virtual machine Archives - Apostolidis Cloud Corner

Deploy VM from Azure SIG in new Resource Group

Pantelis Apostolidis — Thu, 04 Feb 2021 15:03:12 +0000

Deploy VM from Azure SIG in new Resource Group

This is a template that first creates a Resource Group, and then it deploys a Virtual Machine from an image version of the Shared Image Gallery. It provides the Public IP and Hostname for outputs.

Currently it only asks for the SIG image version and an environment value to create the naming convention of the resources.

GitHub: https://github.com/proximagr/ARMTemplates/blob/master/VM-from-SIG-in-new-RG/VM-from-SIG-in-new-RG.json

{
    "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "galleryimageversion": {
            "type": "string",
            "defaultValue": "10.0.2"
        },
        "envname": {
            "type": "string",
            "defaultValue": "test"
        }
    },
    "variables": {
        "basename": "[concat(parameters('envname'),substring(deployment().name,0,6))]",
        "rgname": "[concat('rg-', substring(variables('basename'), 0, 10))]",
        "region": "francecentral"
    },
    "resources": [
        {
            "name": "[variables('rgname')]",
            "type": "Microsoft.Resources/resourceGroups",
            "apiVersion": "2019-10-01",
            "location": "[variables('region')]",
            "dependsOn": [
            ],
            "tags": {
            }
        },
        {
            "type": "Microsoft.Resources/deployments",
            "resourceGroup": "[variables('rgname')]",
            "dependsOn": [
                "[resourceId('Microsoft.Resources/resourceGroups',variables('rgname'))]"
            ],
            "apiVersion": "2019-10-01",
            "name": "nestedTemplate1",
            "properties": {
                "expressionEvaluationOptions": {
                    "scope": "inner"
                },
                "mode": "Incremental",
                "parameters": {
                    "galleryImageVersionName": {
                        "value": "[parameters('galleryimageversion')]"
                    },
                    "envname": {
                        "value": "[parameters('envname')]"
                    }

