Azure Networking - #11 - Azure Private Link

#TheAzureAcademy #AzureNetworking #AzurePrivateLink
Learn how to secure your Azure PaaS resources with Azure Private Link today at The Azure Academy
Azure Private Link enables you to access Azure PaaS Services and Azure hosted customer/partner services over a Private Endpoint in your virtual network.
Traffic between your virtual network and the service traverses over the Microsoft backbone network, eliminating exposure from the public Internet.
You can also create your own Private Link Service in your virtual network (VNet) and deliver it privately to your customers.
Private Link Docs - 1:00
Private Link Center - 2:48
Add Private Endpoint - 3:36
Build Private Endpoint - 5:29
Create Private Link Svc - 7:23
Test Private Link Svc - 10:30
Test Azure SQL - 14:36
Test Azure Storage - 16:11
📲 Follow Azure Academy
►Twitter: / msazureacademy
►LinkedIn: / dean-cefola-2902934b
►Facebook: / azure-academy-87979521...
💰 Support Azure Academy
►Patreon: / azureacademy
📡 Contact Azure Academy
►Email: [e-mail]
►MAIN Channel: / azureacademy
🤣Playlists
►Azure Governance: aka.ms/AzureAcademy-Governance
►Azure Fundamentals: aka.ms/AzureAcademy-Fundamentals
►Azure Blueprints: aka.ms/AzureAcademy-Blueprints
►Azure AD Series: aka.ms/AzureAcademy-AzureAD
►Azure ARM Templates: aka.ms/AzureAcademy-ARMTemplates
►Azure Automation: aka.ms/AzureAcademy-Automation
►Azure Networking: aka.ms/AzureAcademy-Networking
►Azure Migrations: aka.ms/AzureAcademy-Migrations
►Azure Backup: aka.ms/AzureAcademy-Backups
►Azure New Features: aka.ms/AzureAcademy-NewFeatures
►Windows Virtual Desktop: aka.ms/AzureAcademy-WVD
►Cloud Adoption Framework:aka.ms/AzureAcademy-CAF

[@samhouston2000]

I wish I had found you four years ago when I started with Azure, you are absolutely the teacher I need. Straight to the point no self praising and tangents to the history of technology.

[@AzureAcademy]

Thanks Samhouston2000! Let me know what other videos you are looking for and I can create it 😁

[@someguynj]

Another gem. Thanks Dean, again you've nailed the ideal delivery style for many who need to stay current with new tech concepts.

[@AzureAcademy]

Thanks for the feedback!

[@jaylee3941]

This has to be the clearest instruction on Private Link I've come across. Thank you!

[@AzureAcademy]

thanks Jay Lee , I appreciate that! How do you plan on using Private Link?

[@jaylee3941]

@@AzureAcademy I support a customer that has been hesitant about moving to Azure due to the public endpoints being internet accessible. This looks to be a real game changer.

[@AzureAcademy]

have you gotten to use Private Endpoints yet...thoughts?

[@geraldparish497]

Very informative and helpful!! Dean you Rock!!!

[@AzureAcademy]

Thanks for the feedback Gerald!

[@rajsingh494]

Great video, to the point (Not going off topic or being Skippy), concise with practical Demo.

[@AzureAcademy]

Thanks Rajwant!

[@jaimemint405]

Thanks Azure Academy, you are making very nice Tutorials!

[@AzureAcademy]

+Erik Wolkenberg thank you for your kind words. Please help the community and share the Azure Academy with others so they can learn too!

[@anantharamakrishnan19]

Love your videos. So much informative.

[@AzureAcademy]

Thanks for watching!

[@jeanlameree3259]

Great video, thanks!

[@AzureAcademy]

Glad to help Jean!

[@Aladdin512]

Very useful. Thank you so much.

[@AzureAcademy]

Awesome!

[@cloudpachehra1113]

Finalllyyyy... Thankyou so much 🤗🤗🤗

[@AzureAcademy]

🙌 Happy to provide what the community wants 😊👌

[@keyvan.k]

Awesome. Thank you

[@AzureAcademy]

Anytime

[@raviv5109]

Awesome .. thanks!

[@AzureAcademy]

Anytime!

[@rakeshupadhyay1]

Great content and really great delivery

[@AzureAcademy]

Thanks! What else are you interested in?

[@rakeshupadhyay1]

@@AzureAcademy will let you know, still going through

[@AzureAcademy]

So…how’s it going?

[@tamimthaher2405]

Thank you so much!!!!!!!!

[@AzureAcademy]

Happy to help, what other topics are you interested in?

[@j.wadehudson1403]

fascinating video

[@AzureAcademy]

Thank you

[@DDD00007]

Nice Video! On a different note - Seems like you missed the point or it is not required. To allow the Website "IIS" do we need to create a Load balancing rules and attach the load balancer to that Iaas VM? I tested in my Lab to RDP over 3389, I configured the Standard Load balancer FP. BP. ANd NAT rules.

