Kategorie: Microsoft Azure

Announcing Preview of Azure Storage Firewalls and Virtual Networks

Enterprises are faced with the daunting challenge of engaging their employees, customers, and partners in today's hostile and dangerous online environement. They are increasingly turning to layered security approaches that help them stay secure in the face of potential failures of process or technology.

To help our customers address this challenge, the Azure Storage team is excited to announce the preview of Firewalls and Virtual Networks for Azure Storage. With this preview, the authorization capabilities of Azure Storage are expanded to allow administrators to also control which networks have access to their data.

By leveraging the recently announced Virtual Network Service Endpoints, administrators can now create network rules that allow traffic only from selected Virtual Networks and subnets, creating a secure network boundary for their data. On-premises networks and other trusted internet traffic can also be granted access using network rules based in IP address ranges. These rules can be managed using the Azure portal, PowerShell, CLIv2, and Azure Resource Manager templates. 

 

This preview is available now for new and existing Storage accounts in the following Azure regions:

East US
West US
West US 2
West Central US
Australia East
Australia Southeast

To learn more and get started with Firewalls and Virtual Networks for Azure Storage, check out Configure Azure Storage Firewalls and Virtual Networks​.  

Thanks!
Quelle: Azure

Announcing Virtual Network integration for Azure Storage and Azure SQL

Today, we are glad to announce the public preview of Virtual Network (VNet) Service Endpoints for Azure Storage and Azure SQL. 

For many of our customers moving their business-critical data to the cloud, data breaches remain a top concern. Various Azure services that store or process the business data have Internet-reachable IP addresses. Leaked credentials or malicious insiders with administrative privileges gaining access to the data, from anywhere in the world, is an increasing concern to our customers.

To protect against these threats, private connectivity to Azure services is becoming essential to moving more critical workloads to the cloud. Most customers want to limit access to their critical resources to only their private environments, i.e. their Azure Virtual Networks and on-premises.

While some of the Azure services can be directly deployed into VNets, many others still remain public. With VNet service endpoints, we are expanding Virtual Network support to more multi-tenant Azure services.

Service endpoints extend your VNet private address space and identity to the Azure services, over a direct connection. This allows you to secure your critical service resources to only your virtual networks, providing private connectivity to these resources and fully removing Internet access.

Configuring service endpoints is very simple with a single click on a subnet in your VNet. Direct route to the services is auto-configured for you. There are no NAT or gateway devices required to set up the endpoints. You also no longer need reserved, public IP addresses in your VNets to secure Azure resources through IP firewall. Service endpoints makes it easy to configure and maintain network security for your critical resources.

Step1: Set up service endpoints once on your Virtual Network. Network administrators can turn this setting independently, allowing for separation of duties.

Step 2: Secure your new or existing Azure service resources to the VNet, with a simple click. Set up once for the Storage account or SQL server and automatically applies to any access to child resources. Data administrators can set up independently (optional).

Service endpoints is available in preview for below services and regions:

Azure Storage: WestUS, EastUS, WestCentralUS, WestUS2, AustraliaEast, and AustraliaSouthEast

Azure SQL: EastUS, WestCentralUS, WestUS2

We will be expanding the feature to more regions soon.

We are very excited to bring enhanced network security for your Azure service resources. This is only a beginning for our roadmap for tightening security for Azure services. We will expand the service endpoints to more Azure services. In addition to service endpoints, we are also very committed to giving you private connectivity to your Azure resources, from your firewalls and on-premises. Service tags is yet another investment in this direction, for your Network Security Groups (NSGs) to selectively open access only to Azure services from your VNets. Service tags is also available in preview now. More enhancements to follow!

Next Steps

To start using VNet Service Endpoints, refer to the documentation.

For full list of network security capabilities in Azure, see “Azure Network security”.

We need your help in improving the features and broadening network security for Azure services. Share your feedback on StackOverflow with the tag “vnet-azure-services”. You can also email us directly at vnetserviceintegration@microsoft.com

For those of you at Microsoft Ignite, we will be covering the feature in more detail in our session on security:  “Network security for applications in Azure”! See you all there!
Quelle: Azure

Azure Monitor: New services and capabilities for metrics

This blog post was co-authored by Vitaly Gorbenko, Senior Program Manager, Azure Monitor and Anirudh Cavale, Program Manager, Azure Monitor.

Earlier this year we announced the general availability of Azure Monitor, Microsoft’s built-in platform monitoring service for Azure. The service enables users to access native resource metrics to gain visibility into the performance and health of their workloads in Azure. Since its launch, we have seen enormous growth in the usage of Azure Monitor metrics and heard some great feedback. Today, we are excited to announce some new additions to the metrics ecosystem. They enable you to seamlessly visualize your metrics, monitor more Azure resources, and unlock deeper insights with the addition of dimensions to metrics.