                },
                "template": {
                    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                    "contentVersion": "1.0.0.0",
                    "parameters": {
                        "galleryImageVersionName": {
                            "type": "string"
                        },
                        "envname": {
                            "type": "string"
                        }
                    },
                    "variables": {
                        "basename": "[concat(parameters('envname'),substring(deployment().name,0,6))]",
                        "pubipname": "[concat( 'pip-',variables('basename'))]",
                        "pubipdns": "[concat( 'vm-',variables('basename'))]",
                        "region": "francecentral",
                        "adminUsername": "uiadmin",
                        "adminPassword": "ThisIs1Password!",
                        "galleryName": "demosig",
                        "galleryImageDefinitionName": "demoid",
                        "nicName": "[concat( 'nic-',variables('basename'))]",
                        "addressPrefix": "10.0.0.0/24",
                        "subnetName": "[concat( 'sub-',variables('basename'))]",
                        "subnetPrefix": "10.0.0.0/24",
                        "vmName": "[concat( 'vm-',variables('basename'))]",
                        "virtualNetworkName": "[concat( 'vnet-',variables('basename'))]",
                        "subnetRef": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworkName'), variables('subnetName'))]",
                        "networkSecurityGroupName": "[concat( 'nsg-',variables('basename'))]"
                    },
                    "resources": [
                        {
                            "name": "[variables('pubipname')]",
                            "type": "Microsoft.Network/publicIPAddresses",
                            "apiVersion": "2019-11-01",
                            "location": "[variables('region')]",
                            "tags": {
                                "displayName": "publicIPAddress1"
                            },
                            "properties": {
                                "publicIPAllocationMethod": "Static",
                                "dnsSettings": {
                                    "domainNameLabel": "[variables('pubipdns')]"
                                }
                            }
                        },
                        {
                            "comments": "Simple Network Security Group for subnet [variables('subnetName')]",
                            "type": "Microsoft.Network/networkSecurityGroups",
                            "apiVersion": "2019-08-01",
                            "name": "[variables('networkSecurityGroupName')]",
                            "location": "[variables('region')]",
                            "properties": {
                                "securityRules": [
                                    {
                                        "name": "default-allow-22",
                                        "properties": {
                                            "priority": 1000,
                                            "access": "Allow",
                                            "direction": "Inbound",
                                            "destinationPortRange": "22",
                                            "protocol": "Tcp",
                                            "sourceAddressPrefix": "*",
                                            "sourcePortRange": "*",
                                            "destinationAddressPrefix": "*"
                                        }
                                    },
                                    {
                                        "name": "default-allow-3389",
                                        "properties": {
                                            "priority": 1001,
                                            "access": "Allow",
                                            "direction": "Inbound",
                                            "destinationPortRange": "3389",
                                            "protocol": "Tcp",
                                            "sourceAddressPrefix": "*",
                                            "sourcePortRange": "*",
                                            "destinationAddressPrefix": "*"
                                        }
                                    }
                                ]
                            }
                        },
                        {
                            "type": "Microsoft.Network/virtualNetworks",
                            "name": "[variables('virtualNetworkName')]",
                            "apiVersion": "2016-03-30",
                            "location": "[variables('region')]",
                            "dependsOn": [
                                "[resourceId('Microsoft.Network/networkSecurityGroups', variables('networkSecurityGroupName'))]"
                            ],
                            "properties": {
                                "addressSpace": {
                                    "addressPrefixes": [
                                        "[variables('addressPrefix')]"
                                    ]
                                },
                                "subnets": [
                                    {
                                        "name": "[variables('subnetName')]",
                                        "properties": {
                                            "addressPrefix": "[variables('subnetPrefix')]",
                                            "networkSecurityGroup": {
                                                "id": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('networkSecurityGroupName'))]"
                                            }
                                        }
                                    }
                                ]
                            }
                        },
                        {
                            "type": "Microsoft.Network/networkInterfaces",
                            "name": "[variables('nicName')]",
                            "apiVersion": "2016-03-30",
                            "location": "[variables('region')]",
                            "properties": {
                                "ipConfigurations": [
                                    {
                                        "name": "ipconfig1",
                                        "properties": {
                                            "privateIPAllocationMethod": "Dynamic",
                                            "publicIPAddress": {
                                                "id": "[resourceId('Microsoft.Network/publicIPAddresses',variables('pubipname'))]"
                                            },
                                            "subnet": {
                                                "id": "[variables('subnetRef')]"
                                            }
                                        }
                                    }
                                ]
                            },
                            "dependsOn": [
                                "[resourceId('Microsoft.Network/publicIPAddresses/', variables('pubipname'))]",
                                "[resourceId('Microsoft.Network/virtualNetworks/', variables('virtualNetworkName'))]"
                            ]
                        },
                        {
                            "type": "Microsoft.Compute/virtualMachines",
                            "name": "[variables('vmName')]",
                            "apiVersion": "2019-07-01",
                            "location": "[variables('region')]",
                            "properties": {
                                "hardwareProfile": {
                                    "vmSize": "Standard_F8s_v2"
                                },
                                "osProfile": {
                                    "computerName": "[variables('vmName')]",
                                    "adminUsername": "[variables('adminUsername')]",
                                    "adminPassword": "[variables('adminPassword')]"
                                },
                                "storageProfile": {
                                    "imageReference": {
                                        "id": "[resourceId('Microsoft.Compute/galleries/images/versions', variables('galleryName'), variables('galleryImageDefinitionName'), parameters('galleryImageVersionName'))]"
                                    }
                                },
                                "networkProfile": {
                                    "networkInterfaces": [
                                        {
                                            "id": "[resourceId('Microsoft.Network/networkInterfaces',variables('nicName'))]"
                                        }
                                    ]
                                }
                            },
                            "dependsOn": [
                                "[resourceId('Microsoft.Network/networkInterfaces/', variables('nicName'))]"
                            ]
                        }
                    ],
                    "outputs": {
                        "publicipn": {
                            "type": "string",
                            "value": "[reference(variables('pubipname')).dnsSettings.fqdn]"
                        },
                        "publicipa": {
                            "type": "string",
                            "value": "[reference(variables('pubipname')).ipAddress]"
                        }
                    }
                }
            }
        }
    ],
    "outputs": {
        "hostname": {
            "type": "string",
            "value": "[reference('nestedTemplate1').outputs.publicipn.value]"
        },
        "ipaddress": {
            "type": "string",
            "value": "[reference('nestedTemplate1').outputs.publicipa.value]"
        }
    }
}

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Deploy VM from Azure SIG in new Resource Group appeared first on Apostolidis Cloud Corner.

