Deploy a domain controller on Microsoft Azure Virtual Machines

Deploying a domain controller isn't a new thing in our work environment. Normally, we deploy it in on-premises environment. In this post, I won't list all the steps for deploying Active Directory Domain Services on a Microsoft Azure Virtual Machine but I will mention all things which is needed to mention.

Is it available to deploy a domain controller on Microsoft Azure environment? 

Yes.

Why do you deploy a domain controller on Microsoft Azure?

You might use Microsoft Azure for your branch office deployment. One of my projects was deployed domain controllers in world wide so I think I can apply this scenario to work with Microsoft Azure.

To deploy a domain controller on Microsoft Azure, we need notice the following things:

1. Create a virtual network and then assign IP address and DNS servers for virtual machines on Microsoft Azure

Many of you know that we need to assign a fix IP address and DNS Server for every domain controller. Even though deploy a domain controller on Microsoft Azure, we also need to assign a fix IP address and DNS server to a server. To assign  a fix IP address to a virtual machine on Microsoft Azure, we need to create a virtual network first. To create a virtual network and then assign IP address and DNS Server for Azure Virtual Machines, please read:

Configure a static IP address for a virtual machine in a Cloud-Only virtual network on Microsoft Azure

Manage DNS servers used by a virtual network (VNet)

Remark: The above screen capture is for demo environment. In production, the DNS server should point to your HQ domain controllers.

2. As mentioned branch office scenario, we may need to configure VPN connection from branch office to Microsoft Azure. To configure on-premises sites network to Microsoft Azure Virtual Network, please read:

Connect Multiple On-premises Sites to a Virtual Network

Setup VNet-To-Vnet VPN on Microsoft Azure - Part 1

Setup VNet-To-VNet VPN on Microsoft Azure - Part 2

After testing the network connection, we can do the next task.

3. Because the IP address and DNS server are assigned to a virtual machine by Microsoft Azure, we don't need to enter any IP address and DNS server inside a virtual machine.

We can perform GIP on PowerShell to check the IP settings of a virtual machine.

After that, you can promote a domain controller.

To promote a domain controller, please read:

Install Active Directory Domain Services (Level 100)

Windows 10 is coming and it supports to join Azure Active Directory. Do we still need to join the old Active Directory? Stay tuned.

This posting is provided “AS IS” with no warranties, and confers no rights!

Create multiple virtual network interfaces (vNICs) on Microsoft Azure virtual machine

At TechEd Europe 2014, Microsoft announced support for multiple Network Interface (NICs) in Azure virtual machines. Microsoft listed a table related the numbers of NICs are supported by different sizes of virtual machines.

VM Size	NICs supported

According to "Create a VM with Multuple NICs" article, the primary usage of multiple NICs on Azure virtual machines is intended for Network Virtual Appliances (NVA) VMs. I think we can also apply it to cluster VMs like Exchange Server and SQL Server.

There are some requirements and constraints of multiple NICs on Azure virtual machines.

• Multi-NIC VMs must be in created in Azure virtual networks. Non-VNet VMs are not supported.
• Currently, the multi-NIC feature is intended for NVA (Network Virtual Appliances) VMs only. Attempting to use it with the standard Gallery images may produce unexpected results.
• The current release does NOT support adding or removing NICs after a VM is created. Multi-NIC can only be applied when a VM is created.
• Multi-NIC VMs and single-NIC VMs are not supported in the same deployment. If you attempt to add a multi-NIC VM to a deployment that contains a single-NIC VM, or vice-versa, you will receive the following error: "Virtual machines with secondary network interfaces and virtual machines with no secondary network interfaces are not supported in the same deployment, also a virtual machine having no secondary network interfaces cannot be updated to have secondary network interfaces and vice-versa".
• Multi-NIC VMs cannot forward traffic acting as Layer 3 (IP) gateways or routers. The packets MUST be destined to or sourced from one of the VNet IP addresses on the VM.
• Internet-facing VIP is only supported on the "default" NIC. There is only one VIP to the IP of the default NIC.
• At this time, PIP is not supported for multi-NIC VMs.
• You can't apply network security groups (NSGs) or Forced Tunneling to the non-default NICs at this time.
• The order of the NICs from inside the VM will be random, and could also change across Azure infrastructure updates. However, the IP addresses, and the corresponding Ethernet MAC addresses will remain the same. For example, assume Eth1 has IP address 10.1.0.100 and MAC address 00-0D-3A-B0-39-0D; after an Azure infrastructure update and reboot, it could be changed to Eth2, but the IP and MAC pairing will remain the same. When a restart is customer-initiated, the NIC order will remain the same.
• Multiple NICs on the same virtual network subnet is supported.
• The VM size determines the number of NICs that can be created for a VM. The above table listed the numbers of NICs corresponding to the size of the VMs.