More metrics, for more Azure resources!

Many of you have provided us with feedback around making metrics available for more Azure resources. We are happy to announce additional Azure resources that now have metrics available via Azure Monitor, enabling more visibility into the state and performance of your Azure workloads. All of these metrics can be accessed via the Azure Portal and via the Azure Monitor REST APIs.

Please welcome the following resources to the Azure Monitor family:

Automation: Get visibility into the number of jobs your Azure Automation account is running.
Autoscale: Metrics are now available to help you understand how your Autoscale settings are being evaluated, what metric values are being read, and what scale actions are being taken.
Classic Compute: You can now access host metrics like Network In/Out, Disk Reads/Writes, CPU Percentage etc. for your Classic Compute VMs.
CosmosDB: Determine what the request count for your CosmosDB is by region, database, collection, and status code.
DataLake Analytics: Get visibility into the number of successful, failed, and cancelled jobs in your DataLake Analytics accounts, even measure the total AU time for those jobs.
DataLake Store: Gain insight into the amount of data being stored, written, and read in your DataLake Store accounts.
Express Route: You can now measure the total bytes ingressing and egressing your Express Route circuits.
Public IP Addresses: Metrics are now available to help you understand the inbound packets and bytes being forwarded or dropped for your Public IP Address resources.
Software Load Balancer: You can now query for the availability of your VIP and DIP endpoints for your load balancers.
Storage: You can now access capacity and transaction metrics for a storage account and its underlying services (blobs, files, tables, queues). Learn more about the new Azure storage metrics.
Traffic Manager: View the availability and query metrics for your traffic manager profile and endpoints.
Virtual Network Gateways: Get visibility into the throughput, bytes in, bytes out, packets in, packets out for your VPN Gateways.

A complete list of all the resources and metrics available via Azure Monitor can be found here.

Multi-Dimensional Metrics (public preview)

You also provided feedback that while more metrics are good, you need deeper visibility into the performance of your resources that can help you troubleshoot faster.

In addition to a host of new resource types offering metrics, the Azure Monitor now supports a public preview of multi-dimensional metrics. Native metrics can now have dimensions associated with them. Dimensions are name-value pairs, or attributes, that can be used to further segment a metric; these additional attributes can help make exploring a metric more meaningful.

Let’s look at the metrics of a Blob where your application is writing data to and other apps are reading data from. You expect the Blob writes and reads operations to happen very fast (in just a few milliseconds) to support your mission critical business apps. Prior to the dimension support, you could just use the overall ‘Success E2E Latency’ metric to monitor the average latency. Today, using the new dimensions support, you can break this metric down by the dimension – ‘API Name’. Here is the comparison of the same metric across all API names vs. a break-down by API name.

 

Metrics Name
Metrics Value: Average (ms)

Success E2E Latency
20

Metric Name
API Name
Metric Value: Average (ms)

Success E2E Latency
Get Block List
50

Success E2E Latency
Put Block List
46

Success E2E Latency
Put Block
18

Success E2E Latency
Get Container Properties
7.0

Success E2E Latency
Acquire Blob Lease
6.4

Success E2E Latency
Release Blob Lease
5.9

Success E2E Latency
Get Blob Properties
3.6

With this you can now learn that the Transactions with ‘Get Block List’ API name take more time than others.

Services like Azure Storage, API Management, and Traffic Manager are already emitting multi-dimensional metrics. A full list of resource emitting metrics, and their respective dimensions, can be found here.

New Metric Charting Experience (public preview)

As part of the multi-dimensional metrics ecosystem, we are introducing our brand-new metrics charting experience that you can use to render charts for both multi-dimensional, and basic metrics with no dimensions. The charts in the new experience can overlay metrics across different resource types, resource groups and subscriptions, and can be customized by applying filters and segmentation. After customizing the charts, you can pin them to dashboards and share with other team members.

Going back to the ‘Success E2E Latency’ metric example from above, we use the new experience to explore the average latency of transactions for a Storage resource, and corelate it to the application metric. The top chart below is segmented on the “API name” dimension to plot the average end-to-end (E2E) transaction latency broken down by API name. The bottom chart illustrates an Application Insights metric ‘Server Requests’, customized to show the volume of successful web requests that returned response code 200, and split them by the country from which the requests were made.

We are excited for you to start exploring multi-dimensional metrics and this powerful new charting experience!

