Azure lab services VM losing connection

flk2023-7225 25

I'm new to Azure and I'm trying to change the DNS IP (in the TCP/IPv4 properties) of the Lab services VM to our Domain Controller VM's IP in Azure.

The Domain Controller VM resides in Azure but outside of the Azure Lab services environment but has connectivity to/from the Azure lab services.

When I RPP into the Lab services VM from the Virtual machine pool and change its DNS IP to point to the Domain Controller VM's IP, the connection is immediately lost to the Lab services VM. Then I can no longer RDP to it. The only way to get the connection back is to reset the VM. Then I'm back to the original state and I still need to change the DNS IP.

I normally RDP into the Lab services VM by using the DNS name from the Remote deskstop information section of the Lab services VM Ex) ...cloudapp.azure.com:7001

Is there a way for me to still RDP to the Lab services VM after changing its DNS IP?

By assigning a public IP to the Lab services VM perhaps? If it is possible, where/how would I go about doing that?

TIA

Ayomide Oluwaga 941 Reputation points

2023-03-21T21:40:24.5166667+00:00

This is an issue I went through personally ND I think I can help u with it.

Accepted answer

Peter Hauge (MSFT) 80 Reputation points Microsoft Employee

2023-03-23T18:51:05.1433333+00:00

Hi - I work with the product team and wanted to learn more about what you're trying to accomplish (that way we can give the best guidance on how to get there). Are you using Lab Accounts or Lab Plans? Also, are you attempting to domain-join the student virtual machines? I'm just wondering the reason to use DNS this way?

Thanks!

Pete [msft]
Please sign in to rate this answer.
flk2023-7225 25 Reputation points

2023-03-23T23:48:04.1666667+00:00

Hi - It's Lab Plans. Yes, we're using the Virtual Machine Scale Sets within the Azure Labs and I'm able to RDP to these VMSS instances using either the public DNS name in the format of lab-....cloudapp.azure.com:7001 or its public IP x.x.x.x:7001 but as soon as I change the DNS IP (it gets the Azure DNS by default 168.63.129.16) of the Lab VM instance to point to our Domain Controller's IP that's also on Azure (the DC resides outside of the Azure labs though but has connectivity with the Lab environment via peering). Then I need to reset the VM instance in order to be able to RDP to it again. But after resetting, the DNS will be pointing to 168.63.129.16 again.

flk2023-7225 25 Reputation points

2023-03-23T23:55:07.04+00:00

Hi - we're using Lab Plans.

Yes, we need to have the Virtual Machine Scale Sets (VMSS) to join the domain. When changing the IP of the VMSS instances (it gets the Azure DNS IP 168.63.129.16 by default), the connectivity to the VMSS is lost and cannot RDP into it unless resetting it. After resetting, it's back to square on with its IP still pointing to the Azure DNS IP 168.63.129.16. I'm looking for a way to have the VMSS' DNS IP to point to the Domain controller's IP. The Domain controller also resides on Azure but not in the Lab environment.

Peter Hauge (MSFT) 80 Reputation points Microsoft Employee

2023-03-24T03:10:19.1933333+00:00

Ok, thanks! You mentioned Lab Plans, does that mean you're using Advanced Networking? If so - the place to update the DNS is on the lab's virtual network, not within the VM itself. Generally speaking, the network settings are configured & controlled via Azure.

In terms of Domain Joining - that's not a well-supported scenario in Azure Lab Services unfortunately. Are you using a scripting solution, or will you have the students join the domain directly? (There's a challenge with machine names being the same if you create labs with a template for example)

To update the DNS settings, follow these steps:

Go to the Lab Plan -> Lab Settings

Click the Virtual Network under the "Networking" header

On the Virtual Network select "DNS Servers"

Choose "Custom" and then fill in the IP address of the DNS server

(screenshots below)

Thanks!

Pete [msft]

flk2023-7225 25 Reputation points

2023-03-24T04:56:11.9633333+00:00

Thanks for helping out Pete

It seems like we're not using Advanced Networking because there's no section named "Networking" when I go to the Lab Settings.

Does it need to be enabled in order to use custom DNS?

In terms of Domain joining, we're not using a script solution currently.

We can join each instance manually and change the host name of each before joining. Would that work?

Go to the Lab Plan -> Lab Settings

Click the Virtual Network under the "Networking" header = no "Networking"...