Quote from Create a VM with Multiple NICs

I'm going to create a new virtual machine with 3 NICs under Azure virtual network named wuslabvnet2. I created the following address spaces and subnets in wuslabvnet2.

To configure multi-NICs for a virtual machine, we need to perform Azure PowerShell cmdlets to create and assign the settings to the virtual machine.

Prerequisites

• The configuration computer is installed Microsoft Azure PowerShell module (latest version)
• Create an Azure virtual network named wuslabvnet2 and then create the above address spaces and subnets
• Make sure that the Azure subscription has been connected to Azure Storage Account

Goals

• Create and test a multi NICs virtual machine in Microsoft Azure

Lab

1. Launch "Microsoft Azure PowerShell".

2. Perform "$vm = New-AzureVMConfig -Name <VM Name> -ImageName <Azure VM Image Name> -InstanceSize Extralarge | Add-AzureProvisioningConfig -Windows -AdminUsername <Administrator name> -Password <Administrator's password>" to save Azure VM configuration to a variable.

3. Perform Add-AzureNetworkInterfaceConfig -Name "Ethernet1" -SubnetName "Subnet-192-1" -StaticVNetIPAddress "192.168.1.10" -VM $vm to add a NIC with static IP to the virtual machine configuration variable.

4. Perform Add-AzureNetworkInterfaceConfig -Name "Ethernet2" -SubnetName "Subnet-172-2" -VM $vm to add the second NIC with dynamic IP to the virtual machine configuration variable.

5. Perform Set-AzureSubnet -SubnetNames "Subnet-10-1" -VM $vm to define the default subnet for the default NIC.

6. Perform Set-AzureStaticVNetIP -IPAddress "10.0.1.10" -VM $vm to assign static IP for the default NIC.

7. We can perform New-AzureVM -ServiceName MNICVM001 -VNetName wuslabvnet2 -VMs $vm -Location "West US" to create a virtual machine with 3 NICs.

The multi-NICs virtual machine was created.

Test result

The Azure management portal only displays the default NIC of the virtual machine.

To check other IP addresses from non default NICs of the virtual machine, we can perform Get-AzureVM -ServiceName MNICVM001 -Name MNICVM001 | Get-AzureNetworkInterfaceConfig | Select -ExpandProperty IpConfigurations to get the information.

Remark: Make sure the virtual machine is running before perform the above cmdlet.

Multi-NIC VMs and single-NIC VMs are not supported in the same deployment. You will get the error message when you create a virtual machine into the same cloud service.

References:
Create a VM with Multiple NICs

Multiple VM NICs and Network Virtual Appliances in Azure

This posting is provided “AS IS” with no warranties, and confers no rights!

Setup VNet-To-VNet VPN on Microsoft Azure - Part 2

In part 1, we set up VNet to VNet connection from West US to East US. In this part, I'm going to create 1 more VNet in North Europe and then set up the VPN from North Europe to West US. To set up multi-VNet connections, we cannot complete this action on Microsoft Azure Portal. We have to download and modify the current VNet configuration file and then upload the updated configuration file to Microsoft Azure.

Prerequisites

• The configuration computer is installed Microsoft Azure PowerShell module
• Make sure you set up "Setup VNet-To-VNet VPN on Microsoft Azure - Part 1" lab environment

Goals

• Create a new VNet named nelabvnet in North Europe region
• Create a new local network with the same name nelabvnet
• Create a dynamic routing gateway on nelabvnet
• wuslabvnet connected to 2 VNets (euslabvnet and nelabvnet)

Lab

First, we need to download the current VNet configuration file and then add the new virtual and local network into configuration file.