Programmatic access

Users can also query for multi-dimensional metrics using our new REST API (preview) version. Discover the metrics and dimensions for resources, and query for their metric values. Follow these links to get more documentation on the Azure Monitor metric definitions REST API and the metrics REST API. We will soon be publishing .NET and Java SDKs, and adding support for PowerShell and CLI 2.0.

Wrapping up

In summary, Azure Monitor continues to grow and make more metrics available for more Azure resources. You now have a new experience that allows you to drill down further into metrics and filter them as needed. In the coming months, you can expect to see more services emitting metric and log data through Azure Monitor. Moreover, you will be able to create alert rules on these metrics filtered by their dimensions. Drop us a comment, email us, or head over to user voice and let us know what you think!
Quelle: Azure

Payment Processing Blueprint for PCI DSS-compliant environments

Today we are pleased to announce the general availability of a new Payment Processing Blueprint for PCI DSS-compliant environments, the only auditor reviewed, 100% automated solution for Payment Card Industry Data Security Standard – PCI DSS 3.2 technical controls. The architectural framework is designed to help companies deploy and operate a payment processing system, or credit card handling solution in Microsoft Azure. This automation solution will help customers adopt Azure solutions, showcasing a simple-to-understand reference architecture, and teach administrators how to deploy a secure and compliant workload while adhering to the PCI DSS compliance standard.

The solution was jointly developed with our partner Avyan Consulting, and subsequently reviewed by Coalfire, Microsoft’s PCI-DSS auditor. The PCI Compliance Review provides an independent, third-party review of the solution, and components that need to be addressed.

For a quick look at how this solution works, watch this five-minute video explaining, and demonstrating its deployment.

This automated architecture includes: Azure Application Gateway, Network Security Groups, Azure Active Directory, App Service Environment, OMS Log Analytics, Azure Key Vault, Azure SQL DB, Azure Load Balancer, Application Insights, Azure Web App, Azure Automation, Azure Runbooks, Azure DNS, Azure Virtual Network, Azure Virtual Machine, Azure Resource Group and Policies, Azure Blob Storage, Azure Active Directory access control (RBAC), and Azure Security Center.

The foundational architecture is comprised of the following components:

Architectural diagram. The diagram shows the reference architecture used for the Contoso Webstore solution.
Deployment templates. In this deployment, Azure Resource Manager templates are used to automatically deploy the components of the architecture into Microsoft Azure by specifying configuration parameters during setup.
Automated deployment scripts. These scripts help deploy the end-to-end solution. The scripts consist of:

A module installation and global administrator setup script is used to install and verify that required PowerShell modules and global administrator roles are configured correctly.
An installation PowerShell script is used to deploy the end-to-end solution, including security components built by the Azure SQL Database team.

A sample customer responsibility PCI DSS 3.2 workbook. The workbook provides an explanation of how the solution can be used to achieve a compliant state in each of the 262 PCI DSS 3.2 controls. This workbook provides details on how a shared responsibility between Azure, and a customer can successfully be implemented.

A PCI Compliance Review which outlines the topics necessary to build on the foundational architecture toward a full PCI-compliant business. The Coalfire’s review explores additional dimensions in advance of further solution design that will yield better results for an eventual PCI assessment.
A customer ready threat model. This data flow diagram (DFD) and sample threat model for the Contoso Webstore the solution that provides detailed explanation on the solution boundaries and connections.

The deployed application illustrates the secure management of credit card data including card numbers, expiration dates, and CVC (Card Verification Check) numbers in a four-tier architecture that includes built-in security and compliance considerations and can be deployed as an end-to-end Azure solution.

To stay up to date on all things Blueprint and Government, be sure to subscribe to our RSS feed and to receive emails by clicking “Subscribe by Email!” on the Azure Government Blog, additionally check back frequently to learn more about Azure automated foundational architectures.

To experience the power of Azure Government for your organization, sign up for an Azure Government Trial.
Quelle: Azure

Azure Networking announcements for Ignite 2017

Last year we committed to making it easier for customers to run their services in the public cloud. As we meet with customers from across the world a common concern voiced are the challenges of managing an ever-growing portfolio of cloud-based mission critical applications. In addition to our focus on the fundamental pillars of Security, Performance, Monitoring, Connectivity, Availability, and growing a rich partner Ecosystem, we are equally focused on simplifying the overall management of our networking services and providing you more choices to run your services in a secure and compliant manner. Here is an overview of announcements we are making at Ignite.

