Archive | Azure RSS feed for this section

Azure VMware Solution – Network Connectivity Azure VNet and On-premise

15 Feb

In this blog post, we shall take a deeper look into the Azure VMware Solution network connectivity between the Azure VNet for accessing Azure native services such as Bastion, Azure AD, SQL etc. and further connectivity to the On-premise network to migrate virtual machines or hyrbid setup.

AVS Networking – Image courtesy @Microsoft

Step 1 & 2 – Connectivity between Azure VMware Solution (AVS) – Express Route to Azure VNet

  • After the deploying the AVS we need to connect it to the Azure VNet for consuming Azure Native Services such as Bastion, SQL, AAD etc.
    • Note AVS pre-deploys the ExpressRoute for you (AVS – Manage – Connectivity – Express Route).
  • We need to have a Virtual Network Gateway (VNG) existing on Azure VNet, or we need to create one. All steps to be performed under portal.azure.com
  • Deploy the Virtual Network Gateway (VNG) on Azure subscription
    • Make sure you have a VNG created on Azure VNET
    • Give it a name – AZ104-VNG01
    • Resource Group – Select New or existing
    • Location – Australia East
    • SKU – Standard (for demo and testing purposes)
    • Virtual Network – Select the existing VNET (E.g. 10.0.0.0/16) for Azure. Note it will create the Gateway Subnet automatically (10.x.x.x/24)
    • Type – ExpressRoute
    • Public IP Address – Create New (It will auto assign a public IP)
    • Optional Create Tags
    • Save and Create
  • Under AVS – Connectivity – Express Route
    • Request the Authorization key
      • Name – ToAzureVNET
      • Copy the Key and Express Route ID
  • Open the VNG (AZ104-VNG01) and Settings – Connections
    • Click on Add
    • Name – FromAVSPrivateCloud
    • Connection Type – Express Route
    • Enter the Authorization Key and Express Route ID and paste them here
    • Click OK
    • The Status will change from Updating to Succeeded
  • Now we have the connectivity between the AVS and Azure VNet.

Step 1 & 3 – Connectivity between Azure VMware Solution – ExpressRoute Global Reach to On-premise networks

  • Now we will establish the connectivity between AVS and On-premise networks
  • ExpressRoute Circuits – This is the coming from On-premise into Azure VNet
    • This will depend upon the partner network (Equinix, Telstra etc.)
    • Note there are different type of Peerings available. Select based on your design – Azure ExpressRoute Overview: Connect over a private connection | Microsoft Docs
      • Azure Private – We are going with this option at the moment
      • Azure Public (Public IP address required)
      • Microsoft (Office 365 etc.)
    • Click under Settings – Authorizations
    • Click on Add
    • Name – AuthorizationforAVS
    • Copy the Authorization Key
    • Copy the Resource ID, which is the Express Route Circuit ID
  • Under AVS – Connectivity – ExpressRoute Global Reach
    • Click on Add
    • Select the Subscription and Resource Group
    • Copy and paste the Authorization key and Express Route Circuit ID
    • Click Create
    • It will show as Connected

The intention here is to get you a few useful links on the Networking on Azure VMware Solution:

DescriptionLinks
AVS Network Setup – Video from Trevor DavisAzure VMware Solution – Network Setup – YouTube
VMware Documentation – Using Azure ExpressRoute with AVSDesignlet: Using Azure ExpressRoute with Azure VMware Solution for On-premises Connectivity | VMware
Azure ExpressRoute PricingPricing – ExpressRoute | Microsoft Azure
Previous Blog post – Mindmap AVS Networking guidanceMindmap – Azure VMware Solution – Guidance on Deployment and Networking | AskAresh
ExpressRoute Private PeetingGitHub – microsoft/Deploy-and-Optimize-Azure-ExpressRoute-Private-Peering: This deployment guide is focused on helping you deploy and optimize the Azure private peering, which enables connectivity between your private network and your Azure VNets over ExpressRoute.
Useful Links

I hope you will find this helpful information on your AVS Networking journey. Please let me know if I have missed any steps or good reference links, and I will be happy to update the post.

