Talk Nerdy To Me!

Thoughts on my first 4 months in Azure Engineering

Abhishek_Pradhan — Fri, 23 Dec 2016 17:56:30 GMT

It's been a roller coaster of a calendar year 2016, and similar for FY16 and FY17. In late 2016, I moved from handling the Pre-Sales business for Microsoft Singapore for Public Cloud (Azure), Hybrid Cloud (CPS, Windows Server + System Center, OMS), all of which which runs into the double digit million dollars, to moving to the Azure PG in Redmond as a Program Manager where my team and I are responsible for Compliance Engineering for Azure and all of our services that run on the platform. My first 4 months have been so filled with learning that it has been nothing short of exciting. It has been a rewarding 7 years with Microsoft across 3 primary work location countries in 3 continents, in 3 distinct businesses (Consulting, Sales & Pre-Sales, and now Engineering) and having been able to travel to and work in almost 18 countries to date! This journey has been nothing short of fulfilling and I continue to learn and evolve both personally and professionally.

My first learning in my new role in Azure Engineering, is that the age old statement 'The Grass is always greener on the other side' is not always true :) Go figure!

Leading the Pre-Sales business, I've witnessed first hand how sales people are prone to making promises that sometimes cannot be fulfilled just to close a deal, and then suddenly that becomes an issue that Engineering has to take up to solve. This is by far the most incorrect approach to ever try to close a deal.

Engineering is not here to save individual people when they're in trouble due to a promise they made to close a sale. We're here to ship products, their features and security & compliance, all the while having to balance the requirements that are common across a very large subset of customers, versus doing a trade off for a feature or requirement that probably only a handful of customers may ever use.
This is a good learning to keep in mind always: What is a 'good to have 'versus a 'nice to have' requirement across your global customer base.
As a sales person, if you feel that suddenly forking over stuff to Engineering results in Magic happening to solve problems, you've been watching too much TV. The difference here between reality and fiction, is that fiction has to make sense
Network, network, network! Don't get complacent that you have achieved one role, so you are set. Go out of your way and network with people with whom you've maybe just exchanged emails before, and get their perspective on what it takes to succeed in a role that you are new to. Network outside your company/ employment sphere. Go to Meetup's, User Groups, etc., and network with people from the industry. This will broaden your horizon and knowledge in magnitudes thereof.
Get at a minimum 2 mentors. Heck, get 3! The Italian's have a joke that the world is so hard a man must have two fathers to look after him, and that's why they have godfathers. One of these mentors should ideally be your Godfather when it comes to advice related to the professional sphere, and if you develop a good friendly relationship, personal too.
Have a 30/60/90 day plan when you are transitioning to a new role, and sync on it with your immediate manager, and your mentors on reaching the 30/60/90 day timeline. Treat this as a milestone, not just another checkbox to cross off.
There are no stupid questions. My team's motto is 'We are used to stupid questions'.
Bring your Sales, or Consulting experience to the table in Engineering, but don't make decisions or base opinions purely on that experience., It's a new world for you to explore. Listen first and always, learn, ask questions, get help, evolve before you make a statement.
Think before you act. Think before you speak. Think 9 times before you hit the SEND button on that email (A cat is supposed to have 9 lives, so hypothesizing this, also another reason why I always UNCHECK the 'SEND IMMIDIATELY WHEN CONNECTED' checkbox for email :) )
Be a sponge and soak up as much information as you can. Always be in learning mode aside from shipping your products/ feature and delivering on your KPI's.
Feedback is key. Take it constructively and act decisively on that feedback. It does one a wealth of good.