Security

Virtual Network Service Endpoints

Azures services such as Storage and SQL have Internet facing IP addresses.  Many customers would prefer that their Azure services not be exposed directly to the Internet. Virtual Network Service Endpoints extend your virtual network private address space and the identity of your VNet to Azure services. You can restrict Azure resources to only be accessed from your VNet and not via the Internet. A single click enables VNet service endpoints on a subnet.  Service Endpoints are available in preview for Azure Storage and Azure SQL Database in select regions. We will be including additional Azure services to VNet Service Endpoints in the coming months. For more information see VNet Service Endpoints.

VNet Service Endpoints restricts Azure services to be accessed only from a VNet

DDoS Protection for Virtual Networks

As the types and sophistication of network attacks increase, Azure provides customers with solutions to protect the security and availability of your applications. Azure’s basic DDoS Protection automatically provides real-time mitigation to protect Microsoft’s cloud using the scale and capacity of our globally deployed DDoS infrastructure. However, your application may require finer-grained policies.

The new Azure DDoS Protection service protects your application from targeted DDoS attacks and brings additional configuration, alerting and telemetry. Continuous and automatic tuning protects your publicly accessible resources in a VNet. By profiling your application’s normal traffic patterns using sophisticated machine learning algorithms to intelligently detect malicious traffic, targeted DDoS attacks are mitigated. Seamless integration with Azure Monitor provides detailed telemetry and alerting.

Azure DDoS Protection protects publicly accessible resources in a Virtual Network

Configuring is a simple click to activate protection for new or existing VNets.  Additionally, you can use Azure Application Gateway WAF to protect against application-based (Layer 7) attacks. DDoS Protection complements existing Virtual Network security features such as Network Security Groups (NSG) for a comprehensive defense in depth security solution. For details visit DDoS Protection webpage.

Application Gateway and web application firewall enhancements

Application level load balancing and web application firewalls (WAF) are required for today’s cloud-based web applications. Azure Application Gateway provides Layer 7 Application Delivery Controller (ADC) service including cookie-based session affinity, SSL Offload, URL/Host based routing, SSL re-encryption, and WAF. Application Gateway’s enhanced SSL policy support for cipher suite selection and priority ordering increases security and simplifies your compliance. The new ability to redirect (e.g. HTTP to HTTPS) ensures all web site traffic is encrypted. Support now for multi-tenant backend entities like Azure Web Apps provides more flexibility and scalability. WAF now supports open source OWASP ModSecurity Core Rule Set 3.0 which is recommended for production services. With the ability to enable or disable specific rules you choose the rules most relevant to your application. Integration of WAF with Azure Security Center further simplifies WAF manageability and monitoring.

Simplifying Networking Security management

Network Security Groups (NSGs) allow you to define network security access policies based on IP addresses restricting access to and from VMs and subnets in your VNet. However, it can be cumbersome and error-prone to manage complex security policies using only IP addresses. We have simplified the management of NSGs with Service Tags, Application Security Groups and enhanced NSG rule capabilities.

Simpler Network Security Group management with tags, groups, and enhanced rules

Service Tags: Tailoring network access to specific Azure services

Azure services use public IP addresses. A VNet that wants to access services such as Storage needs to open access to all Azure public IP addresses. Maintaining these IP addresses is problematic. A service tag is a name that represents all the IP addresses for a given Azure service, either globally or regionally. For example, the service tag named Storage represents all the Azure Storage IP addresses. You can use service tags in NSG rules to allow or deny traffic to a specific Azure service by service name. The underlying IP addresses for each tag is automatically updated by the platform. The initial release includes Service Tags for Storage, SQL, and Traffic Manager. More details are available at Service Tags.

Application Security Groups: Network security based on user defined VM groups

Application Security Groups allow you to create your own tags that represent a group of VMs. You can use this tag in your NSGs. For example, you can create a group for all your WebServers or a group for your AppServers and use these names in your security policies. More details are available at Application Security Groups.

Network Security Group Augmented Rules: Enhanced network security definition

Augmented Rules for Network Security Groups simplify security definitions. You can define larger, more complex network security policies with fewer rules. Multiple ports, multiple explicit IP addresses, Service Tags and Application Security Groups can all be combined into a single easily understood security rule. More details are available at NSG Augmented Rules.

Performance – Azure remains the fastest public cloud 

Azure continues to be the fastest public cloud. Performance is critical for running mission critical workloads in the cloud. Last year we introduced 25 Gbps VMs and now we are announcing 30 Gbps VMs. Create D64 v3, Ds64 v3, E64 v3, Es64 v3, or M128ms VMs to get 30 Gbps performance with Accelerated Networking providing ultra-low latency and high packet per second rates for VM to VM traffic.