[@AzureAcademy]

you CANNOT use an an Azure load balancer to use a private endpoints today. You CAN use an Application Gateway. Private Endpoints are for the Azure PaaS Services to be available on your private VNET...WebSites are setup with the Azure Web Apps...they have their own load balancing method. So this is NOT a service for your VMs running IIS behind an Azure Load Balancer

[@Ironmelranger]

G'day Dean, how/where did you get the theme for the portal @11:10? I quite like it :)

[@AzureAcademy]

Thanks! I use a browser extension called night time pro If you have it dark theme a page that was already black it reverses the colors and you get that effect This is NOT native to the Azure portal but it did help to stress that this was a different environment

[@catalin6304]

Hi Dean, thanks for the content! Small question, I might be missing something, but is there any particular reason why you decided not to go for private, non routable IP addresses ranges for the DMZ (12.0.0.128/26) and the VNET (100.0.0.0/24) ?

[@AzureAcademy]

In general all private networks should be in the RFC1918 ranges. However it is not required to make anything work or not work. As for the reason I did it, it was a long time ago, so I am not 100% but I think it was because I had a lot of other networks at the time and it was an easy way to keep it unique.

[@catalin6304]

@@AzureAcademy Understood! Thanks for your reply! :)

[@AzureAcademy]

Anytime @@catalin6304

[@srisrujans6335]

Hello Dean,Thank you much for the videos. I can see only Azure Networking - #10, Azure Networking - #11 only there in the playlist. Could you please provide us the entire series as playlist.@azureacademy

[@AzureAcademy]

I'm sorry about that Srisrujan, from what I can see there are 16 videos in that playlist... Here is the direct link - kzbin.info/aero/PL-V4YVm6AmwXRd3XaREBJbsHzI7nekPvK You can get to this and all the other playlists either from the HOME page under the learning paths or on the PLAYLISTS page. please let me know that you can see all the videos. I believe I understand what you may have done is a search for "Azure Networking" and can only see 2 videos. #10 and #11...This is because the first 9 videos were originally part of the Fundamentals Series, since they were foundation concepts. At this point if I rename the videos then that will mess with the KZbin algorithm or people who saw them before won't be able to find them now...that is why I made a playlist and learning path for networking, so no matter what I call them you can find all the networking related videos there. This is what happens as you grow from posting a few videos over time to building a community of learners... mistakes got made as I learned how to do all this, we all learn as we grow. 😊 Thanks for your understanding.

[@atulkraizada]

I am interested to use Private Links to IOT Hub, so far it appears, it is not supported, please advise?

[@AzureAcademy]

correct, not supported at this time, but the Product Groups are adding more services...stay tuned!

[@MrEnjoyingtoday]

Thanks Dean, this is very nice presentation! When I am trying to create Azure Private Link Service then load balancer instance that is already created is not getting displayed in the Outbound settings drop down. It is created in the same region. Could you check on this issue?

[@AzureAcademy]

So you are saying that you are trying to use the private link with an Azure Load balancer...is that correct?

[@MrEnjoyingtoday]

@@AzureAcademy - Yes. I identified the issue. During creation of load balancer, I had select SKU as Basic instead of Standard. Now, the issue is resolved.

[@AzureAcademy]

GREAT...Standard load balancer is more generally recommended at this point.

[@panadolnopain4886]

What is the difference between Private End Point and Private Link. I mean if I just create a private endpoint (without creating the private link) for a service or storage account I can still access it from the VNET (on which the endpoint is created) and the onprem subnet either through an S2S or Express Route. What value addition is Private Link creating here.

[@AzureAcademy]

Private Endpoint and Private Link are the same thing. however what you are describing sounds like Service Endpoints...which is another way to have access to PaaS Services.

[@muhammadrahman3510]

This is a great content and I was looking for that. Thanks so much! However, to me it is little bit fast and lots of back and forth made me confused sometimes. May be it is my limitation. Would it be possible to make it for us a bit slow and with an end-to-end architecture diagram and go step by step with the dagram? I believe, that would be nice and helpful for other audiances like me 🙂 Thanks so much again!

[@AzureAcademy]

Thanks for the Feedback! I will work on those changes

[@hvalentino9573]

Hi Dean, thank the video! I do have some questions, do you have step by step configuration if we have a dns server on prem? I think now we need to change the hosts file on each machine that trying to connect into the privatelink, but what if the entire network trying to connect from on prem? Do you guys have the step by step tutorials? Thanks!