Move your Azure VM across regions

Pantelis Apostolidis — Tue, 15 Dec 2020 14:06:06 +0000

Move your Azure VM across regions

Azure Resource Mover makes it really easy to move your resources, like Azure VMs, across regions. There are some minor details you need to take care to have the whole process run smoothly.

Let’s see how we can move our VM from a region to an other with simple steps

At the Azure Portal search for “Azure Resource Mover”

2. At the Azure Resource Mover” wizard click “Move across regions”

3. Select the source & target region

4. select the resources you want to move

5. Accept the notification and start he process and go to the “Across Regions” option and press “Validate dependencies” button in the middle

6. After the validation, check the Issues column of all resources and resolve if any.

7. First we need to move the Resource Groups only. The move process has four steps, the Prepare, the Initiate Move , the Commit move and finally delete the source resources. So, select only all the “resources groups” and press “Prepare”

8. Select again the Resource Groups and press “Initiate Move”

9. Select gain the Resource Groups and press “Commit Move”

10. Now the Resource Groups are created at the target region, and is at pending deletion at the source. We can proceed with the rest resources. Select the rest resources and go through the same process, the Prepare, the Initiate Move , the Commit move and finally delete the source resources.

At the Prepare state, the Azure Site Recovery agent is installed at the VM and the data are replicated to the target region. This takes a lot of time, depending on the size of the data but it does not affect the VM.

Sneak peak: You can view the process of the VM, by navigating to the VM blade and go to the Disaster Recovery setting

11. Once all resources are in “Initiate move” pending state, select them and press “Initiate Move”. ATTENTION: at this state, there will be downtime to move the VMs. The source VMs will show down, a final data sync will be performed and finally the target VMs will start.

12. Wait until all resources are at the Commit Move state, select them and press “Commit Move”

at this state, we can see that we have two resource groups, the source and the target:

At the source resource group, the VMs will be stopped and at the target started. Note here that the target IP is not the same as the Source. Your Public IPs will be altered.

13. After the commit move, you will need to delete the source resources manually.

More info at: About the move process in Azure Resource Mover | Microsoft Docs

Pantelis Apostolidis

www.cloudcorner.gr

The post Move your Azure VM across regions appeared first on Apostolidis Cloud Corner.

VMWare Workstation Player on Azure VM for testing

Pantelis Apostolidis — Thu, 19 Nov 2020 10:20:55 +0000

VMWare Workstation Player on Azure VM for testing | Updated September 2021

I had a request to run VMWare Workstation Player on an Azure VM for some testing and labs. Challenge accepted!

UPDATE: Since version 15.5, VMware Workstation & Player Supports Host Hyper-V Mode. Find out more here & here

Demo environment:

Azure VM Standard E4s_v4 Gen 1 running Windows 10 2004 Enterprise

I tested it also with Windows 10 20H2 Enterprise, and since the Hyper-V mode is supported, it should run at all Windows Client & Server OSs that support nested virtualization and to all E_v4 & D_v4 Azure VM Serries.

To enable the Hyper-V Mode Support we need first to enable Hyper-V at the Windows Host via the add/remove features GUIor PowerShell

Via PowerShell Run:

Enable-WindowsOptionalFeature -Online -FeatureName HypervisorPlatform -All
Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V -All

and restart

Installed VMWare Workstation Player 16.0 free for non-commercial use, download from here: VMware Workstation Player – VMware Customer Connect

After the installation, I opened the VMWare Workstation Player and I managed to set up and run a Windows 10 VM.

Pantelis Apostolidis

www.cloudcorner.gr

The post VMWare Workstation Player on Azure VM for testing appeared first on Apostolidis Cloud Corner.

Azure Portal | Playing with Disk Snapshot

Pantelis Apostolidis — Mon, 07 Oct 2019 20:34:36 +0000

Azure Portal | Playing with Disk Snapshot

Disk Snapshot is a powerful tool to manage Azure VMs. It’s simple to create and can help the administrators in various tasks. It’s a fast and efficient way to have a crash-consistent Disk of a Virtual Machine, before performing tasks, updates, configuration changes, application installations, etc. Of course the last line of defence is the Azure Backup, but using the Snapshot you don’t need to wait the whole Backup / Restore times. With snapshots there are two main options to recover the VM. One is using the “swap OS Disk” functionality, which gives you the ease to swap the Operating System disk with one click. The other option is to create a new VIrtual Machine. Beware, if you want to make Azure VM clones, you need to generalize the VM with Sysprep and Capture the VM. Using the Snapshot option you will have an identical VM, with the same IDs.

