Web Application Firewall was always a big investment for a small or growing company as most of the top branded companies are charging a lot of money  A Web Application Firewall protects your application from common web vulnerabilities and exploits like SQL Injection or Cross site scripting. Azure provides enterprise grade Web Application Firewall through the Application Gateway. It comes in two pricing models, Medium and Large. More about sizes and instances you can find here, and more about pricing here

We can add the Application Gateway Web Application Firewall to protect our Azure Web App (PaaS) and our Web Application inside a VMs web server (IaaS). At this post we will see how to protect them both.

One difference in order to fully protect the Azure Web App (PaaS) is to integrate the App Service to a Virtual Network (VNET). In order to integrate an App Service to a Virtual Network it requires a Standard, Premium, or PremiumV2 pricing plan and requires the Virtual Network to have a Virtual Network Gateway that is configured with Point to Site VPN.

Virtual Network

First things first, create a VNET. The VNET must have at least two subnets. One subnet to deploy the Virtual Machine that we will use to publish an IIS Application and one dedicated for the Application Gateway WAF.

Once the VNET is created enable the Point-2-Site VPN. More details can be found here: https://www.e-apostolidis.gr/microsoft/azure/azure-start-point-point-to-site-vpn/ 

Web App

Create a Web App from Azure Portal. For more details check here: https://www.e-apostolidis.gr/microsoft/azure/azure-start-point-your-first-web-app/

VNet Integration

Once the Web App is ready, go to Networking and select “Click here to configure”

Add VNET, select the VNET and press save

Then go back to the Networking blade of the App Service and go to Firewall in order to disable public access and allow only access from the VNET. To do this click the “Configure Access Restrictions”

create an allow IP Restriction and add the WAF’s IP. Once you create an Allow rule, all other access to the app service is restricted automatically. If you try to browse the public URL of the App Service it will return “Error 403 – This web app is stopped.”

Web Application Firewall

Lets create the Secure public entry point for our Web App. Create an application gateway, select WAF Tier, select the required SKU, add it to the WAF subnet we created before, select Public IP configuration and WAF enabled.

When the Application gateway is ready we need to do some configuration. First at the Backend pools, open the default created backend pool, select “App Service” and browse to the required web app.

Then add a health probe. For host add the FQDN of the Web App.

at the HTTP settings check the “Use for App service”

Add a rule to bind the Listener, Backendpool and HTTP settings

And that’s all. Now we can try our Web App from the Internet. In order to do so we need to browse to the Web App’s URL, that is now published by the Application Gateway, from the Internet. So, we need to create a Public DNS record to point the FQDN to the Application Gateway’s FQDN. In this case we need to crate a CNAME papwaf3app.funniest.gr to point to the 8b0510c1-47e9-4b94-a0ff-af92e4455840.cloudapp.net. In order to test the app right now we can just add a host file to our computer pointing to the Public IP Address of the application gateway and we can access the Web App behind the WAF.

Logging

In order to be able to see the Application Gateway and Web Application Firewall logs we need to turn on diagnostics. The easiest way to see the logs is by sending them to Log Analytics (OMS).

With the Firewall at “Detection” mode, if we try an SQL Injection (?id=10||UTL_INADDR.GET_HOST_NAME( (SELECT user FROM DUAL) )–), the Web App still servers the landing page.

By switching the Firewall to “Prevention” mode, the same SQL injection attach stops by the WAF before accessing our Web App.

Protect an IaaS Web Application

To add a Web Application that runs inside a VM behind the Application Gateway Web Application Firewall, first add the VM as a Back End Pool. Create a new Backend Pool and select “Virtual Machine”. Select the Virtual Machine that runs the Web Application.