Accelerated Networking support has been greatly expanded to all 4+ physical core VMs on Dv2, Dv3, Ev2, Ev3, F and M series instances for Windows and Linux.  Accelerated Networking is generally available in all public regions for Windows, and we’ve expanded the preview of Linux support to 20 regions. Azure Marketplace Ubuntu, SLES, and CentOS images now support Accelerated Networking with no manual steps. Automation for more Linux distros are coming soon.

We’ve been working with our partners to deliver performant network virtual appliances with fast packet processing using Data Plane Development Kit (DPDK) technology that provides direct access to network hardware. As announced in our Ignite session, we’ve been working with A10 to bring up their appliance in a production environment in Azure using Accelerated Networking and DPDK in D series VMs and they are seeing 30Gbps line rate with their vThunder appliance! 

In A10’s own words, “A10 and Microsoft are helping customers to achieve the very best performance when migrating workloads to the public cloud,” said Raj Jalan, Chief Technology Officer, A10 Networks. “Azure cloud with DPDK significantly improves network performance. A10’s vThunder ADC on Azure will offer customers 10x more performance and reduced latency.”

DPDK support for Linux VMs using Accelerated Networking is now in a Developer Preview for partners looking to provide the best networking performance. For more details contact us at AzureDPDK@microsoft.com. 

6x VPN performance

We’ve increased our VPN gateway performance so that you can have a 1 Gbps VPN connection to your Azure Virtual Network.  With such performance VPN becomes a good backup option to ExpressRoute, our private network connectivity solution. The new VPN Gateway can also be used for connecting branch offices to a VNet while the core network uses ExpressRoute. Expect more performance updates from our VPN gateways early next year.

Monitoring

Customers entrust Azure to run their mission critical workloads. Providing deep operational insights into the real-time behavior of these production applications is essential. We have enhanced our network monitoring capabilities to address these needs.

Monitoring ExpressRoute with Operations Management Suite

ExpressRoute provides private network connectivity to Microsoft’s cloud services bypassing the Internet. Two new capabilities in the Operations Management Suite (OMS) provide end-to-end monitoring of ExpressRoute from on-premises to Microsoft.

Network Performance Monitor (NPM) for ExpressRoute – Customers can monitor their connectivity end-to-end to see continuous measurements of latency, packet loss and topology snapshots in the Azure service management portal. You can set alerts and act on latency variations, packet loss and view ExpressRoute circuit, peering and connection statistics.
Endpoint monitoring – Customers can measure latency, packet loss and view the network topology of their connectivity to PaaS or SaaS services hosted in Microsoft. For example, Endpoint monitoring can track reachability to Office 365 and Azure storage accounts.

Network Performance Monitor and Endpoint monitoring enhance ExpressRoute monitoring

Enhanced Site-to-Site (S2S) VPN Monitoring

Azure VPN Gateways for Azure Monitor provides both metrics and diagnostics logs giving you the throughput of your S2S VPN tunnels and critical event logs. You can also set alerts based on VPN tunnel metrics. You get better visibility into routing information with BGP peering status for both learned and advertised routes.

Network Watcher Connectivity Check and NSG Flow Log Integration

Network Watcher enables you to diagnose, and gain insights in your Azure services using network diagnostic and visualization tools. The new Connectivity Check feature provides advanced connection diagnostics to see hop by hop information such as latency and the paths packets take to reach their destination. You can also identify configuration issues including traffic blocked by NSGs, guest firewalls, and user defined routes. Network Watcher NSG Flow Logs can be easily integrated with open source log management tools like Elastics Stack, Grafana and Graylog.

Azure Traffic Manager – Real User Measurements and Traffic Flow

Traffic Manager directs the end users of a global cloud service to the Azure regional endpoint with the lowest latency. Azure Traffic Manager uses the network latency measurements it collects through Microsoft’s cloud services to customize incoming queries based on location. With the new Azure Traffic Manager’s Real User Measurements, you can contribute your end users’ experience. For more information please visit the Real User Measurements Overview.

Traffic Manager Traffic View allows you to understand where your users are located, the traffic volume from these regions, the representative user latency, and specific traffic patterns. With this actionable intelligence, you can better manage your capacity and global expansion so your users get a great network experience. For more information please visit the Traffic View Overview.

Connectivity

Global Virtual Network Peering

Global VNet Peering enables linking VNets in different Azure regions allowing direct VM to VM communication via Microsoft’s global backbone network. Resources within VNets communicate with each other as if they are part of a single global network. Data replication, disaster recovery, and data base failover becomes significantly easier with a global abstraction. To learn more about Global VNet Peering please visit Global VNet Peering.