[@AzureAcademy]

Thanks Hendi! For DNS on prem you should not have to change everyone’s host files. I assume you have a DNS tool or appliance. For example AD integrated DNS or IPBlox etc. There are a few choices to reach the private link endpoint. Setup another DNS zone setup the Azure private DNS Zone as a FWD lookup Setup a CNAME record in you existing zone

[@hvalentino9573]

Azure Academy thanks Adam! I tried those but it seems stuck.. still pointing into external dns when I try to connect into the sql private link, I look in Microsoft site but there is no step by step tutorial for this... wish you could point me into a good site for this? Thanks!

[@AzureAcademy]

did you setup Azure Private DNS for your SQL Private Link Endpoint?

[@hvalentino9573]

@@AzureAcademy Yes I did, is just the on prem side that I am a little lost, I did the tried with win server DNS on prem but no luck hitting the private link...

[@AzureAcademy]

I setup a SQL Server / Database with private endpoint The Private DNS Zone is - privatelink.database.windows.net and the FQDN of the endpoint is - msaaprisql.privatelink.database.windows.net What is the FQDN of the DNS entry you are trying to hit?

[@vivek.padale]

Hi Dean, thanks for the content.. I feel that before you start the video you should provide a topology diagram or an agenda for reference on what you are going to do and also refer it after completing every task...it feels very difficult to link as you keep on toggling between screens and resources. Thanks....Best of Luck!

[@AzureAcademy]

thanks for the feedback Vivek...I appreciate you helping me to improve!

[@samhouston2000]

His teaching style is for users who don't need foundational knowledge. If you have experience and if you already know what you need to learn then this is an absolutely fantastic method that works for people who don't need hand-holding. I learn from in a 5-minutes video more than 4-hours tutorials of others. Please don't make him change his style, there are tons of other people who would cater to your learning needs.

[@AzureAcademy]

👍😁👍

[@raviv5109]

Hey, I have one question, once this private link is setup the services shouldn't be available from public network? Isn't' it? And when I have VPN from my Org to Azure, I should be able to access the service behind private link from my org?

[@AzureAcademy]

Correct! Creating the private link sets up an IP address for that service on your private network, Traffic between your virtual network and the service traverses over the Microsoft backbone network, eliminating exposure from the public Internet. As long as you are connected from on prem to Azure with a VPN / ER correctly, meaning routing, firewalls etc allow your traffic to the private link ip you should be able to access it.

[@raviv5109]

@@AzureAcademy Thank u so much!

[@AzureAcademy]

Any time!

[@rajeevsharma2664]

Can you please do a separate video so how to use Private Link in Azure SQL and Storage service like ADLS?

[@AzureAcademy]

sure, I will add it to the list...Thanks for the suggestion!

[@hurrdurr4828]

Do you know what happends behind the scenes with service endpoint? At 2:10 you are stating that is uses NAT? So is basically the Azure SDN magic for service endpoint is that in reality the private IP traffic hits some managed NAT by Microsoft on backbone to public, and hits public IP of PaaS service. This would be really interesting. There is really no documentation on service endpoint. Just that you use your private IP and public IP to the PaaS service..

[@AzureAcademy]

Service endpoints and private endpoints are different. A service and point allows you to grant access from a locked down virtual net work to a specific service like storage or even storage in a specific region but the private endpoint is a specific dedicated IP address that lives on your virtual net work which represents the storage service, and that allows you to use Azure private DNS and create firewall or NSG rules against it

[@hurrdurr4828]

@@AzureAcademy Thanks for answering. I was just wondering if you knew how the fabric controller is translating the rfc1918 adress from the vnet to the public ip of the paas service. i am not talking about private endpoint. when u use service endpoint you see next hop is public ip from an private rfc1918 adress. so azure sdn must do some sort of magic

[@AzureAcademy]

Yes Azure is doing SDN magic. Actually when the traffic leaves the virtual network and it’s destination is an Azure service endpoint, the traffic goes out the SNAT and hairpins to the public endpoint of that service. When you do a private endpoint this does not happen, the traffic stays on the Azure backbone and using the private IP of the private endpoint, goes direct to the private side of the service…hope this helps!

[@ntnr32]

Hi Dean, how do we use private link service to access key vault? Scenario : I have a azure key vault in tenant one and want to privately access it from tenant two app service, does private links service work here?

[@AzureAcademy]

Yes it can. But you need to call the key vault by its ip to access the private link. Also the 2 networks need to be peered across the tenants

[@ntnr32]

@@AzureAcademy thank you for quick response

[@AzureAcademy]

Anytime

[@anantharamakrishnan19]

While you created SQL Server there was a option "No Access" What is that option for? you showed "Private Endpoint" and I can understand "Public Endpoint".

[@AzureAcademy]

No access would isolate the resources

[@anantharamakrishnan19]

@@AzureAcademy You mean isolated from any calls? If so why would I need a SQL Server. I mean Applications must be able to talk to SQL Server. Sorry, I didn't understand.

[@AzureAcademy]

It depends on how you need the Server to communicate with other things in Azure