Then create a new probe adding the URL of the Web Application

next add HTTP settings and add custom probe the new created probe “vmsite”

Next step is to create two multi-site listeners, one for each host name

After the listener, add a Basic rule using the Listener, Backend Pool and HTTP settings we created for the VM Web Application,

Finally one extra step is to change the default rule1 to listen to the WeB App listener

Finally the Application Gateway Web Application Firewall provides secure access to both the Web App (PaaS) and the VM Web Application (IaaS)

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Protect your Web App using Azure Application Gateway Web Application Firewall appeared first on Apostolidis Cloud Corner.

With the new Dv3 and Ev3 VM sizes Microsoft has released the Nested Virtualization, meaning you can simply have a Hyper-V VM inside an Azure VM. I have created a set of posts to explore the Nested Virtualization functionality. Of course nested virtualization is only supported in Windows Server 2016.

Microsoft Azure Nested Virtualization

• Hyper-V VM inside Azure VM
• Hyper-V Replica on Azure
• Web Server
• VM in Nested VM in Azure VM

At my previous post, Microsoft Azure Nested Virtualization | Hyper-V VM inside Azure VM, I described how to create a Hyper-V VM inside an Azure VM with the new Dv3 and Ev3 VM sizes. Now we will see how to use a Hyper-V Nested VM as a Web Server that is hidden behind the Azure VM to secure access to your web application.

Starting we will add the IIS Role at the Nested VM. Go to the Server Manager, add Roles and Features and select the Web Server (IIS) Role.

Select the Features that your application requires and Install.

After that we will need to Forward the required ports to the Nested VMs. To accomplish this we will need to use PowerShell.

At my previews post I created a NAT in order to have network communication between the Host and the Nested VM. We will use that NAT to forward the port 80 and 443 to the Nested VM.

At the Host Azure VM open the PowerShell and rum:

Get-NetNat

From the results we can see the NAT Name.

Now we can create the Rules:

Add-NetNatStaticMapping -NatName "NVMNat" -Protocol TCP -ExternalIPAddress 0.0.0.0 -InternalIPAddress 192.168.168.10 -InternalPort 80 -ExternalPort 80
Add-NetNatStaticMapping -NatName "NVMNat" -Protocol TCP -ExternalIPAddress 0.0.0.0 -InternalIPAddress 192.168.168.10 -InternalPort 443 -ExternalPort 443

A final step is to create a rule at the Azure VM’s NSG to allow port 80 & 443 and also open the ports at the Windows Firewall on both the Host and the Nested VMs.

Finally we can browse to the Public IP of the Azure VM and see the IIS Welcome Page of the Nested VM.

Just add an https binding to the IIS default website and also browse at the https page.

Stay tuned for more usage scenarios for the Microsoft Azure Nested Virtualization!

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Microsoft Azure Nested Virtualization | Web Server appeared first on Apostolidis Cloud Corner.

With the new Dv3 and Ev3 VM sizes Microsoft has released the Nested Virtualization, meaning you can simply have a Hyper-V VM inside an Azure VM. I have created a set of posts to explore the Nested Virtualization functionality. Of course nested virtualization is only supported in Windows Server 2016.

Microsoft Azure Nested Virtualization

• Hyper-V VM inside Azure VM
• Hyper-V Replica on Azure
• Web Server
• VM in Nested VM in Azure VM

At the first port, we will create a Hyper-V VM inside an Azure VM and have Network and Internet Connectivity.

Lets get started. First of all we will need a Dv3 or Ev3 VM and for best Nested Virtualization performance make use of SSD Managed Disks. I created a D4s_v3 Standard  (4Cores, 16GB Ram, SSD managed disks) and I attached a 1023GB SSD Data Disk for performance.

Now remote desktop to the VM to add the Hyper V Role. From the Server Manager, add Roles and Features and add the Hyper-V role

Since this is an one NIC VM select the NIC to create the Virtual Switch

Change the default Store location to the SSD Data Disk, in this case the E: drive.

Finally wait for the installation to complete and reboot the VM. After the VM reboots, Remote Desktop and open the Hyper-V manager. Now we have Hyper-V inside an Azure VM.