1. Launch "Azure PowerShell" as administrator on a workstation.

2. Connect to your Azure subscription by performing "Add-AzureAccount".

3. Perform "Get-AzureVNetConfig -ExportToFile C:\VNetConfig.xml" to export the VNet configuration to C:\VNetConfig.xml.

4. Open "VNetConfig.xml" in "Windows PowerShell ISE" as administrator and then focus on Local Network Sites first.

There are 2 local network sites under our vnet configuration. We need to add a new local network for North Europe region.

5. Copy from <LocalNetworkSite> to </LocalNetworkSite> and then paste it under </LocalNetworkSite> of wuslabvnet.

6. Change the name, AddressPrefix and VPNGatewayAddress to nelabvnet, 10.3.0.0/16 and 172.16.0.3.

The latest local network configuration will be the following.

Then, we need to add a new virtual network and update "Connect to local network" in this virtual network configuration file.

7. Copy from <VirtualNetworkSite> to </VirtualNetworkSite> and then paste it under </LocalNetworkSite> of wuslabvnet.

8. Change the name, Location, AddressPerfix and LocalNetworkSiteRef to the following.

name = nelabvnet

location = North Europe

AddressPrefix = 10.3.0.0/16

AddressPrefix = 10.3.0.0/19

AddressPrefix = 10.3.32.0/29

LocalNetworkSiteRef = wuslabvnet

9. Then, we need to add 1 more LocalNetworkSiteRef named nelabvnet under wuslabvnet.

Eventually, we have the following virtual network configuration.

10. Save the VNet configuration.

11. Back to Azure PowerShell console, perform "Set-AzureVNetConfig -ConfigurationPath C:\VNetConfig.xml" to update VNet configuration on Microsoft Azure.

Click to wuslabvnet virtual network, the portal will display the 2 virtual network connection.

  

However, we haven't created a gateway on nelabvnet and set up shared key for both VNets.

Click "Configure".

The Local Network option of wuslabvnet was configured to multiple. We cannot configure this on Microsoft Azure Portal.

12. Back to Azure PowerShell console, perform "New-AzureVNetGateway -VNet nelabvnet -GatewayType DynamicRouting -Verbose" to create a new dynamic gateway with dynamic routing for nelabvnet.

 Remark: It takes 15 - 30 minutes to create a gateway.

13. Perform "$GIP = (Get-AzureVNetGateway -VNetName nelabvnet).VIPAddress" to get the gateway IP address of nelabvnet and then save it to $GIP variable.

14. Perform "$xml = [xml](Get-Content C:\VNetConfig.xml)" to get the xml content and save it to $xml variable.

15. Perform "($xml.NetworkConfiguration.VirtualNetworkConfiguration.LocalNetworkSites.LocalNetworkSite | where name -eq nelabvnet).VPNGatewayAddress" to get the gateway IP address of nelabvnet in the vnet configuration file.

We entered a temp gateway IP address for nelabvnet local network in the configuration file. Now, we need to update the configuration file and then upload to Microsoft Azure to update the virtual network settings.

16. Perform "($xml.NetworkConfiguration.VirtualNetworkConfiguration.LocalNetworkSites.LocalNetworkSite | where name -eq nelabvnet).VPNGatewayAddress = $GIP" to update the IP address.

17. Perform "$xml.save("C:\VNetConfig.xml") to save the updated content into the virtual network configuration file.

18. Perform "Set-AzureVNetConfig -ConfigurationPath C:\VNetConfig.xml" to update virtual network configuration on Microsoft Azure.

19. Perform "$Gwkey = (Get-AzureVNetGateway -VNetName wuslabvnet -LocalNetworkSiteName euslabvnet).value" to get the current shared key between wuslabvnet and euslabvnet. Then, save it to $Gwkey variable.

Remark: Get-AzureVNetGateway can get the shared key and show it as clear text.

20. Perform "Set-AzureVNetGatewayKey -VNetName nelabvnet -LocalNetworkSiteName wuslabvnet -SharedKey $Gwkey" to setup VPN tunnel on nelabvnet.

21. Perform "Set-AzureVNetGatewayKey -VNetName wuslabvnet -LocalNetworkSiteName nelabvnet -SharedKey $Gwkey" to setup VPN tunnel on wuslabvnet.

Eventually, wuslabvnet connected to euslabvnet and nelabvnet.