Deploying an Azure Resource Group (with Resources) for Demo's

Abhishek_Pradhan — Tue, 19 Jul 2016 10:03:14 GMT

Hello again! I've gotten queries from a few local SI partners regarding a sample PowerShell script that helps to deploy an Azure Resource group with basic resources to showcase automating deployments. Given that some documentation literally goes step-by-step for every action required for deployment with their scripts, this results in some incoherence around what needs to be done and in what sequence. A great post by Tom FitzMacken outlines the step by step approach with explanations on how to HERE. The following is a PowerShell script I've put together based in some part on Tom's post. 'Azure Resource Group + Resources Deployment Demo' 'Create a Resource Group' Login-AzureRmAccount Get location list Get-AzureRmLocation | sort Location | Select Location 'variable' $locname = "southeastasia" 'Create ResourceGroup' $rgName = "ResourceGroupTest" New-AzureRmResourceGroup -Name $rgName -Location $locName 'Create Storage Account' $stName = "resourcestorage0" Get-AzureRmStorageAccountNameAvailability $stName $storageAcc = New-AzureRmStorageAccount -ResourceGroupName $rgName -Name $stName -SkuName "Standard_LRS" -Kind "Storage" -Location $locName 'Create Virtual Network' $subnetName = "ResourceSubnet" $singleSubnet = New-AzureRmVirtualNetworkSubnetConfig -Name $subnetName -AddressPrefix 10.0.0.0/24 'Create VNet' $vnetName = "ResourceVnet0" $vnet = New-AzureRmVirtualNetwork -Name $vnetName -ResourceGroupName $rgName -Location $locName -AddressPrefix 10.0.0.0/16 -Subnet $singleSubnet 'Create Public IP and Network Interface' $ipName = "ResourceIP0" $pip = New-AzureRmPublicIpAddress -Name $ipName -ResourceGroupName $rgName -Location $locName -AllocationMethod Dynamic 'NIC Name' $nicName = "ResourceNIC0" $nic = New-AzureRmNetworkInterface -Name $nicName -ResourceGroupName $rgName -Location $locName -SubnetId $vnet.Subnets[0].Id -PublicIpAddressId $pip.Id 'Create VM Set Admin UName & PWD' $cred = Get-Credential -Message "ResourceAdmin Pass@word1!@" 'Create VM' $vmName = "resourceprodvm0" $vm = New-AzureRmVMConfig -VMName $vmName -VMSize "Standard_A4" 'Define the Image to use' $vm = Set-AzureRmVMSourceImage -VM $vm -PublisherName MicrosoftWindowsServer -Offer WindowsServer -Skus 2012-R2-Datacenter -Version "latest" 'Add NIC Interface' $vm = Add-AzureRmVMNetworkInterface -VM $vm -Id $nic.Id 'Add DiskPath & Create VHD' $blobPath = "vhds/WindowsVMosDisk.vhd" $osDiskUri = $storageAcc.PrimaryEndpoints.Blob.ToString() + $blobPath 'Name OS Disk' $diskName = "ResourceVMosDisk" $vm = Set-AzureRmVMOperatingSystem -VM $vm -Windows $vm = Set-AzureRmVMosDisk -VM $vm -Name $diskName -VhdUri $osDiskUri -CreateOption fromImage 'Finally Create the VM in Azure' New-AzureRmVM -ResourceGroupName $rgName -Location $locName -VM $vm This script will do the following:

Ask you to login to your Azure Subscription
Set Deployment location to the SoutheastAsia Region
Create a Resource Group with the following attributes provisioned: Storage Account, Virtual Network (with Subnet), Create Public IP with vNIC assigned, Create VM (With Username & Password prompted for on the pop-up), Add a NIC INterface, Add DiskPath and Create VHD, Name the OS disk.
Create the actual VM itself (Predefined to a Standard_A4 VM). The script will in the end prompt you to name the VM (Name provided in the script body, or you can use your own)

Hope this helps you folks with your demo deployments! Cheers, Abhishek [gallery ids="175"]