Lets create a VM. You can download a Trial Windows Server 2016 from https://www.microsoft.com/en-us/evalcenter/evaluate-windows-server-2016 or use your Subscription (MSDN, EA, etc).

I created a VM Called NestedVM01, with 4GB Ram using the Trial Windows Server 2016 ISO

After the VM creation setup the Windows Server 2016 with all defaults and login.

The first thing to notice is that the Network Interface does not have a valid IP address, since Microsoft Azure will not provide one. In order to have the Nested VM to have Network connectivity we need to use NAT.

First change the Virtual Switch to “Internal network”

At the Host’s Network interfaces, open the vEthernet NIC and add a static IP, only IP & Mask

Now we will need PowerShell, since we cannot configure NAT form the GUI.

Open the PowerShell (still at the Host Azure VM) and run

New-NetNat –Name NVMNat –InternalIPInterfaceAddressPrefix 192.168.168.0/24

The result:

After that we can provide the Nested VMs with IPs form the 192.168.168.0/24 range. So login to the Nested VM and add an IP fron the Range and for Default Gateway add the Host’s IP.

For DNS add your AD DNS or a Public DNS server just to have internet.

Now from the Nested VM you can ping the Host:

And also browse the Internet:

Stay tuned, on my next post we will see how we can make the Nested VM a Web Server, a hidden Web Server in a VM inside an Azure VM!

Of course this Features opens the door for many more features to test, like Hyper-V Replica, Containers, etc, that we will see in future posts.

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Microsoft Azure Nested Virtualization | Hyper-V VM inside Azure VM appeared first on Apostolidis Cloud Corner.

This post is my view of a complete guide, from A to Z, including both the Windows Server part and the Azure Portal part on how to build a Web Farm using IIS & Azure File storage. Following this guide you will have a functional two server IIS Web Farm using Azure File storage.

To create a Web Server Farm the mail requirement is a high available common storage. I see that when deploying on Azure, a lot of people are using DFSR for common storage. This solution has two major issues, the first is the cost, because you need at least two Windows Servers and second the replication speed that many times doesn’t cover the web servers needs.

Azure File storage provides a very fast, high available and cheap solution to create a web server farm on Azure.

Azure File storage supports both SMB 2.1 & 3.0 protocol. Every share can be up to 5TB, storing unlimited number of files and each file can be up to 1TB. Of course we can create as many shares as needed up to 500TB that is the Storage Account limit. Also every share provided 1000 IOPS.

For this guide I used one Windows Server 2016 for Domain Controller, two Windows Server 2016 for web servers and one Standard Storage Account for Azure Files. Of course you can create an IIS Web Farm with workgroup server, but I will cover this at an other post.

I will skip the part of creating the Azure VMs, the domain and joining the servers on it, so I assume that there is a domain and the other two servers are member servers of the domain.

Just a note, when creating the Azure VMs that will be part of the IIS Farm remember to add them to the same Availability Set. This will inform the Azure Fabric to have the VMs to different update & fault domains

Step 1. Add the Web Server role

From the Server Manager, click Add roles and features and add the “Web Server (IIS)” role and at the next screen add all the features your app needs.

Step 2. Add Application Request Routing

For more feature and control over the IIS load balance add the Application Request Routing (ARR) using the Web Platform Installer. The Web Platform Installer uses the Internet Explorer engine so I disable the “IE Enhanced Security Configuration” just for the installation and then enable it. You can do it from the Server Manager, at the Server section.

Next, open the IIS Manager and at the Actions Panel (on the right) click the “Get New Web Platform Components”

Search for “arr”, and add the Application request routing 3.0

Step 3. Create an Azure Storage Account for Azure File Storage

To create the Azure File storage shares, go to the Azure Portal, click the + button and create a Standard Storage account (you can just search for storage account)

Select General purpose and Standard performance (Premium does not support Azure Files)

once the storage account is created, open it and click the “Files” button

Click the “+ File share” to add a file share

Give it a name and quota limit

After clicking OK the share will be created and it will be listed at the shares blade.