Snapshot

The first step is to create a snapshot from the Virtual Disk. Open the Azure VM, go to Disks, select the OS Disk and press “Create Snapshot”. You don’t actually need to stop the VM. Windows Server operating system stays fully consistent, but no one can guarantee the consistency of any databases currently running. Think of it like the Hyper V CheckPoint functionality. We make checkpoints all the time and we revert to them even in production.

The Create snapshot screen will open. Fill in a name and disk account type (Standard / Premium) and press create.

At this point I will create a folder at the VM for revision

Create a Disk

To make the snapshot functional, we need to create a Managed Disk resource.

At the Create managed disk wizard, select the Region that the Snapshot resides. Then select “Source type” Snapshot and select it. At the Size, select a disk size at least the same as the source disk.

Swap OS Disk

Now that we have created the managed disk, it’s time to use the Swap OS Disk functionality. We have proceeded with the Azure VM’s updates, software updates, configuration changes, and finally we need to roll back those changes. Go to the VM’s Disks and press “Swap OS Disk”

at the “Swap OS Disk” wizard, select the managed disk that we created.

In the background, the Azure Platform will stop, deallocate the VM and it will re-crate it with the selected OS disk. As you see at the next screenshot the OS disk is the managed disk that we created from teh snapshot.

I Started the VM and logged in. The folder I created after the snapshot of course is missing 🙂

New Azure VM

The other option is to create a new Virtual Machine using the Snapshot. As I wrote before, beware, if you want to make Azure VM clones, you need to generalize the VM with Sysprep and Capture the VM. Using the Snapshot option you will have an identical VM, with the same IDs.

To create a VM from the Snapshot, just open the Managed Disk that you created from the Snapshot and press Create VM.

The Create a virtual machine wizard will open, and at the Operating System Image section, it will have selected the image from the disk. This process is identical to creating a new Hyper V VM from an existing virtual disk.

Follow the Create a virtual machine wizard exactly the same as creating any Azure VM.

More e-apostolidis.gr posts about managed disks: https://www.e-apostolidis.gr/tag/managed-disks/

Pantelis Apostolidis

www.cloudcorner.gr

The post Azure Portal | Playing with Disk Snapshot appeared first on Apostolidis Cloud Corner.

Azure Monitor for VMs – Health, Performance & Service Map

Pantelis Apostolidis — Thu, 07 Feb 2019 13:58:51 +0000

Get real insights about your Windows and Linux VMs & VMSSs performance and their dependencies with Azure Monitor. Integrate with Log Analytics for even more in depth analysis and retain the data over time. Health, Performance & Service Map of your VM in a dashboard.

Deploy to Single VM

For a single VM, go to the VMs blade, scroll down to the “Monitoring” section, select “Insights” and press “Try now”

The Azure Monitor Insights Onboarding wizard will open. If your VM is already onboard at a Log Analytics workspace just click Enable. Otherwize select a Log Analytics workspace or create one.

You will start seeing data form the VM in about 20-30 minutes.

Deploy to multiple VMs using Azure Policy

For deploying to multiple VMs, the easiest way is to use Azure Policy

Go to the Azure Policy, select Assignments and press “Assign initiative”

The first option is the Scope. Press the three dots “…” at the Scope field. You can choose a a Management Group, a Subscription or a Resource Group. So if you just select a Management Group (And don’t select subscription and resource group), this policy will apply to all Subscriptions under the Management Group and of course to all resources of the subscription. If you choose a Subscription (and don’t select a resource group then the policy will apply to all resources of the subscription. Finally if you choose a resource group then the policy will apply only to this resource group. Later we will see how to select specific VMs in the Subscription or Resource group.

After selecting the Scope you can add exclusions. There you can check the VMs you don’t want this policy to apply.

The next step is to select the Policy. At the BASICS section, press the three dots “…” near the “Initiative definition” and find the “Enable Azure Monitor for VMs”

Next step is to configure the Parameters. There select the Log Analytics workspace that the VM will onboard, or create a new one. Optionally you can provide a list of VMs instead of adding all of them

Finally press Apply. Back at the Azure Policy main menu you will see the new Definition Assignment.

