Cloud Network and Security

Intra-Region VNET Routing Options The most common design topology within Azure is the Hub and Spoke model. The hub is a virtual network (VNet) in Azure that acts as a central point of connectivity to your on-premises network. The spokes are VNets that peer with the HUB and can be used to isolate workloads, departments, subscriptions, etc... Traffic flows between the on-premises datacenter and the hub through an ExpressRoute or VPN gateway connection. Figure 1 below details this topology. Figure 1: Azure Hub and Spoke Topology In environments where spoke to spoke communication is required, there are three different options for allowing this connectivity. Each option has advantages and disadvantages, which will be laid out here for intra-region communications, and these options can be co-mingled for various workloads. Option 1: Leveraging ExpressRoute If ExpressRoute is in use to allow connectivity from on-prem locations, we can leverage the ExpressRoute circuit to provi...

What is ExpressRoute ExpressRoute lets you extend your on-premises networks into the Microsoft cloud over a private connection facilitated by a connectivity provider. With ExpressRoute, you can establish connections to Microsoft cloud services, such as Microsoft Azure, Office 365, and Dynamics 365. Connectivity can be from an any-to-any (IP VPN) network, a point-to-point Ethernet network, or a virtual cross-connection through a connectivity provider at a co-location facility. ExpressRoute connections do not go over the public Internet. This allows ExpressRoute connections to offer more reliability, faster speeds, lower latencies, and higher security than typical connections over the Internet. For information on how to connect your network to Microsoft using ExpressRoute, see ExpressRoute connectivity models . Key benefits ·          Layer 3 connectivity between your on-premises network and the Microsoft Cloud through a connectiv...

The Challenge – Private Endpoints for Azure  Event Hub Currently, the Microsoft Azure Event Hub service offers only public IP endpoints for device and client connectivity.  While all communication with Azure Event Hub requires an encrypted TLS/SSL channel, there are customers who prefer device communication with the Event Hub service to occur over a private connection.  There are several important use cases where EventHub would benefit from offering a private endpoint to devices and clients: ·        Private traffic though ExpressRoute (e.g., factory devices with secure private IPs that use MPLS for Cloud connectivity) ·        Private traffic through a VPN (e.g., remote sensors that use P2S for high security) ·        Devices requiring internal DNS resolution of a PaaS endpoint The Solution – NGINX as a Private Event Hub Gateway NGINX (pronounced ...