All right.
It's everything we've been talking about so far has been primarily focused around the Azure Virtual
Networks and all the great software defined networking services that we can build out there.
But often we still want to connect that Azure network to our on premises data center and so we have
a number of hybrid connectivity options available to us from Microsoft first one and very common is
site to site VPN.
This is how a lot of people get going before they're ready to commit to something larger.
And essentially this involves connecting data sent over a VPN device to Azure.
The next one is express route which is kind of what people mature and gravitate towards as they adopt
a lot of Azure and decide Okay I'm ready for a dedicated circuit maybe I'm doing a large scale migration
maybe I've got a lot of data to access on premises and in the public cloud and I've got apps running
everywhere I really want Azure to feel like a permanent extension of my data center and express right
is a good method for that.
And the third one is point aside which is very easy way to connect say your laptop directly into a virtual
network and we're going to cover all of these in a little bit more detail as we go through the module.
So let's begin with site to site VPN and you can see a couple of examples on screen right now.
But let's just take a look at the at the top one first one focus on the basics of a site to site VPN.
Well on the one side we have our data center in this case on premises it's got its own IP range and
on the other side we have Azure with a VPN gateway and essentially we just want to connect these two
together.
We have to have a public IP on the right hand side you can see there we call that VPN chip.
And on the right hand side we've got our VPN VoIP there.
And what we do then is we create an IP sic Iki as to us VPN tunnel between the two.
And now they are connected.
Now we can also do this across multiple sites as I mentioned so we could have multiple data centers
with their own networks again you can see in a lot of these examples we don't have any overlap in address
space because that's obviously not going to work from a routing perspective but you know multiple sites
all connected in to the same VPN gateways.
There's a lot of flexibility that if you've got a lot of offices or a lot of data centers that you want
to connect and you can do it that way you could also create multiple VPN VIPs if you want to connect
different offices into different VPN gateways and segments of larger networks you can really start to
carve this out and in multiple ways.
If we look at some of those specifics you definitely need to know for the exam site to site VPN gateway
connection is a connection of IP SEC slash Iki that's IKB version 1 or Virgin 2 requires a VPN device
in your enterprise data center that has a public IP address assigned to it cannot be located behind
a net and site to site connections can be useful cross premises and hybrid configurations if you definitely
take one thing away remember those four points for the exam.
If we look at point to site then in contrast this is really about connecting clients directly into the
network so you can see on screen now we have a number of VPN clime users know on the right hand side
and they could be a mixture of laptop remote workers could be people at their desks but essentially
they've got a few options that they can do an SSD teepee like a vision to tunnel as you see on the screen
there into the VPN gateway.
Now that's just like VPN into your corporate network when you want to access network resources and your
corporate network you might VPN in there.
Well same thing.
You just VPN into Azure and now you have access to your resources in the azure network.
The one thing I will say about this a lot of people use this in conjunction with say Jump box you might
VPN in connect to a jump box run it from there or potentially look at some of the new like services
like Citrix and Microsoft's audio mind things like that.
That'll coming out.
There's a lot of ways to kind of solve these scenarios and I'll bring that up because a few things you
definitely need to know especially for the Examiner.
Obviously we understand it's a secure connection from an individual computer and it's great for remote
work situations.
There's no need for a VPN device or public IP.
You know we can connect wherever we have an internet connection OS support is something we have to consider.
So it's all windows support primarily at the moment throughput and scale is the big thing though that
we have to be concerned about.
You know 3 puts up to 100 megabits per second.
And this is unpredictable due to the Internet.
And it just doesn't scale easily.
Now this is difficult to manage.
It's really only useful for a few workstations that you might want to connect in in this manner.
Now in addition you also need to know about the different VPN gateway skews that are available to you.
So if you look at the bottom there starting with the basic skew it has a maximum of 10 tunnels available
for the point to site connections it's 128 across all of the skews.
But the other big difference if you look at the basic one it really has a maximum throughput of 100
megabits a second.
That's not very much.
You really have to get into VPN gateway one two or three where they start at 650 Meg going up to 1 gigabit
to second on VPN gateway to one point to five on VPN gateway three and those gateways allow for the
max of 30 tunnels.
So a lot more flexibility if you look at it from a recommendation standpoint you know pretty much if
it's a production critical workload you're not going to use the basic you're just going to pick the
VPN gateway SKU that meets your throughput requirements if it's dev test or proof of concept and sure
the basic SKU is fine.
And then at the bottom there you can also see we've got the SKU whether it's basic or the VPN gateways
and just the features on the right hand side.
So if you see a few things down the basic SKU you know policy based VPN does not support point to sites
already mentioned it's kind of 10 tunnels maximum when you're looking at route based VPN the policy
based is only one tunnel.
And then if we look at the VPN gateway skews again up to 30 tunnels point to site BGP is supported.
So that's the border Gateway Protocol for routing and you've also got custom IP SEC IKB policies express
around VPN can co-exist you know so we can have like an express for our connection with a VPN fail over
as well.