View the Health / Performance / Service Map of the VMs

To view the Azure Monitor of the VMs, go to the VM that you have enabled Insights, select the Insights blade and you will be able to see the health status not only for the common CPU. Memory, Disk,

But also for the services that run inside the VM and the Azure Monitor discovered.

By clicking on any service you will have a list of all logs of this service

At the performance section you have the ability to select time range and have performance analytics for a requisted period of time

Finally at the MAp, you have a service map of the services and ports that are open and listening

Product Documentation: https://docs.microsoft.com/en-us/azure/azure-monitor/insights/vminsights-overview

Pantelis Apostolidis

www.cloudcorner.gr

The post Azure Monitor for VMs – Health, Performance & Service Map appeared first on Apostolidis Cloud Corner.

Azure Backup | Enable backup alert notifications

Pantelis Apostolidis — Wed, 12 Sep 2018 13:37:57 +0000

Azure Backup | Enable backup alert notifications

Azure Backup generates alerts for all backup events, such as unsuccessful backups. A new option is to create backup alert notifications so Azure Backup will alert you firing an email when an alert is generated.

To enable the backup alert notifications, navigate to the “Backup Alerts” section of the “recovery Services vault” and click the “Configure notifications”

There switch the Email notification to On to enable the alerts. Enter one or more recipients separated with semicolon (;). Choose Per Alert or Hourly Digest. Per Alert will fire an email for every alert instantly and the Hourly Digest means that the notification agent will check for alerts every hour and will fire an email with the active alerts.

Finally choose the Severity of the alerts which you will be notified and press save.

Pantelis Apostolidis

www.cloudcorner.gr

The post Azure Backup | Enable backup alert notifications appeared first on Apostolidis Cloud Corner.

Azure Portal Tip | Virtual Machines bulk actions

Pantelis Apostolidis — Mon, 10 Sep 2018 21:24:01 +0000

Azure Portal | Virtual Machines bulk actions

Azure Portal is a great GUI tool to administer all your Azure Resources and it continues evolving. Here is a very useful Tip. Did you know that you can manage Virtual Machines in bulk using the Azure Portal VIrtual Machines section? We have virtual machines bulk actions!

Not only we can Assign Tags, Start, Restart, Stop and Delete Virtual Machines in bulk but also configure Change Tracking, Inventory and Update Management!!

Filter out the Virtual Machines needed and just click the “Change Tracking” to have a report off all changes that happens inside the VM, like changes to services for Windows, daemons for Linux, applications and file changes.

Use the “Inventory” to have a complete inventory of all the installed applications of the VM. Enable consistent control and compliance of these virtual machines.

Enable the “Update Management” to manage the Updates of the selected Virtual Machines. Create update policies and control the installation of the updates.

Pantelis Apostolidis

www.cloudcorner.gr

The post Azure Portal Tip | Virtual Machines bulk actions appeared first on Apostolidis Cloud Corner.

Bulletproof manage your Azure VMs

Pantelis Apostolidis — Sun, 03 Dec 2017 21:35:58 +0000

Bulletproof manage your Azure VMs

Continuing the Azure Security Center posts, today we will see a new feature of the Security Center, called Just in Time VM Access.

As best security practice, all the management ports of a Virtual Machine should be closed using Network Security Groups. Only the ports required for any published services should be opened, if any.

However there are many occasions that we are requested to open a management port for administration or a service port for some tests for short time. This action has two major problems, first it requires a lot of administration time, because the administrator must go to the Azure Portal and add a rule at the VM’s NSG. The second problem is that many time the port is forgotten open and this is a major vulnerability since the majority of the Brute Force attacks are performed to the management ports, 22 and 3389.

Here comes the Azure Security Center, with the Just in Time VM Access feature. With this feature we can use the RBAC of the azure Portal and allow specific users to Request a predefined port to be opened for a short time frame.

JIT Configuration

Lets see how we configure the JIT. First we need to go to the Azure Security Center. Scroll down to the ADVANCED CLOUD DEFENSE and click the “Just in time VM Access”. Since it is at a Preview you need to press the “Try Just in time VM access”

After we enable JIT, the window displays tree tabs, the Configured, the Recommended and the No recommendation. The Configured tab displays the Virtual Machines that we have already enabled JIT. The recommended are VMs that have NSGs and are recommended to be enabled for JIT. The No recommendation are Classic VMs or VMs that don’t have attached NSG.