Thanks,
Aresh Sarkari

Tags: , , , , , ,

Mindmap – Part 2 – Managing Azure Virtual Desktop (AVD)

21 Jan

This blog post is in continuation of my part 1 – Mindmap – Part 1 – Azure Virtual Desktop (AVD) – Quick start guide to virtual desktop/applications | AskAresh where we look at deploying the AVD solution. In this post, I want to share my learnings with you all around the management and #Day2 aspects of AVD. We shall take a look into the following topics:

  • Mind map – Managing Azure Virtual Desktop
    • Scale Out – Add extra Host (VM) to the Host Pools
    • Lifecycle – Update your Master Image – Shared Image Gallery aka Azure compute galleries
    • Drain the old Session Host VM
    • Automatically Power ON the Session host Virtual Machines
    • Monitoring Azure Virtual Desktop

Mindmap for Managing Azure Virtual Desktop (AVD)

I have managed to document all the high-level steps involved in managing the AVD on an ongoing basis. The idea here is that the mindmap acts as an excellent visual representation of what to do during ongoing maintenance activities. You can figure out in advance the requirements/steps and pre-requisites.

Managing Azure Virtual Desktop
Managing Azure Virtual Desktop

Disclaimer – This guide is a get you started guide, and the production management may vary. Please make sure you always reference Microsoft documentation. Here is the PDF version if you would like to download and zoom in (Don’t stress your eyes!) –

managing-azure-virtual-desktop-twitter-40askareshDownload

I hope you will find this helpful information on your Managing Azure Virtual Desktop journey. Please let me know if I have missed any steps in the mindmap, and I will be happy to update the post.

Thanks,
Aresh Sarkari

Tags: , , , , , , , , ,

Mindmap – Part 1 – Azure Virtual Desktop (AVD) – Quick start guide to virtual desktop/applications

1 Nov

I have been learning Azure Virtual Desktop (AVD) from the awesome book DaaS – The Complete Guide: A Step-by-Step Guide on deploying Desktop-as-a-Service solutions from Microsoft, Nutanix, Citrix, VMware, Accops. I want to share my learnings with you all, and in this post, we shall take a look into the following topics:

  • Mind map for Azure Virtual Desktop – Getting started
    • Getting started with Azure Virtual Desktop (AVD)
    • Deployment – Pre-requisites for AVD
    • Master Images – (Windows 10 Multi-Session, Windows 10 1909 Enterprise or Windows Server 2019 DC)
    • Template and Shared Image Gallery
    • Host Pools
    • Application Groups
    • Workspaces
    • Windows Desktop Client
  • Quick Start Links

Mindmap for Azure Virtual Desktop (AVD) – Getting started

Managed to put together a mindmap on the AVD getting started from zero to a working desktop or application. The idea here is the mindmap acts as an excellent visual representation of what to do during pre-requisites, deployment and you can figure out in advance the requirements/steps and pre-requisites.

Azure Virtual Desktop

Disclaimer – This guide is a get you started guide, and the production settings and configuration might be different. Please make sure you change the settings appropriate for production workloads. Here is the PDF version if you would like to download and zoom in (Don’t stress your eyes!) –

azure-virtual-desktop-twitter-40askaresh-1Download

Change log

  • The Mindmap was last updated on 21st Jan 2022 with lots of changes!

