Skip to main content

Posts

Set Network ACLs using Windows Azure Powershell Commands

In the latest update of Azure PowerShell commandlets, there is an option to set network ACLS for VM end points. Using this option, you can Allow/block access to an endpoint based on the IP address range Maximum of 50 ACL rules are possible per VM Lower numbered rules take precedence over higher number rules If you create a permit ACL, all other IP ranges are blocked. Similarly, if you define a Deny rule, All other Ips are permitted  If no ACLs are defined, it is permit all by default Steps for setting a permit ACL for a particular IP is given below. Before executing the same, make sure that you have set the subscriptions correctly as per my previous post. Create a new acl object $acl=New-AzureAclConfig Create the permit rule and add it to the acl Set-AzureAclConfig -AddRule -ACL $acl -Order 50 -Action Permit -RemoteSubnet "110.124.37.30/32" -Description "Test-ACL confguration" Here I am explicitly permitting access from a public IP ...

Back to basics : Networking - Part 2

IPV6 Basics: IPV6 uses 32 bit address space whereas IPV6 uses 128 bit address space Represented by eight groups of hexadecimal quadrants and uses Classless Interdomain Routing(CIDR) First 48 bits of the address are the network prefix, next 16 characters are subnet ID and last 64 characters are interface identifiers There are three kinds of IPV6 addresses  are Unicast,Multicast and Anycast Unicast : Identifies a single interface, equalent to IPV4 address of a machine Multicast : Identifier for Multiple network interfaces. Commonly used for sending signals to a given group of systems or for braodcasting videos to multiple computers etc Anycast : The pacaket is delivered to the nearest(in terms of routing) device IPV6 does not have broadcast messages Unicast and Anycast addresses have the following scopes: Link-local : Scope is local link(ie nodes on same subnet).Prefix for link-local addresses is FE80::/64 Site-Local: Scope is organization ie private site addressing.Pre...

Managing Windows Azure using Powershell commandlets

Inorder to start managing your Azure subscriptions using Powershell commandlets, first you need to install the Windows Powershell from here Open the Azure PowerShell windows from Start-> all programs->Windows Azure->Windows Azure Powershell Inorder to manage a subscription, you will have to import the management certificate for the same . You can use the below commands for the same $cert = new-object System.Security.Cryptography.X509Certificates.X509Certificate2 $Filepath ="D:\certs\managementcert.pfx" --> Provide the path to your management cert here $password='Password' --> Give your certificate password here $cert.Import($Filepath,$password,'Exportable,PersistKeySet')   -->At this point the variable $cert will have your management certificate loaded Now you need to import your subscription id & subscription name. You can get the value from the management portal->Settings $subscriptionId = '1935b212-1179-4231-...

Windows Azure fault domain and upgrade domain

Fault Domain: In simple words, fault domain can be considered as a single point of failure. For eg:, servers hosted in a rack in a data center can be considered as a fault domain, because power failure to the rack will bring down all the servers in it. During deployment time, the instances in a role are assigned to different fault domains, to provide fault tolerance (only when there are multiple fault domains) Upgrade Domain:  This concept is applicable during a deployment upgrade.Each upgrade domain can be considered as a logical unit of deployment. During an application upgrade, it is carried out on a per upgrade domain basis, ie the instances in the first upgrade domain are stopped, upgraded  , brought back to service, followed by the the second upgrade domain. Thsi ensures that the application is accessible during the upgrade process though with reduced capacity

Windows Azure storage concepts

You can create a storage accounts in windows Azure and provide your applications access to the tables, Blobs and queues in it. The maximum capacity of data for storage accounts is 200TB, if it was created after June 8th 2012 and 100 TB if created before that. Geo redundant Storage(GRS): Replicates the storage to a secondary, geographically separate location. Data is replicated asynchronously to the secondary location in the background. If there is any failure in primary location, storage will failover to the secondary location Locally redundant Storage(LRS) : For any storage, the data is replicated three times within the same datacentre. All Windows Azure storages are locally redundant Affinity group: It is a geographical grouping of cloud deployments and storage accounts.By grouping the services used by your application in a affinity group in  a particular geographical location, you can improve your service performance Storage account endpoints: Highest namespace for acc...

Windows Azure host and guest OS updates

Windows Azure host OS is the root partition, which is responsible for creating child partitions to execute Windows Azure services and guest OS. The host OS is updated atleast once in a quarter to keep the environment secure. Updating the Host OS means that the VMs hosted in it should be shutdown and then restarted. While the upgrade is done, Azure ensures that the VMs in different update domains are not down simultaneously thereby affecting the availability of hosted applications. An optimal order of updating the servers are identified first before proceeding with the upgrade. Windows Azure guest OS runs on the VMS that host your applications in Azure. The OS is updated periodically when each time a new update is released. You can choose to get this done automatically or manually upgrade it at a chosen period.Microsoft recommends automatic OS updates, so that known security vulnerabilities are taken care of and you application will run on an up-to-date environment. Inorder to con...

Configuring Diagnostics for Windows Azure cloud service

Steps for configuring the Windows Azure diagnostics are as follows: Import the Diagnostics module in the csdef file     <Imports>       <Import moduleName="Diagnostics" />     </Imports> The option for tracing and debugging can be included in the Windows Azure application code Custom performance counters can be created for web and worker roles using powershell scripts in startup tasks. You can collect data from the existing performance counters as well Store dignostics data in an Azure storage, since the collected data is only cached and hence does not perisist. The diagnostics storage can be defined in the cscfg file using the following settings <Setting name="Microsoft.WindowsAzure.Plugins.Diagnostics.ConnectionString" value="DefaultEndpointsProtocol=https;AccountName= storagename ;AccountKey= storageaccesskey " /> Replace the storagename and storageaccesskey using the name and access key of your d...