(Hybrid) Cloud Design and Security

Abhishek_Pradhan — Mon, 30 May 2016 13:18:30 GMT

Hello again! I've been speaking on Security, Privacy & Compliance in the Public and Hybrid Cloud at industry/ partner events and Microsoft seminar's, both internal and external for quite a few years, and am very passionate about this topic. Recently, I was invited to speak at an Industry Security event by Trend Micro in Singapore, on the topic of (Hybrid) Cloud Design & Security to 'C' Level Executives, and I presented a small deck with a lot of information during the session. It was a lively discussion with the attending Executives on how they can obtain, and maintain even more granular compliance with logical controls, without compromising on data sovereignty and security. The discussion comprised several aspects of Public Cloud and Hybrid Cloud Security, how Security for customer workloads is a shared responsibility, and how everyone plays a part in ensuring a secure and compliant cloud computing environment. I'm uploading a sanitized version of my deck here. Obviously it has some MS confidential information removed, and proper attribution to sources given where necessary. I hope you enjoy downloading and reading the Hybrid Cloud Design & Security-STZD deck. Do feel free to post comments if you have questions, or if you feel I may have inadvertently missed attribution to any sources. Cheers and happy reading! Abhishek

Now Available: Windows Server 2016 TP5 Comparison Guide for Download

Abhishek_Pradhan — Mon, 16 May 2016 01:43:42 GMT

I'm happy to announce the public download of a detailed capability comparison guide for Windows Server 2016 TP5, with previous version of Windows Server 2012 R2 and Windows Server 2008 R2. This feature comparison guide compares selected features of Microsoft Windows Server 2008 R2, Windows Server 2012 R2, and Windows Server 2016. Its goal is to help customers understand the differences from the version they are running today and the latest version available from Microsoft. The comparison table includes comments about each feature, as well as notation about how well each feature is supported in each release. This is a fantastic resource and will help you details about new features in Windows Server 2016, and help your IT Business make focused decisions on why investing in Windows Server 2016 is a great decision. The comparison guide document is available publicly on our Windows Server 2016 page as a download under the Technical Resources section, and here is the direct link to the document download as well. Happy Reading! Abhishek

Microsoft Azure is compliant with PCI DSS 3.1

Abhishek_Pradhan — Thu, 05 May 2016 11:40:29 GMT

About the PCI matrix Introduction Coalfire conducted an assessment and found Microsoft Azure to be compliant with PCI DSS 3.1 as of March 4, 2016. This responsibility matrix has been created to illustrate and clarify the PCI compliance responsibilities for Microsoft Azure and the customers of Microsoft Azure services. As part of the assessment Coalfire analyzed an array of both customer-facing and internal infrastructure services. The Azure Compliance team has published the PCI matrix 3.1 compliance matrix online and it can be downloaded from here https://aka.ms/pci31matrix If you are a customer and have any Payment gateway/ services etc., hosted on the Azure platform, you can utilize the PCI matrix 3.1 as a good reference point. Happy reading! Abhishek

Bring the technology of Microsoft Azure to your own datacenter with Azure Stack!

Abhishek_Pradhan — Sat, 06 Feb 2016 07:53:00 GMT

Born from Azure, Azure Stack helps organizations deliver Azure services from their own datacenter.

With Azure Stack, Microsoft is bringing proven innovation – including IaaS and higher level PaaS services – from hyper-scale datacenters to on-premises, enterprise-scale environments to meet customers’ business requirements.

Wondering what Azure Stack will offer when it eventually goes GA?

Check out the list below: (Note: The list of services is subject to change without notice)

Compute - Virtual Machines (including extensions & availability sets)
Service Fabric* Data & Storage - Blobs, Tables, Queues*
Networking - Virtual Network, Load Balancer, VPN Gateway
Mgmt. & Security - Microsoft Azure Portal, Key Vault*
Web & Mobile - App Service (Web Apps, Logic Apps*, Mobile Apps*, API Apps*)
Developer Services - Azure SDK * PLANNED TO BE IN PREVIEW AT AZURE STACK GENERAL AVAILABILITY.

Want to know more? Check out the Azure Stack whitepaper now!