The intention here is to get you quickly started on Azure Virtual Desktop Solution:

DescriptionLinks
Azure Virtual Desktop OverviewWhat is Azure Virtual Desktop? – Azure | Microsoft Docs
Azure Virtual Desktop technical (ARM-based model) deployment walkthrough. (Christiaan Brinkhoff)Azure Virtual Desktop technical (ARM-based model) deployment walkthrough. It covers all you need to know and beyond! | christiaanbrinkhoff.com – Sharing Cloud and Virtualization Knowledge
AVD Zero to Hero (YouTube – I am IT Geek)Series 5: Episode 1 – AVD Zero to Hero Introduction – YouTube (Playlist)
AVD PowerShellAzure Virtual Desktop PowerShell – Azure | Microsoft Docs
AVD PricingAzure Virtual Desktop | Microsoft Azure

I hope you will find this helpful information on your Azure Virtual Desktop journey. Please let me know if I have missed any steps in the mindmap, or reference links, and I will be happy to update the post.

Thanks,
Aresh Sarkari

Tags: , , , , , , ,

Mindmap – Azure VMware Solution – Guidance on Deployment and Networking

12 Oct

I have been trying out the Azure VMware Solution (AVS) on the VMware HOL and going through the techzone documentation. In this post, we shall take a look into these topics:

  • Mindmap – Steps for AVS Deployment and Networking
  • Quick Start Links
  • Optional – Deploy AVS via Azure Resource Manager Templates

Mindmap for AVS Deployment/Networking

Managed to put together a mindmap on the AVS deployment and networking steps of the service. The idea here is the mindmap acts like an excellent visual representation of what to do during deployment and you can figure out in advance the requirements/steps and pre-requisites.

Azure VMware Solution

Here is the PDF version if you would like to download and zoom-in

deploy-azure-vmware-solution-avs-network-connectivity-40askareshDownload

Quick Start Links

The intention here is to get you quickly started on Azure VMware Solution:

DescriptionLinks
AVS TechzoneAzure VMware Solution | VMware
AVS Hands-on LabAzure VMware Solution Hands-on Labs | VMware
AVS PricingPricing – Azure VMware Solution | Microsoft Azure
AVS (Microsoft Doco)Azure VMware Solution documentation – Azure VMware Solution | Microsoft Docs
AVS Logical DiagramAzure VMware Solution Logical Design
Useful Links

Optional – Deploying AVS using Azure Resource Manager

We can also deploy the AVS solution via PowerShell and using the Azure Resource Manager (ARM) template. The advantage here is you have slightly more advanced options that are not available via the GUI. (E.g. You can set the desired password for vCenter and NSX)

{
  "type": "Microsoft.AVS/privateClouds",
  "apiVersion": "2021-06-01",
  "name": "AE-1-AVS-01",
  "location": "Australia East",
  "tags": {
    "Billing": "IT",
    "Department": "IT"
  },
  "sku": {
    "name": "AV36"
  },
  "properties": {
    "circuit": {},
    "identitySources": [
      {
        "alias": "string",
        "baseGroupDN": "string",
        "baseUserDN": "string",
        "domain": "string",
        "name": "string",
        "password": "string",
        "primaryServer": "string",
        "secondaryServer": "string",
        "ssl": "string",
        "username": "string"
      }
    ],
    "internet": "string",
    "managementCluster": {
      "clusterSize": "3"
    },
    "networkBlock": "10.19.0.0/22",
    "nsxtPassword": "yourchoicepassword",
    "vcenterPassword": "yourchoicepassword"
  }
}

I hope you will find this helpful information on your AVS journey. Please let me know if I have missed any steps in the mindmap or reference links and I will be happy to update the post.

Thanks,
Aresh Sarkari

Tags: , , , , , , , ,

SAML Authentication Flow – Azure Active Directory and VMware Workspace ONE Access

28 Sep

Many blogs discuss and show in detail how to integrate the Azure Active Directory (AAD) with VMware Workspace ONE Access (WoA) as a 3rd party IDP, and the following are my top post on that topic:

However, in this blog post, I would like to shed more light on the SAML Authentication Flow between the Azure Active Directory (Identity Provider) and VMware Workspace ONE Access (Service Provider). When designing the WoA and AAD integration, the below flow helped me understand what is happening behind the scenes, and I thought of sharing my knowledge with you all.