Masih Shekarak 20 Reputation points

2023-03-24T07:42:11.0866667+00:00

Hi,

I joined ALS VMs to a domain following the guide I provided above. You must use the Advanced Networking option, as Pete suggested, and that is done at the same time you are creating the lab. It is pretty straightforward if the script executes successfully.

Regards,

Masih

Nicole Haugen 5 Reputation points Microsoft Employee

2023-03-24T14:52:31.1233333+00:00

Hi all-

I'm also on the product team along with Pete.

As Masih mentioned, Advanced Networking is needed in order to specify the DNS so that you can reach your domain controller from lab VMs.

We did provide sample scripts for the previous version of Azure Labs that uses lab accounts to help with domain joining (which is what this blog post references). However, we haven't updated these scripts to be used with the new version of Azure Labs that uses lab plans. In fact, there are many shortcomings with the script approach that we may not be able to address. For this reason, I would recommend that if you can manually join student VMs, that this would be the best approach to try for now. Again, you will need to ensure that you uniquely name the student VMs. I would also recommend that you plan a strategy for how to handle "stale" lab VMs in the domain because each time that a lab is re-published or a VM is reset, the lab VMs will need to be renamed and rejoined again. The old domain joined lab VMs will remain in the domain as "stale" entries and will need to routinely cleaned up.

Also, I have some questions:

How many labs\VMs in each lab are you planning to domain join? As you can see, manually joining VMs likely isn't practical at a broad scale. The same is true even if you were to attempt a scripted approach (like we did with lab accounts) because the scripts take "babysitting" to ensure they run properly.

What are your key reasons\requirements for needing to domain join the lab VMs?

Thanks,
Nicole

flk2023-7225 25 Reputation points

2023-03-24T16:17:36.3666667+00:00

Thanks for the information guys.

Since the Advanced networking doesn't seem to be enabled, is there a way to enable it now or do I need to create a new lab and enable the Advanced networking as I'm creating it?

There will be less than 10 VMs so manually adding them do the domain would be do-able.

Mas023 5 Reputation points

2023-03-24T16:30:19.69+00:00

Hi,

At least with the Lab Account (the older version of Lab Services), you could only enable advanced networking in the beginning. I'm unsure about the Lab Plan since it uses Network delegation.

GPT3 says you can do it afterward.

If someone from the MS team can confirm that it would be nice.

Follow the instructions below and test. I would say if you have nothing to lose, create a new lab.

https://learn.microsoft.com/en-us/azure/lab-services/tutorial-create-lab-with-advanced-networking

Nicole Haugen 5 Reputation points Microsoft Employee

2023-03-24T16:58:08.8533333+00:00

For Lab Plans, you can only set up advanced networking when you create a lab plan - you can't configure advanced networking on an existing lab plan. Here's the doc that I recommend that provides more details: Use advanced networking to connect to your virtual network.

Thanks for the additional info on your scenario - could you also highlight the benefits\requirements that you are trying to achieve by domain joining? It's helpful for to understand your scenario better.

flk2023-7225 25 Reputation points

2023-03-24T22:55:01.73+00:00

The reason for domain joining is because the test users reside on AD. So for the AD authentication.
Sign in to comment

3 additional answers

Ayomide Oluwaga 941 Reputation points

2023-03-21T21:43:25.7066667+00:00
Yes, it is possible to assign a public IP address to your Azure Lab services VM. To assign a public IP address to the VM, follow these steps:

Go to the Azure portal (https://portal.azure.com/).

Navigate to the virtual machine you want to assign a public IP address to.

Click on the "Networking" tab in the virtual machine blade.

Click on "Add inbound port rule" and add a rule to allow RDP traffic (port 3389) from your IP address.

Click on "Add public IP address" and select "Create New" to create a new public IP address resource.

Fill in the required information for the new public IP address, including the DNS name label.

Once the public IP address is created, select it in the "Networking" tab and click on "Associate" to associate it with the virtual machine.

You should now be able to RDP to the VM using the public IP address.

Note that assigning a public IP address to your VM will incur additional costs. Also, make sure to configure the firewall on the VM to allow RDP traffic from your IP address.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment
flk2023-7225 25 Reputation points

2023-03-21T23:14:49.0166667+00:00

When I go to the Azure portal (https://portal.azure.com/), the VMs from the Azure Lab services do not show up as a virtual machine.

I can see them under "connected devices" when I go to "Virtual Networks" > virtual network the lab services belongs to > connected devices but it doesn't give me the option to assign a public IP address.