Practical Architectures Part 2: Scale Out File Servers & Firewalls: How to design your SOFS & Network topology

Abhishek_Pradhan — Fri, 05 Feb 2016 06:41:00 GMT

This one has been a long time in coming since my last blog post (almost 10 months to be precise) , but that's simply due to the amount of field deployments and engagements I have at hand. Finally am on my (well deserved) vacation from tomorrow, but going to spam the blog with a few posts before I head out with the family.

My last post dealt with SOFS & Firewalls, and I'm following that up with how to design the storage connectivity in a highly secured deployment (for the paranoid). If you see the architecture below, it represents what you could actually apply in a Production scenario (without the need for firewalls :P )

Network Architecture Diagram:

What you see here is a deployment based on Dell Hardware with the C6220 as Compute, SFP+10G capable switches, and MD3060E JBOD's as the Storage; and Cisco N2K TOR switches, while the Cisco N5K serves as an EOR

The way the network flow is structured is as follows:

Note: This architecture is formulated from the Microsoft Hybrid Cloud Reference Architecture, but devolved specifically to cater to a high security zone deployment.

1. We have created 4 VLANS on the N2K TOR switches to map to the Managed Nodes and SOFS. We are also Trunking the Z1 & Z2 VLANS, with multiple redundant links from the SOFS+JBOD's to the Managed Hyper-V nodes' VLANS.
2. SOFS authenticates with AD in Z3 VLAN through the RDMA link
3. SOFS RDMA link can ideally stay in the Z3 VLAN that we have created on the switch, but given the nature of the deployment, our recommendation is to have a separate Management Link to the Z4 VLAN, where the Master AD resides
4. The Hyper-V Management Fabric traffic flows thrugh the same SFP+10G links, connecting to the Z4 VLAN. There is no need to have separate 1GE ports

So what do you achieve with this? Quite a bit actually. You Decouple the Storage from the Compute, and lose the complexity of iSCSI or FC. At a high level, using commodity storage like JBOD's is what Hyper-Scale Cloud Service Providers like Microsoft do.

What other benefits do you get?

Let Windows do the work that was initially the fiefdom of expensive SAN technologies, you end up saving a TON of money, with more control.

Data delivery via standard protocol:

SMB 3.0

Load-balancing and failover:

Teaming (switch agnostic)

Load aggregation and balancing:

SMB multi-channel

Commodity L2 switching:

Cost effective networking (Ethernet)
RJ45
QSFP

Quality of Service:

Multiple-levels

Host workload overhead reduction:

RDMA

Scale Easily thanks to Software Defined Networking, while getting more granular control.

Hope this helps you to design, or even replicate some of the network topology in your environments (If you're feeling lazy :) ) based on what I've given above

Cheers!

Practical Architectures Part 1: Scale Out File Servers & Firewalls: To do or not to do?

Abhishek_Pradhan — Wed, 27 May 2015 23:53:00 GMT

Hello there, I'm back with Part 1 of a 2 post series that will try and address (hopefully) some of the more quirkier questions I / We've been getting about trying to put a firewall, in between a SOFS deployment and the Hyper-V nodes it connects to

WHAT!? Are you serious? Why would you do that?

Yeah, these, amongst several others are the reactions we get when someone throws this requirement at us: 'I know that the SOFS is great, but I want a firewall between the Hyper-V Hosts and the SOFS/ JBOD deployment in question, so I can ensure that the storage traffic is secure.'

Frankly speaking, there is no need for a firewall in between the Hyper-V Hosts SOFS/ JBOD's, and I'll go a bit in detail and elaborate on the What, Why and How's below.

First and foremost, go check out this fantastic article by Jason Gerend on how to Provide cost-effective storage for Hyper-V workloads by using Windows Server https://technet.microsoft.com/en-us/library/dn554251.aspx?f=255&MSPPError=-2147217396 and scroll down to the third diagram where he has outlined how the actual SOFS architecture looks at a High Level.

Now then, I guess you're read Jason's article and figured out What a Scale-Out File Server is and How it functions. 2 questions answered, now we move on to the requirement posed by some folks to us below.

