successful the new Azure Administrator Exam Az-104 and get the renewal of the Microsoft Certified: Azure Administrator Associate.

Two years ago Microsoft released the first new Rolebased exams with the Az-100/Az-101. I´ve passed both exams, but the exams are only valid for two years after passing. With the new Az-104 I got a renewal of the title for the next two years.

The Az-104 certification is a further development of the Az-103, as it will be discontinued at the end of July. To see the necessary skills and the differences to the Az-103, please have a look at the document “Az-104 Skills measured“.

Preparation and study guides

In preparation, all I can say is practice, practice, practice. Create different Azure Services, manage and administer them and interact with them. This helps a lot to understand the individual service and the different functions.

There are a lot of good study guides out there:

If you have any questions, please do not hesitate to contact me. Good luck and happy study.

Links

Connect and Secure Azure PaaS services to Virtual Networks with Private Link

Azure allows to use IaaS and PaaS solution together over the same network. But all Azure PaaS services using a public interface for connection. When configure the PaaS firewall to allow traffic only from internal VNETs the public interface still exists. With Azure Private Link there is a new service to disable the public interface and add a private endpoint to secure connect to PaaS from your own VNET.

When configuring the internal service Firewall to block all traffic from outside the VNET, the Firewall make a mapping from internal VNET traffic to the Public IP and block all other IP- Adress ranges – and here comes the new Azure Service Private Link into play. This blog post will cover how Private Link works and how to configure this service for your environment including own DNS solution to get a complete private based Azure VNET.

Continue reading Connect and Secure Azure PaaS services to Virtual Networks with Private Link

How I pass the Azure Security Exam Az-500

In the past I have taken several Azure exams, and yesterday I took the Azure Security exam Az-500. I am really glad that I passed the exam. In this article I will give you a brief overview of the topics I saw in the exam and what materials I used to prepare for the exam. I can say directly that the best way to succeed in the exam is practice.

Continue reading How I pass the Azure Security Exam Az-500

Azure Bastion – Secure Access Azure VMs via SSH/RDP without Public IP or Jumphosts

Azure Bastion is a new service to reaches Azure VMs in a secure way without needing a Jump host in the same VNET or to publish an Public IP for a VM.

Azure Bastion is in public preview since end of June 2019. Now the service is General Available (since Microsoft Ignite 2019) and many limitations are gone. This article will short introduce the service, the new features and how easy is it to enroll the service in the environment to reach Azure VMs (Windows or Linux) over a secure way.

Azure Bastion architecture from MS docs
Azure Bastion architecture from MS docs
Continue reading Azure Bastion – Secure Access Azure VMs via SSH/RDP without Public IP or Jumphosts

Azure Advent Calendar Session about Azure Bastion

Azure Advent Calender Azure Bastion session
Azure Advent Calender Azure Bastion session

Hi folks, we are in the end of the year and many advent calendars are running right now. One great idea came from Robert and Gregor, they founded the Azure Advent Calendar. A calendar with Azure session about different services. Every day will be released 3 sessions to different topics in Azure. There are many contents available now. So thanks Robert and Gregor for this great initiative.

I´m happy to contribute with a session about Azure Bastion. A secure way to access your Azure VMs without need for a Jump host or to bind a public IP-Address to a server.

Continue reading Azure Advent Calendar Session about Azure Bastion

Azure Saturday Cologne 2019 – Azure Bastion Slides

Gestern fand der erste Azure Saturday in Köln statt. Organisiert wurde dieser von Jennifer, Raphael und Martin und es war ein gelungener Auftakt. Eine tolle Orga und eine absolut hervoragende Location bei der Gothar sorgten für einen gelungene Veranstaltung. Dazu noch viele verschiedene Speaker und eine große Themenbandbreite, die für viel Austausch und Networking sorgten.

Am Nachmittag durfte ich mit zwei Sessions selbst einen kleinen Teil zum Azure Saturday Cologne beitragen.

Continue reading Azure Saturday Cologne 2019 – Azure Bastion Slides