To enable JIT for a VM, go to the Recommended tab, select one or more VMs and press “Enable JIT on x VMs”

At the “JIT VM access configuration” the Security Center proposes rule with the default management ports. We can add other ports that we need and also remove any of them that are unnecessary.

At each rule we can configure the Port, the Protocol, the Source IP and the Maximum request time.

If we leave the “Allowed source IPs” to “Per request” then we allow the requester to decide. One very interesting setting here is that when a user requests access it has the option to allow only the Public IP that he is using at that time automatically.

With the last option, the “Max request time” we narrow down the maximum time that we will allow a port to be opened.

After we configure all the parameters we click Save and the VM moves to the Configured tab. At any time we can change the configuration by selecting the VM, press the three dots at the end of the line (…) and click Edit.

The Propertied button opens the VM’s blade, the Activity log shows all the users that requested access and the Remove of course disabled the JIT.

Behind the scene

What really happens to the VM? if you browse to the NSG that is attached to the VM you will see that all the port rules configured at the JIT are added as NSG Rules with lower priority than all the other rules. All other rules automatically changed priority to higher.

Lets see how we request access and what happens in the background. To request access go to the Security Center / JIT , select the VM and press “Request Access”

At the “Request access” blade switch on the desired port, select “My IP” or “IP Range” and the Timerange, all according to the JIT configuration of the VM. Finally press “Open Ports”

At the above example I select “My IP” so if you go to the VM’s NSG you will see that the 3389 port rule changed to “Allow” and for Source has my current Public IP. Also it moved at first priority.

After the expiration of the time rage the port will change to “Deny” and move back to its prior priority.

Pantelis Apostolidis

www.cloudcorner.gr

The post Bulletproof manage your Azure VMs appeared first on Apostolidis Cloud Corner.

Use Azure Security Center to protect your workloads

Pantelis Apostolidis — Mon, 20 Nov 2017 19:18:47 +0000

Use Azure Security Center to protect your workloads

At this series of posts we will make a walk along the Azure Security Center, to see some common usage scenarios. Like how we can use it to protect from a Virtual Machine to a whole Data Center.

To make it easier to understand we will start with a typical Azure IaaS scenario. A Virtual Machine with IIS role to act as Web Server. The steps to create the VM is out this post’s scope. I will simply describe the process. First we create a Windows Server 2016 Virtual Machine. Second we log in and add the Web Server (IIS) role. Third we open the port 80 at the VM’s Network Security Group (NSG) and voila we can browse at the Azure DNS name of the VM and see the IIS default landing page.

At this point the security of the Web Server is relying on the Network Security Rule, a layer 3 firewall that allows access to the port 80 and of course the Windows Firewall that does exactly the same.

Lets browse to the Azure Security Center from the Azure Portal. There we see an overview of security settings for the whole subscription.

First, click the “Compute”. I will skip the overview and go directly to the “VMs and computers” tab. There we see the name of the VM and the five points of interest. Our VM is not monitored, it doesn’t have endpoint protection and it reports some vulnerabilities.

Recommendation: Enable data collection for subscriptions

To start resolving the issues click the VM to go to the Recommendations blade. The first recommendation says to enable data collection for the subscription. Of course this is the Log Analytics, OMS (Operations Management Suite) integration. This will enable the subscription resources to report to log analytics.

Press the “Enable data collection for subscription”. The Data Collection blade will open. There we can enable or disable the automatic provision of the monitoring agent. This is the Microsoft Monitoring Agent that connects a Virtual Machine to Log Analytics and also we can use it for connecting to SCOM.

The second option is to chose a workspace. IF you have already created an OMS workspace you can choose it. If not let it create a new one automatically. Finally press save.

Returning to the previous blade you will see that the “Turn on data collection” recommendation, is now in Resolved state.

Although this recommendation is resolved instantly, the Microsoft Monitoring Agent is not yet installed. Go back to the Compute / Data collection installation status to see the agent installation status.

Stay tuned for the next Azure Security Center post to resolve more recommendations.

Pantelis Apostolidis

www.cloudcorner.gr

The post Use Azure Security Center to protect your workloads appeared first on Apostolidis Cloud Corner.

Microsoft Azure Nested Virtualization | Hyper-V Replica on Azure

Pantelis Apostolidis — Mon, 21 Aug 2017 11:30:32 +0000

Microsoft Azure Nested Virtualization | Hyper-V Replica on Azure

With the new Dv3 and Ev3 VM sizes Microsoft has released the Nested Virtualization, meaning you can simply have a Hyper-V VM inside an Azure VM. I have created a set of posts to explore the Nested Virtualization functionality. Of course nested virtualization is only supported in Windows Server 2016.