Global VNet Peering connects VNets in different regions

ExpressRoute enhancements

Accessing Azure Services through Microsoft peering, Route Filters, IPv6

Previously, ExpressRoute had three peerings: private peering for connecting to Azure VNets, public peering to reach Azure services, and Microsoft peering for Office 365 and Dynamics 365. To simplify ExpressRoute management and configuration we merged public and Microsoft peering. You can now access Azure PaaS and Microsoft SaaS services via Microsoft peering.

Route filters can dramatically reduce the number of IP prefixes advertised over ExpressRoute into your network. You can select the specific Office 365 or Dynamics 365 services you want to access via ExpressRoute. You can also select Azure services by region.  Additionally, you can now use IPv6 to access Office 365 over Microsoft peering.

VPN enhancements

Point-to-Site (P2S) VPN Support for macOS and Active Directory (AD) Authentication

P2S VPN connectivity allows customers to connect to their Azure VNet from anywhere using their Windows machines and now macOS. With Active Directory domain authentication customers can now use their organization’s domain credentials for VPN authentication instead inserting certificates on the client machines. The Azure VPN Gateway integrates with your RADIUS and AD Domain deployment running either in Azure or on-premises. Integrate your RADIUS server with other identity systems for additional authentication options for P2S VPN.

Azure DNS – Private Zones

Azure Domain Name Service (DNS) Private Zones provides a DNS service to manage and resolve names within and across VNets. You can manage internal DNS names for your application without exposing this information to the Internet keeping the internal structure of your application private. Private Zones automatically maintain hostname records for the VMs in the VNets. All the common record types are supported including A, NS, TXT, CNAME, SOA, SPF and Wildcard.

With the Private Zones, Azure DNS supports split-horizon views. You can use the same name in a Private Zone and an Internet facing zone. The DNS query resolves to an internal IP address if executed within a VNet and to an external IP address if queried from outside. This is useful for websites with the same internal and external name resolving to different IP addresses.

Azure DNS Private Zones can return different IPs if the DNS query is called from within the VNet or outside the VNet

Availability

New Load Balancer: 10x Scale, advanced analytics, Availability Zones, HA Ports

Load balancing enhances service availability for your applications. With the new Azure Load Balancer you can now increase your load balanced VMs by 10x from 100 to 1000 VMs. Load Balancer takes advantage of regional anycast IPs to quickly load balance external or internal traffic to ensure availability in the presence of failures. You can load balance across all your VMs deployed in Availability Zones enabling scenarios with zonal frontends and cross-zone load balancing for the backend.  You also get extensive health and diagnostic metrics including continuous in-band measurements for data plane health, per endpoint health probe status, and counters for packets, bytes, connection attempts, and outbound connections.

Azure’s new Load Balancer supports Availability Zones and provides better diagnostics.

High Availability for Network Virtual Appliances: HA Ports

Network Virtual Appliances (NVAs) help customers secure their critical workloads. With the new Load Balancer, you can take advantage of Highly Available (HA) Ports to easily configure a single load balancing rule to process and distribute VNet traffic coming across any Layer 4 port to your NVAs increasing reliability with faster failover and more scale-out options. Internal network traffic is load balanced across multiple NVAs such as virtual routers, firewalls, and application delivery controllers.

Learn more at Load Balancer Standard Preview and HA Ports.

HA Ports simplifies the deployment of highly available NVAs

Ecosystem: Providing better solutions and more choices

Building a rich ecosystem of partners provides more comprehensive solutions and a variety of choices on how best to meet your specific requirements. Using our global network with over 1.6 Pbps capacity per region and the great network performance available in Azure, we see a trend of Software as Service companies and Network Virtual Appliance (NVA) companies offering compelling solutions on Azure.

Zscaler Private Access: Built on Azure for fast local breakouts to access your Azure applications

Enterprises struggle with providing secure per-user access to line of business applications. Zscaler helps to simplify the enterprise journey to Azure for both public and hybrid environments. Zscaler Private Access (ZPA), built on Azure, provides a better, fast, seamless, policy-based SaaS-like access experience for users securely accessing business applications without exposing the entire corporate network. Zscaler integrates with Active Directory for authentication and simplified policy management.

F5 WAF as a Service: Built on Azure

Maintaining a Web Application Firewall infrastructure can be a burden to your team. F5’s new WAF as a Service, built on Azure, combines enterprise grade WAF with API driven services, making it easier to protect your apps. From the Azure Marketplace you can deploy the WAF as a Service. Read F5’s announcement.

Network Virtual Appliances: More partners and more choices

The number of NVAs available in the Azure Marketplace continues to increase. Recent additions include Arista vRouter, Citrix Netscaler SD-WAN, Riverbed SteelConnect , Cisco Viptela vEdge, and Verisign DNS Firewall. See here from more information on our NVA ecosystem.