Please note that virtual machines under wuslabvnet can communicate with euslabvnet and nelabvnet. However, virtual machines under euslabvnet and nelabvnet cannot communicate with each other because we didn't add "Local Network Site Ref" into VNet configuration file and configured shared key. To communicate between euslabvnet and nelabvnet, we updated the VNet configuration file and then upload to Microsoft Azure. After that, configure shared key on both sites. Eventually, virtual machines under euslabvnet and nelabvnet can communicate with each other.

Additional:
By default, the Azure Gateway SKU is Default.

It supports S2S VPN throughput to 80Mbps and 10 S2S VPN tunnels. It costs $0.036 US dollar per hour.

Except Default gateway SKU. Microsoft Azure provided High Performance one. It supports S2S VPN throughput to 200Mbps and 30 S2S VPN tunnels. It costs $0.49 US dollar per hour. To update the gateway SKU, we can perform "Resize-AzureVnetGateway -VNetName <virtual network name> -GatewaySKU HighPerformance".

Eventually, the virtual network was changed to High Performance.

Reference:

Connect Multiple On-premises Sites to a Virtual Network

Azure Virtual Network Gateway Improvements

Other parts in this series

Setup VNet-To-VNet VPN on Microsoft Azure - Part 1

This posting is provided “AS IS” with no warranties, and confers no rights!

Setup VNet-To-VNet VPN on Microsoft Azure - Part 1

To apply VNet to VNet communication on Microsoft Azure, we can configure Site-to-Site (S2S) VPN between VNets. The Site-to-Site VPN for VNets can be applied to following scenarios, requirements and considerations.

Cross region geo-redundancy and geo-presence

• You can set up your own geo-replication or synchronization with secure connectivity without going over internet-facing endpoints.
• With Azure Load Balancer and Microsoft or third party clustering technology, you can setup highly available workload with geo-redundancy across multiple Azure regions. One important example is to setup SQL Always On with Availability Groups spreading across multiple Azure regions.

Regional multi-tier applications with strong isolation boundary

• Within the same region, you can setup multi-tier applications with multiple virtual networks connected together with strong isolation and secure inter-tier communication.

Cross subscription, inter-organization communication in Azure

• If you have multiple Azure subscriptions, you can now connect workloads from different subscriptions together securely between virtual networks.
• For enterprises or service providers, it is now possible to enable cross organization communication with secure VPN technology within Azure.

Requirements and considerations

• VNet to VNet supports connecting Azure Virtual Networks. It does not support connecting virtual machines or cloud services NOT in a virtual network.
• VNet to VNet requires Azure VPN gateways with dynamic routing VPNs - Azure static routing VPNs are not supported. Connecting multiple Azure virtual networks together does NOT require any on premises VPN gateways, unless cross premises connectivity is required.
• Virtual network connectivity can be used simultaneously with multi-site VPNs, with a maximum of 10 VPN tunnels for a virtual network VPN gateway connecting to ether other virtual networks or on premises sites.
• The address spaces of the virtual networks and on premises local network sites MUST NOT overlap. Overlapping address spaces will cause the creation of virtual networks or uploading netcfg configuration files to fail.
• The virtual networks can be in the same or different subscriptions.
• The virtual networks can be in the same or different Azure regions (locations).
• Redundant tunnels between a pair of virtual networks are not supported.
• A cloud service or a load balancing endpoint CANNOT span across virtual networks even though they are connected together.
• All VPN tunnels of the virtual network, including P2S VPNs, share the available bandwidth on the Azure VPN gateway and the same VPN gateway uptime SLA in Azure.

Quote from Configure a VNet to VNet Connection

Remark: We can perform "Resize-AzureVNetGateway" to increase maximum of 10 VPN tunnels to 30 VPN tunnels.

In this part, I'm going to create 2 VNets in different regions and then configure Site-to-Site VPN for these networks.

Prerequisites

• The configuration computer is installed Microsoft Azure PowerShell module

Goals

• Create 2 VNets named euslabvnet and wuslabvnet in different regions
• Create 2 local networks with the same names represent 2 virtual networks
• Create 2 dynamic routing gateways on 2 VNets
• Configure VPN shared key on 2 VPN gateways

Lab

Create virtual networks

First, we need to create 2 virtual networks on Microsoft Azure. One is located West US. Another is located East US. West US will be assigned 10.1.0.0/16 address space and East US will be assigned 10.2.0.0/16.  