If you've looked at Jason's article, you'll have noticed the 10GB Ethernet (Multiple Links) part in the design. What we've been asked is that is the following a recommended/ supported design:

Notice the Hardware Firewall performing Stateful inspection of SMB traffic, as it sits atop the SOFS Nodes, acting as an additional layer for the SMB traffic passing to and fro from the 10 Gb Ethernet switch(es) and the SOFS nodes? Sounds very straightforward right? It isn't so actually. Let's see why.

The Firewall will work as it's designed to do, but what you are ending up overlooking, is the kind of impact this is going to have on your SOFS and the resultant IO. This is what we term as a 'Bump in the Wire' situation, when an additional piece of equipment/ software is lobbed in between a perfectly good architecture simply to meet an age old/ antiquated security requirement/ or probably in 95% of the cases, a completely wrong interpretation of the requirement thereof.
To make this work, to a very basic level, you will have to configure the firewall to operate in Layer-2 Transparent Mode. What this means, is that a transparent firewall (or Layer 2 firewall), on the other hand, acts like a “stealth firewall” and is not seen as a Layer 3 hop to connected devices. The appliance connects the same Layer 3 network subnet on its inside and outside ports, but each interface of the firewall resides in a different Layer 2 Vlan.
This is a really bad move, since now you also end up with the possibility of the firewall inserting loops into your networks. See what happened there?

So while your intentions may be noble, you're going to end up with a mess on your hands once your workloads start asking for more IOPS.

So a couple of points to make here:

1. Could this 'bump in the wire' approach work? Answer: Maybe, maybe not.

2. Is this 'bump in the wire' approach supported/ recommended by Microsoft? Answer: No.

3. You definitely do not place a firewall in between your SAN arrays and the workloads, so why try this approach here?

4. If you're worried about someone trying to sniff traffic on the network, do remember that SMB 3.0 traffic is not your standard TCP/IP traffic. There's a whole lot of differences.

5. Check out Encryption in SMB 3.0: A Protocol Perspective http://blogs.msdn.com/b/openspecification/archive/2012/10/05/encryption-in-smb-3-0-a-protocol-perspective.aspx on how to Encrypt your SMB 3.0 traffic.

Now for me to draw up a Practical Architecture for how the SOFS and JBOD connectivity looks like on the network, when implemented per documented Best Practices

Microsoft Download Center: Microsoft Azure Datacenter IP Ranges & Windows Azure Mini Case Studies

Abhishek_Pradhan — Sun, 26 Apr 2015 22:20:00 GMT

Hello there, I'm sharing some useful resources around Microsoft Azure available on the Microsoft Download Center site.

The first download is about the Microsoft Azure Datacenter IP Ranges.

This file contains the Compute IP address ranges (including SQL ranges) used by the Microsoft Azure Datacenters, which you can share with your IT/ Network/ InfoSec teams for their information when setting up a Hybrid Cloud with Microsoft Azure. Each section specifies the geographic region and the IP address ranges associated with that region.

DOWNLOAD HERE

The second document one contains mini case studies on Microsoft Azure featuring ISVs for your reference.

DOWNLOAD HERE

Get the Windows Server 2012 R2 & Windows Server 2012 TechNet Library documentation as a PDF

Abhishek_Pradhan — Fri, 24 Apr 2015 19:19:02 GMT

Hello there,

Back in late 2013, we announced the availability of Microsoft Windows Server 2012 R2 and Windows Server 2012 TechNet Library documentation available as a PDF on Microsoft Download Center.

I would very highly recommend that you should always rely on the latest documentation available on http://technet.microsoft.com, but when you don't have internet access, the downloads below will offer you some respite :)

This download is an Adobe® PDF of the entire contents of the Windows Server 2012 R2 and Windows Server 2012 section of the Microsoft TechNet Library, for the convenience of Windows Server users who have limited Internet access, or require a portable version of the Windows Server 2012 R2 and Windows Server 2012 documentation. The PDF is 116 MB, and 7,970 pages in length. Highlights of the PDF include the following.

DOWNLOAD HERE

Happy reading!