  • SAML Authentication Flow
  • AuthnRequest
  • Issuer
  • NameIDPolicy
  • RequestAuthnContext
  • SAML Response that AAD sends to WoA

#ProTip – I use a Chrome/Edge extension called SAML-tracer to inspect the SAML responses back and forth within the browser.

SAML Authentication Flow

The diagram below describes the single sign-on sequence. The VMware Workspace ONE Access (the service provider) uses an HTTP Redirect binding to pass an AuthnRequest (authentication request) element to Azure AD (the 3rd party identity provider in case of WoA). Azure AD then uses an HTTP post binding to post a Response element to the cloud service.

SAML Authentication Flow – AAD and WoA
S. No.Description Flow
1.End-user tries to access the VMware Workspace ONE Access portal
2.VMware Workspace ONE Access finds the identity provider to authenticate the user
3.VMware Workspace ONE Access generates a SAML 2.0 AuthnRequest and redirects the user’s browser to the Azure AD SAML single sign-on URL
4.If the end-user is not signed in, Azure AD authenticates the user using multi-factor authentication & generates a SAML token
5.Azure AD posts the SAML response to the WoA application via the user’s browser
6.VMware Workspace ONE Access verifies the SAML Response
7.VMware Workspace ONE Access completes the end-user sign-in and presents the desktop/app entitlements

Note – I have randomly created the GUID within the XML response just for demonstration purposes.

AuthnRequest

To request a end-user authentication, from WoA portal send an AuthnRequest element to Azure AD.  Following is the SAML SAML 2.0 AuthnRequest from WoA portal:

<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                    AssertionConsumerServiceURL="https://askaresh.com/SAAS/auth/saml/response"
                    Destination="https://login.microsoftonline.com/adsadas-2312asdasd-asdasda-2312asdda/saml2"
                    ForceAuthn="false"
                    ID="_sdasdwqezxdasdasd2313asdas"
                    IssueInstant="2021-08-04T00:24:08.092Z"
                    ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                    ProviderName="askaresh.com"
                    Version="2.0"
                    >
 
</samlp:AuthnRequest>

Issuer

The Issuer element in an AuthnRequest must exactly match one of the ServicePrincipalNames in the cloud service in Azure AD. Typically, this is set to the App ID URI that is specified during application registration. (When the Enterprise Application is created under AAD portal)

<saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://askaresh.com/SAAS/API/1.0/GET/metadata/sp.xml</saml:Issuer>

NameIDPolicy

This element requests a particular name ID format in the response and is optional in AuthnRequest elements sent to Azure AD. A NameIdPolicy element looks like the following from WoA portal:

<samlp:NameIDPolicy AllowCreate="false"
                        Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"/>

RequestAuthnContext

The RequestedAuthnContext element specifies the desired authentication methods. It is optional in AuthnRequest elements sent to Azure AD. Azure AD supports AuthnContextClassRef values snippet from WoA portal:

<samlp:RequestedAuthnContext>
    <saml:AuthnContextClassRef xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml:AuthnContextClassRef>
</samlp:RequestedAuthnContext>

SAML Response AAD sends to WoA portal (Step 5-6)

The SAML Repsonse that AAD sends back to WoA portal:

<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                ID="_2132sdasdasdas-asdasd-aeeqwq-adsa"
                Version="2.0"
                IssueInstant="2021-08-04T02:39:06.365Z"
                Destination="https://askaresh.com/SAAS/auth/saml/response"
                InResponseTo="_ad123123213qws12312asa1"
                >
    <Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion">https://sts.windows.net/se13edsadsadasdasdasd2342342dasdas/</Issuer>
    <samlp:Status>
        <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" />
    </samlp:Status>
    <Assertion xmlns="urn:oasis:names:tc:SAML:2.0:assertion"
               ID="_324sadasdsa-adsa-asd1312-adsasdas"
               IssueInstant="2021-08-04T02:39:06.365Z"
               Version="2.0"
               >
        <Issuer>https://sts.windows.net/123asdasdas-adsa-asdsad-asdsad-4523213432asd/</Issuer>
        <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
            <SignedInfo>
                <CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
                <SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />
                <Reference URI="#_54fb024a-f2f0-4495-99c7-f47e3fd37701">
                    <Transforms>
                        <Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
                        <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
                    </Transforms>
                    <DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
                    <DigestValue>3213asdasdase3432sdsadasd2342432423675=</DigestValue>
                </Reference>
            </SignedInfo>
            <SignatureValue>SIGNATUREDATA==</SignatureValue>
            <KeyInfo>
                <X509Data>
                    <X509Certificate>CERTDATA==</X509Certificate>
                </X509Data>
            </KeyInfo>
        </Signature>
        <Subject>
            <NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">aresh@askaresh.com</NameID>
            <SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
                <SubjectConfirmationData InResponseTo="_aasdwqewqsadsadasdsa-asdasd-asdasd"
                                         NotOnOrAfter="2021-08-04T03:39:04.318Z"
                                         Recipient="https://askaresh.com/SAAS/auth/saml/response"
                                         />
            </SubjectConfirmation>
        </Subject>
        <Conditions NotBefore="2021-08-04T02:34:04.318Z"
                    NotOnOrAfter="2021-08-04T03:39:04.318Z"
                    >
            <AudienceRestriction>
                <Audience>https://askaresh.com/SAAS/API/1.0/GET/metadata/sp.xml</Audience>
            </AudienceRestriction>
        </Conditions>
        <AttributeStatement>
            <Attribute Name="http://schemas.microsoft.com/identity/claims/tenantid">
                <AttributeValue>adsad1-adsasdsa-adasdasd-adasdsa-12321321</AttributeValue>
            </Attribute>
            <Attribute Name="http://schemas.microsoft.com/identity/claims/objectidentifier">
                <AttributeValue>123dsfssdfw12312asdasdadasdxsas21s</AttributeValue>
            </Attribute>
            <Attribute Name="http://schemas.microsoft.com/identity/claims/identityprovider">
                <AttributeValue>https://sts.windows.net/131sdfsdfsdfsdcs13123123dsfsdfsdfxcr21e23rwadsadsa/</AttributeValue>
            </Attribute>
            <Attribute Name="http://schemas.microsoft.com/claims/authnmethodsreferences">
                <AttributeValue>http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password</AttributeValue>
            </Attribute>
            <Attribute Name="email">
                <AttributeValue>aresh@askaresh.com</AttributeValue>
            </Attribute>
            <Attribute Name="ExternalID">
                <AttributeValue>8711aaae-b7b3-4202-8faf-f2408ffd7cf9</AttributeValue>
            </Attribute>
            <Attribute Name="userName">
                <AttributeValue>aresh@askaresh.com</AttributeValue>
            </Attribute>
            <Attribute Name="userPrincipalName">
                <AttributeValue>aresh@askaresh.com</AttributeValue>
            </Attribute>
        </AttributeStatement>
        <AuthnStatement AuthnInstant="2021-08-04T02:38:59.239Z"
                        SessionIndex="_123123-adsasdsa-ad213123dsaasdsa"
                        >
            <AuthnContext>
                <AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</AuthnContextClassRef>
            </AuthnContext>
        </AuthnStatement>
    </Assertion>
</samlp:Response>

Reference Link

The above flow I learnt from an excellent Microsoft page – Azure Single Sign On SAML Protocol – Microsoft identity platform | Microsoft Docs. Without this article, it wouldn’t have been possible to understand this under the hood.

I hope you will find the above information helpful in your journey with AAD/WoA. A small request if you see any scope of improvisation or refinements. I hope you can share it back with me?

Thanks,
Aresh Sarkari

Tags: , , , , , ,

Newer Entries →