ExpressRoute Partners Tripled

We have tripled the ExpressRoute partner ecosystem providing you even more options to meet us at 40 ExpressRoute meet-me locations throughout the world. With this strong partner ecosystem, you can privately connect to us from anywhere in the world.

Summary

As you continue to bring your mission-critical workloads to Azure, we will continue to simplify the overall network management, security, scalability, availability and performance of your applications. You can fully reap the benefits offered by our global cloud and our global backbone network. One key lesson we have learned is that network-based Software-as-a-Service offerings greatly simplify your experience. Be prepared for more exciting announcements from us in the coming months. We welcome your feedback on our new features and capabilities as well as your guidance to further refine our roadmap to meet your requirements.
Quelle: Azure

Run you Hive LLAP & PySpark Job in Visual Studio Code

If you’re interested in querying log file and gaining insights through Hive LLAP, please try HDInsight Tools for Visual Studio Code (VSCode). If you’re looking for data warehouse query experiences for big data, please try HDInsight Tools for VSCode. If you are a data scientist looking for interactive tools and BI applications for big data, we suggest you try HDInsight Tools for VSCode. If you’re a python developer for HDInsight Spark, we ask you to try HDInsight Tools for VSCode! 

Along with the general availability of Hive LLAP, we are pleased to announce the public preview of HDInsight Tools for VSCode, an extension for developing Hive interactive query, Hive Batch jobs, and Python PySpark jobs against Microsoft HDInsight! This extension provides you a cross-platform, light-weight, and keyboard-focused authoring experience for Hive & Spark development.

HDInsight Tools for VSCode not only empowers you to gain faster time to insights through interactive responses, cache in memory and higher levels of concurrency from Hive LLAP, but also offers you a great editor experiences for your Hive query and PySpark job with simple getting started experiences.

Key customer benefits

Interactive responses with flexibility to execute one or multiple selected Hive scripts.
Preview and export your Hive interactive query results to csv, json, and excel format.
Built in Hive language service such as IntelliSense auto suggest, auto complete, error marker, among others.
Python authoring with language service and HDInsight PySpark job submission.
Integration with Azure for HDInsight cluster management and query submissions.
Link with Spark UI and Yarn UI for further trouble shooting.

How to start HDInsight Tools for VSCode

Simply open your Hive or Python files in your HDInsight workspace and connect to Azure. You can then start to author your script and query your data.

How to install or update

First, install Visual Studio Code and download Mono 4.2.x (for Linux and Mac). Then get the latest HDInsight Tools by going to the VSCode Extension repository or the VSCode Marketplace and searching “HDInsight Tools for VSCode”.

 

 

 

 

 

For more information about Azure Data Lake Tool for VSCode, please see:

User Manual: HDInsight Tools for VSCode
Demo Video: HDInsight for VSCode Video
Hive LLAP: Use Interactive Query with HDInsight

Learn more about today’s announcements on the Azure blog and Big Data blog. Discover more Azure service updates.

If you have questions, feedback, comments, or bug reports, please use the comments below or send a note to hdivstool@microsoft.com.
Quelle: Azure

Get insights into your Azure #CosmosDB: partition heatmaps, OMS, and more

Transparency is an important virtue of any cloud service. Azure Cosmos DB is the only cloud service that offers 99.99% SLAs on availability, throughput, consistency, and <10ms latency, and we transparently show you metrics on how we perform against this promise. Over the past year, we have made a number of investments to help you monitor and troubleshoot your Azure Cosmos DB workloads. Today we're announcing a few more metrics we added recently, as well as integration of our metrics with the Azure Monitor, OMS, and a preview of Diagnostics logs.

Elastic scale, partition key heatmaps, and "hot" partitions

Azure Cosmos DB offers limitless elastic scale. We don't ask you how many VMs or instances you want, etc. Instead, we just ask you how much throughput you need, and we transparently and elastically scale your collections as your data grows. To enable elastic scale, we ask you what partition key you would like us to use.

The latter is a very important piece of information. Our promise to you is: if you select a partition key that has data evenly distributed over the partition key value space, we will ensure that you're taking advantage of the entire provisioned throughput. However, if all your records come in with the same partition key value, say you forgot to set it, so the value is null, you will only get 1/Nth of the provisioned throughput, where N is the current number of physical partitions created for your collection. So, if you provisioned 10000 RU/s for your collection that has 10 physical partitions, did not choose the partition key wisely, you may end up with only 1000 RU/s provisioned throughput available for your requests.