Click on it to get the connection string and then click Connect to get the access key. At this point copy the “Connecting from Windows” command. We will use this to mount the share to the web servers.

Finally click the File Share and at the new blade press “+Add Directory” and create two directories, one Configuration and one Data

Step 4. Configure Windows Firewall & NSG

Open the port 80 (and nay other requires ports) at the Windows firewall and at the NSGs

for the windows firewall, go to the Servers’s control panel, Windows Firewall and click “Advanced Settings”

go to the Inbound Rules, add New Rule and select Port

Select TCP 80 (and any other needed for your application/site)

Allow the rule for all profiles, provide a name and press finish to create the rule

For the NSGs , go to the Azure Portal, open the NSGs of the web servers and add an http allow rule like below

Step 5. Create the IIS Shared Configuration

Go back to the first web server, open Computer Manager and add a new user with username and password the same as the connection string of the Azure Files share. You will need this for the IIS Service to access the Azure File storage share.

Add the user to the IIS_IUSRS group

Then open the IIS Manager and click the “Shared Configuration”

at the Action pane click “Export Configuration”

add the Azure File storage Share UNC path and “Connect As” using the share’s credentials

Enter a complex encryption key and press ok to export the configuration to the Azure File storage “configuration” share

EDIT: if you experience issues when trying to export the configuration directly to the shared location try to export the configuration to a local path and then copy the files to the shared location. This Microsoft support article describes the issue: https://support.microsoft.com/en-us/help/2511835/configuration-files-cannot-be-exported-to-a-dfs-share-through-the-inte

Now we can enable the Shared Configuration, add the Configuration Share path and the same credentials and click apply.

it will ask for the encryption key and finally the Shared Configuration will be enabled. You will need to restart the IIS Manager console

at this point we can change the path of application pools, ftp applications etc to the Data folder share of the Azure File storage. Just note that you will need to use the UNC path “\\azurefilesol.file.core.windows.net\iisfarm\Data” and not any mapped drive.

Repeat the above steps to the second web server. At the Shared Configuration don’t export the configuration, just enable the Shared Configuration.

Finally we can create the Farm, from the IIS Manager, right click at the “Server Farms” and click “Create Server Farm…”

give a farm name,

add both servers and press Finish

Press NO at the URL rewrite rule auto creation

And the farm is ready

as mentioned before, deploy your Web Site, Web Application etc to the Data file share, always using the full UNC path “\\azurefilesol.file.core.windows.net\iisfarm\Data”. All the website data will reside at the Azure File storage.

If you need more than 1000 IOPS create more Azure Files storage shares and divine your website/application data.

Run the following command to allow access to the Azure File storage. Change the file://”path” as needed

C:\Windows\Microsoft.NET\Framework64\v4.0.30319>caspol -m -ag 1. -url file://azurefilesol.file.core.windows.net/iisfarm/* FullTrust

Step 5. Azure Load Balancer

Finally, create a Load Balancer to distribute incomming traffic to the farm. For this guide I will create an External Load Balancer, but also an Internal Load Balancer is supported.

First, find and create the Load Balancer from the Azure Portal

provide a name, for external load balancer select Public, select Dynamic or Static IP, resource group, location and press Create

Then go to the new load balancer and create a health probe

create an http probe

provide a name, select Availability Set for association and add both the Web Servers

finally create a load balancing rule to load balance the TCP port 80 at the farm

once the load balance rule is created you can browse the public ip / name of the load balancer

Now, browse to the load balancer’s IP and you are good to go!

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Azure Web Farm using IIS & Azure File storage appeared first on Apostolidis Cloud Corner.

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Fix IIS listener when changing IP address of the server appeared first on Apostolidis Cloud Corner.