So that's kind of just a summary of your gateway recommendations that now if we want something a little
bit more dedicate a little bit more private.
You know better guaranteed throughput.
We can move up to something like express route and this essentially is a dedicated circuit between us
and Microsoft Azure and it works on a number of steps a festival.
We have our network on the left hand side we're going to choose a partner to work with.
Who's going to provide that connection all the way across to the Microsoft Edge.
And then we have the flexibility of looking at the private services or the public services available
to us and Azure and that's really important.
And if we look at the private services this allows us to connect directly to anything we've created
like V nets et cetera in Azure the public services in contrast this is things like Office 365 as well
as services like blob storage you know parse sequel services power BMI et cetera.
These are kind of those services that are publicly exposed in a public address space and we can choose
to have you know those connected to our circuit.
You know if we want to or not.
Now in addition you've got some connectivity models that you need to choose between these three major
ones available.
One very common now is a lot of people started to use these cloud exchanges in a colo location that
could be like an equity facility as an example.
And they will provide the cloud exchange for you and connect you into Microsoft Azure.
We could do a dedicated point to point Ethernet connection that could be set up with our partner and
they would help facilitate that or we could do something like in any to any IP VPN connection over NPL
us when type scenario if we look at the key benefits of express routing.
Definitely many here but let's just hit on some of the main ones.
Well first of all this is now providing layer 3 connectivity between our on premises network and Microsoft
ashes network.
So adds a lot of flexibility in allowing us to share resources between the two data centers and allows
connectivity in all regions.
So to every Microsoft cloud service across all regions in the geopolitical region.
But in addition you can add on express for our premium add on.
And this allows to Microsoft services across all regions with that add ons or global connectivity at
that point.
In addition we've got dynamic routing.
So this uses BGP.
So this is the industry standard protocol.
So between our network and Microsoft we have that all built in and there's built in redundancy so in
every pairing location Microsoft is ensuring redundancy of hardware at every single point along the
way.
So we don't need to worry about that in addition.
Okay.
So you've decided you want to move up to express wrap but what does it take to get all of this provision.
Well there is a bit of a process and it can take many months sometimes for this to be completed.
This isn't as simple as just going into Azure and clicking new service and it's up and running this
datacenter work that has to be done.
And so there is a workflow let's just kind of walk through that you know first of all and show your
prerequisites on that.
So you need to have a connectivity provider identified and set up a business relationship with them.
Make sure you have your Azure subscription and you have to setup physical connectivity with your provider
as well.
Then you go about ordering your express route circuit you going to select things like appear in location
your bandwidth your billing model and whether or not using the standard or the premium SKU next the
service provider is going to provision that connectivity you're going to provide them with some information.
You know there's a service key you have to give them.
They're going to provide you with information and get that connected you'll work together to establish
that connection and then you can start using your express route circuit and you can link your vignettes
to Azure private period and you can link to public pier and all of that suddenly becomes available to
you.
Now in addition it's worth noting some of the data that you have to collect and some things are very
very important because for private period public period a microwave period you're going to have to create
some slash 30 subnets for your path.
So for path one is a slash 13 for path to is a slash 30.
That's a private period for public appearance the same but you must have a public IP.
And same for Microsoft parent as well.
So these are pieces of information you have to have on hand in order to be able to establish that circuit.
And now it's very important just to know about the slash study often in the exam you'll get some questions
around space and subnet and then just knowing around you know that those require a slash 30s is very
very important if we kind of look at one other aspect of this.
Does the concept of unlimited versus meta.
So if we look at unlimited first of all you know speeds from 50 megabits a second to 10 gigabits a second
you have unlimited inbound data transfer unlimited outbound data transfer but you do pay a higher monthly
fee for this unlimited option.
Now naturally if you look at the metered option while you still get the same speeds so you can go from
50 to 10 gigabits a second you still got unlimited inbound data transfer.
But the big difference is the outbound data transfer is charged at a predetermined rate for gigabyte.
Now there's a lower monthly fee for that obviously because you have sacrifice in that outbound unlimited
data transfer and you know obviously that if you bring in data in he's moving into Asia.
Metin may be the way to go.
But if you see a lot of traffic going both ways and just watch for questions on this then you know the
the unlimited option would be better for you.
So to end off let's just take a look at some of the express route considerations and three major areas
one just understand the models so the difference between unlimited data and meta data if you're trying
to do this in your own data center you understand what model using today to accelerate adoption understand
the differences in Port speeds locations and approach things like that understand the providers and
what they offer.
And finally understand the costs.
You know if you think of these three things models providers costs you'll be well on your way to being
able to answer any of the Express Rob questions they might throw at you.
And with that this ends this module hopefully this gives you a good background on everything you need
to know from a connectivity standpoint.
Like I said on the exam the questions will be focused around you picking probably the right skews around
the VPN gateway so definitely know those choosing between express route connection versus site to site.
When do you use point to site things like that are likely to come up.
And with that that's the end.
Thank you.