They show up as

vmss-user (instance 2)

vmss-user (instance 3)

vmss-user (instance 4) and so on

The VMs created on the Azure portal show up fine and I'm able to assign public IPs to them but not the VMs created on the Azure Lab services.
Please sign in to rate this answer.
Ayomide Oluwaga 941 Reputation points

2023-03-22T00:06:20.3166667+00:00

These seems to be Virtual Machine Scale Sets (VMSS) being deployed, there is a difference between Vms and VMSS. sometimes, they might have slightly different configurations available. When you create a Lab Services environment, the VMs are created as instances of a VMSS rather than as individual VMs.

To assign a public IP address to a VMSS instance, you'll need to use an Azure Load Balancer to provide public access to the VMSS instances. Here are the steps you can follow to assign a public IP address to a Lab Services VMSS instance:

Navigate to the Azure portal and open the virtual network that the Lab Services environment is connected to.

Click on "Subnets" and select the subnet that the Lab Services environment is using.

Click on "Associate" and choose "Load Balancer".

Choose "Create new" and enter a name for the load balancer.

Choose "Internet facing" as the type and create a new public IP address or use an existing one.

Select "Basic" as the SKU and click "Create".

After the load balancer is created, go back to the virtual network subnet and click on the "Network Security Group" associated with it.

Add an inbound security rule to allow traffic from the internet to the VMSS instances. You can do this by creating a new rule with a priority lower than the default "Deny all inbound traffic" rule.

Choose "Destination port ranges" and enter "3389" for RDP traffic.

Choose "Source" and enter "Internet".

Choose "Allow" as the action and click "Add".

Navigate to the VMSS instance that you want to assign a public IP address to.

Under "Networking", select "Load balancing".

Choose the load balancer that you created earlier.

Under "Inbound NAT rules", click "Add".

Enter a name for the rule, choose "RDP" as the service, and select the VMSS instance that you want to assign the public IP address to.

Enter a unique frontend port number and select the public IP address that you created earlier.

Click "OK" to create the rule.

After these steps are completed, you should be able to RDP to the Lab Services VMSS instance using the public IP address associated with the load balancer. Keep in mind that assigning a public IP address to a VMSS instance may expose it to the internet, so it's important to configure your security groups and firewall rules appropriately to ensure that only authorized users can access the VMSS instances.

flk2023-7225 25 Reputation points

2023-03-22T06:41:32.3166667+00:00

Thanks for the instructions.

Can it work for multiple VMSS instances?

There's about 5 VMSS instances and would like to use 1 public IP with inbound NAT using a unique frontend port number for each VMSS

Example

7000 > 3389 VMSS1

7001 > 3389 VMSS2

7002 > 3389 VMSS3

7003 > 3389 VMSS4

7004 > 3389 VMSS5

Ayomide Oluwaga 941 Reputation points

2023-03-22T07:29:44.4766667+00:00

Certainly! You can use a single public IP address and Azure Load Balancer to allow RDP traffic to multiple VMSS instances in Azure.

To set this up, you'll need to create an Azure Load Balancer and add the virtual machines in each VMSS instance to the backend pool. Then, create an inbound NAT rule for each VMSS instance, with a unique frontend port number and the backend port set to 3389 (RDP). Finally, configure each VMSS instance to use the frontend port number for its corresponding inbound NAT rule.

Once this is set up, you can use the public IP address assigned to the Load Balancer, along with the unique frontend port number for the VMSS instance that you want to connect to, to RDP into the virtual machines in each VMSS instance. Please let me know if this was helpful

flk2023-7225 25 Reputation points

2023-03-23T01:16:21.1566667+00:00

Thanks

I will give it a try

Masih Shekarak 20 Reputation points

2023-03-24T07:33:41.47+00:00

Hi @flk2023-7225

You don't need to assign a public IP address for joining your Azure Lab Services (ALS) VMs to your Active Directory. ALS VMs (deployed with Scale Set) are not in your subscription and are hosted on your behalf by Microsoft. So I'm unsure how much control you can have over network configurations. I would suspect not much. I wish the ALS's constraints and architect were explained more in detail in the documentation.

Here is an excellent guide by @Roger Best that shows you how it's done.

Regards,

Masih
Sign in to comment
Masih Shekarak 20 Reputation points

2023-03-24T22:58:50.1166667+00:00

@flk2023-7225

Are you sure the answer you chose as the correct answer, provide the best answer to A) why you lost connection to your lab machines when you change the DNS server IP address and B) how can you domain join your lab?
Please sign in to rate this answer.

0 comments No comments
Sign in to comment