How do you know if your partition key choice is good? We help you figure it out in three simple steps.

Check if your operations are getting throttled. Look at the "Requests exceeding capacity" chart on the throughput tab.
Check if consumed throughput exceeds the provisioned throughput on any of the physical partitions (partition key ranges), by looking at the "Max RU/second consumed per partition" metric.
Select the time where the maximum consumed throughput per partitions exceeded provisioned on the chart "Max consumed throughput by each partition" to investigate the per-partition distribution of the consumed throughput at that time.

Sometimes it’s also helpful to look at the data distribution across partitions. You can see this chart on the storage tab. You can click on individual partition key ranges and find out the dominant partition keys in that range. You can further select a key and click “Open in Data Explorer” to see the corresponding data.

Here is a quick Azure Friday video on this topic:

For more information on using the new metrics, see Monitoring and debugging with metrics in Azure Cosmos DB.

Database audit and OMS integration

We are excited to announce Diagnostics Logs for data plane operations, which enable you to get a full audit of who accessed your Azure Cosmos DB collections and when. In the Azure portal, navigate to the Diagnostics Log menu on the left navigation bar, select your Azure Cosmos DB account, and turn the diagnostics log on. You can also export these logs to an Azure Storage account, stream them to an Event Hub, or send them to Log Analytics and an Operations Management Suite. For instructions on turning on diagnostic logs, see Azure Cosmos DB diagnostic logging.

Azure Monitor

Today we also announced the availability of a subset of Azure Cosmos DB metrics via Azure Monitor API. Now you can use tools like Grafana to access your metrics, with Operations Management Suite integration coming soon.

Play with Azure Cosmos DB and let us know what you think

Azure Cosmos DB is the database of the future. It’s what we believe to be the next big thing in the world of massively scalable databases! It makes your data available close to where your users are, worldwide. It is a globally distributed, multi-model database service for building planet-scale apps with ease, using the API and data model of your choice. You can try Azure Cosmos DB for free today, no subscription or credit card required.

If you need any help or have questions or feedback, please reach out to us on the developer forums on Stack Overflow. Stay up-to-date on the latest Azure Cosmos DB news and features by following us on Twitter using #CosmosDB, or @AzureCosmosDB.

– Your friends at Azure Cosmos DB
Quelle: Azure

A new Planned Maintenance experience for your virtual machines

We’re excited to announce the availability of a new planned maintenance experience in Azure, providing you more control, better communication, and better visibility. While most planned maintenance is performed without any impact to your virtual machines using memory preserving maintenance, some do require a reboot to improve reliability, performance, and security.

What’s new?

More control: You now have the option to proactively initiate a redeploy of your VMs on your schedule within a pre-communicated window, ensuring that planned maintenance will be performed when it is most convenient for you.

Better communication: We added planned maintenance to the Azure Monitor experience where you can create log-based alerts. With Azure Monitor notifications, you can add multiple email recipients to maintenance alerts, receive SMS messages, and configure webhooks, which integrate with your third-party software, to alert you of upcoming maintenance.

Better visibility: We recently introduced Azure Service Health in the Azure Portal, which provides you planned maintenance information at the VM level. Additionally, we introduced Scheduled Events, which surfaces information, including upcoming planned maintenance, via REST API in the VM. You can use this capability as part of maintenance preparation. Lastly you can view upcoming maintenance information via PowerShell and CLI.

Why should I consider proactive-redeploy?

During a communicated window, customers can choose to start maintenance on their virtual machines. If you do not utilize the window, the virtual machines will be rebooted automatically during a scheduled maintenance window (which is visible to you). Starting the maintenance will result in the VM being redeployed to an already-updated host. While doing so, the content of the local (temporary) drive will be lost.

Native cloud applications running in a cloud service, availability set, or virtual machines scale set, are resilient to planned maintenance since only a single update domain is impacted at any given time.

You may want to use proactive-redeploy in the following cases:

Your application runs on a single virtual machine and you need to apply maintenance during off-hours.
You need to coordinate the time of the maintenance as part of your SLA.
You need more than 30 minutes between each VM restart even within an availability set.
You wish to take down the entire application (multiple tiers, multiple update domains) in order to complete the maintenance faster.

What should I do next?

Prior to the next planned maintenance in Azure:

Become familiar with how to proactively redeploy your VMs on Windows and Linux.

Create alerts and notifications in Azure Monitor.

Set up Scheduled Events for your Windows and Linux VMs.

For more information:

Watch Azure Friday on Planned Maintenance.

Watch Tuesdays with Corey on Planned Maintenance.

Quelle: Azure