Microsoft Azure Nested Virtualization

After the Microsoft Azure Nested Virtualization | Hyper-V VM inside Azure VM post on how to create a Nested VM inside an Azure VM, I am following with how to have Hyper-V Replica on Azure.

To accomplish this we will use the Azure VM and the Nested VM from the Microsoft Azure Nested Virtualization | Hyper-V VM inside Azure VM post. The first step is to create an identical pair of Azure VM and Nested VM to use for replica server. The only requirement is that the two Azure VMs must have network connectivity. As you understand we can have Hyper-V Replica between two Azure VMs at different Azure Regions using VPN.

Next, at both Azure VMs open the 443 port at both the NSG and the Windows Firewall. For more security we can add the Public IPs of the VMs as Source.

Since the VMs are not part of a domain we need to use Certificate based authentication for the Hyper-V Replica. We will use the New-SelfSignedCertificate command to create both certificates.

The certificate process

First we need to create a root CA certificate, so login at the first host and run:

New-SelfSignedCertificate -Type "Custom" -KeyExportPolicy "Exportable" -Subject "CN=myazurerootca" -CertStoreLocation "Cert:\LocalMachine\My" -KeySpec "Signature" -KeyUsage "CertSign"

Next, using the certificate Thumbprint of the root CA certificate, create two server certificates, one for each Azure VM. To accomplish this run:

New-SelfSignedCertificate -type "Custom" -KeyExportPolicy "Exportable" -Subject "CN=anothertestvm" -CertStoreLocation "Cert:\LocalMachine\My" -KeySpec "KeyExchange" -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.1,1.3.6.1.5.5.7.3.2") -Signer "Cert:LocalMachine\My\6A7196D9759FC2F7C49D62E08FA7195310DE5EB7" -Provider "Microsoft Enhanced RSA and AES Cryptographic Provider"

New-SelfSignedCertificate -type "Custom" -KeyExportPolicy "Exportable" -Subject "CN=anothertestvm2" -CertStoreLocation "Cert:\LocalMachine\My" -KeySpec "KeyExchange" -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.1,1.3.6.1.5.5.7.3.2") -Signer "Cert:LocalMachine\My\6A7196D9759FC2F7C49D62E08FA7195310DE5EB7" -Provider "Microsoft Enhanced RSA and AES Cryptographic Provider"

The next step is to open the Certificates mmc (Local Computer) and at the Personal container you will find the three certificates created above.

Right click each certificate and Export it, including the Private key, to a folder

Copy the certificates to the second Azure VM and import them. The root CA certificate needs to be imported to he Trust Root Certification Authorities and the other two to the Personal (or just use automatic placement).

Finally we need to disable the Certificate revocation check for Replication on both Azure VMs. To do this run the following command on both Azure VMs:

REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Virtualization\Replication" /v DisableCertRevocationCheck /d 1 /t REG_DWORD /f

The Hyper-V Replica process

Lets start creating the Hyper-V Replica. Since Hyper-V Replica uses computer names, we need to use the host file to bind the Public IPs with the computer names. So, at the first Azure VM, open an elevated Notepad, browse to the path “C:\Windows\System32\drivers\etc”, and open the “hosts” file. Enter the Public IP of the second Azure VM following by the computer name. Do the same at the second Azure VM.

After saving the host file, go to the Hyper-V Settings, go to the “Replication Configuration” and check the “Enable this computer as a Replica Server”. Then check the “Use certificate-based Authentication (HTTPS)” and select the certificate created before. Finally check the “Allow replication from any authenticated servers” and press OK. Do this at both Azure VM Hyper-V Servers.

Next go to the Hyper-V manager, right click the Nested VM and choose “Enable Replica”. Enter the name of the second Azure VM and select the certificate.

I just used the defaults at all the next screens and finally press finish to enable the replication.

Once the replication is enabled you will see the “Replication enabled successfully” message and the Status will change to “Sending Initial Replica”.

After a very short period of time, the VM will complete the initial sync.

Pantelis Apostolidis

www.cloudcorner.gr

The post Microsoft Azure Nested Virtualization | Hyper-V Replica on Azure appeared first on Apostolidis Cloud Corner.