1. Log in the Microsoft Azure Portal.

2. Select "Networks" tab.

3. Click "New > Virtual Network > Custom Create".

4. On "Virtual Network Details" window, next to "Name", enter "wuslabvnet".

5. Next to "Location", select "West US".

6. Click "Next".

7. For testing, we don't need to configure DNS server. Then, click "Next".

8. On "Virtual Network Address Spaces" window, the address space for wuslabvnet is 10.1.0.0/16.

9. Click "OK".

10. Repeat step 3 - 9 to create euslabvnet in "EAST US" location  and assign 10.2.0.0/16 address spaces for this VNet.

Create local networks

Then, we need to create 2 local networks to represent 2 virtual networks. Both local networks will be used the same name as the virtual networks. 

1. Select "Network" tab on "Microsoft Azure Portal".

2. Click "New > Virtual Network > Add Local Network".

3. On "Specify your local network details" window, next to "Name", enter "wuslabvnet".

4. Next to "VPN device IP address (optional)", enter "172.16.0.1".

We haven't created a VPN gateway on both VNets but we need to enter a temp IP address under "VPN Device IP address" for creating local networks. After creating a gateway, we need to change it back to the real IP address.

5. Click "Next".

6. On "Specify the address space" window, enter wuslabvnet IP address space, 10.1.0.0/16".

7. Click "OK.

8. Repeat step 2 - 7 to create a local network euslabvnet and assign 172.16.0.2 to be a temp gateway IP address. Then, enter 10.2.0.0/16 under address space.

Assign local networks to virtual networks

To create a VPN gateway for the VNets, we need to assign the destination local network to the virtual network.  For example. euslabvnet local network should be mapped to wuslabvnet. 

1. Select "wuslabvnet" virtual network.

2. Select "Configure".

3. Next to "site-to-site connectivity" section, check "Connect to local network".

4. Next to "Local Network", select "euslabvnet".

The "Local Network" should be pointed to other site Address Spaces. In this lab environment, we select euslabvnet.

5. Next to "virtual network address spaces" section, make sure the "gateway subnet" is created. If not, click "add gateway subnet".

To create Site-to-Site VPN on Azure, the gateway subnet is compulsory.

6. Click "Save".

7. Repeat step 1 - 6 to configure euslabvnet virtual network.

Create dynamic routing gateways on VNets

Dynamic routing gateway is a key component for VNets communication. We're going to create dynamic routing gateway on both VNets and then update the public IP address of both gateways to the local networks. 

1. Select "wuslabvnet" virtual network.

2. Select "Dashboard".

3. Click "Create Gateway > Dynamic Routing" button to create the gateway.

Then, Azure will take 15 - 30 minutes to create the gateway.

4. Repeat step 1 - 3 to create "Gateway" on "euslabvnet".

5. We need to update the VPN gateway addresses on Local network.

Connect VPN gateways on both VNets

To make connections between both VNets, we need to set up a shared key. 

1. Launch "Microsoft Azure PowerShell".

2. Connect to your Azure subscription by performing "Add-AzureAccount".

3. Perform "Set-AzureVNetGatewayKey -VNetName wuslabvnet -LocalNetworkSiteName euslabvnet -SharedKey <shared key for VPN tunnel>" to setup VPN tunnel on wuslabvnet.

4.  Perform "Set-AzureVNetGatewayKey -VNetName euslabvnet -LocalNetworkSiteName wuslabvnet -SharedKey <shared key for VPN tunnel>" to setup VPN tunnel on euslabvnet.

Now, both VNets can communicate with each other.

Test result

I created 2 virtual machines on Microsoft Azure. One is under euslabvnet. The other is under wuslabvnet.

I performed "tracert" on both virtual machines to make sure it can communicate with each other.

In next part, I'm going to add 1 more VNet and configure VPN to communicate with wuslabvnet.

Reference:

Configure a VNet to VNet Connection

Other parts in this series
Setup VNet-To-VNet VPN on Microsoft Azure - Part 2

This posting is provided “AS IS” with no warranties, and confers no rights!