We want to thank everyone that participated in Windows Azure Connect CTP program.

Windows Azure Connect Team

For your Web and Worker roles, if they are configured to upgrade to the new guest OS automatically, then you don’t need to take any action. When the new OS is rolled out later this month Connect endpoint software will be automatically refreshed to the new version. To upgrade endpoint software manually, you can set below to true in your .cscfg and “Upgrade”.

<Setting name="Microsoft.WindowsAzure.Plugins.Connect.Upgrade" value="true" />

For PaaS VM role, the on-premise VHD image can be either updated via Windows Update or manually updated, and then re-uploaded.

For the new IaaS roles and on-premise machines, you can use Windows Update to upgrade or manually install.

To verify that upgrade worked, in the Silverlight portal, go to “Virtual Network” –> “Activated Endpoints” –> “Properties” to make sure the version is 1.0.0960.2.

If you plan to do manual upgrade, below is Microsoft Update Catalog upgrade link for manual install.

https://catalog.update.microsoft.com/v7/site/ScopedViewInline.aspx?updateid=f100960b-3ba9-4463-8efd-b0ae86c4dfd5

Place the “update” in the “basket”, click “download” to a temp folder, and run either the x86 or the amd64 upgrade package.

Directory of C:\temp\Update for Windows Azure Connect Endpoint Upgrade (1.0.0960.2)

08/24/2012  10:05 AM         2,948,720 AMD64-en-wacendpointupg_prod_d0e8b5df2bdf2587cdbb75fdfdef1946de7f5f56.exe

08/24/2012  10:05 AM         2,316,424 X86-en-wacendpointupg_prod_f2f3fe266e7a3399691042ce8eb4606dc82a6925.exe

--Jason Chen

--Jason Chen

For corporate machines distributing updates with WSUS (Windows Server Update Services) or SCCM (System Center Configuration Manager), the endpoint update can be imported into WSUS from the Microsoft Update Catalog https://catalog.update.microsoft.com/v7/site/Search.aspx?q=windows%20azure%20connect .

For machines not receiving updates from WSUS (Windows Server Update Services), just start Windows Update, Check for updates, and select Windows Azure Connect Endpoint Upgrade.

--Jason Chen

--Jason Chen

We’ve identified a simple workaround to avoid the timeout and speed up connections: create a firewall rule on your Azure roles to block outbound connections to SQL over IPv4. That causes the incorrect IPv4 connection to fail immediately instead of timeout. The easiest way to accomplish that is to add a startup task to your role that runs a command like:

netsh advfirewall firewall add rule name="BlockIPv4SQL" dir=out action=block protocol=tcp remoteport=1433 remoteip=(your on-premise IPv4 range)

Note that if you use SQL Azure in addition to SQL over Windows Azure Connect, you will need to ensure the the remoteip range in the rule exempts traffic to your SQL Azure servers.

If you’re looking for other performance improvements, make sure you’re using a relay close to you.

--Morgan Brown

To address this feedback, we introduced certificate based activation in our latest CTP Refresh. You can now choose to use existing activation model (token based only - this is the default) or certificate based activation (token + certificate). In this refresh, certificate based activation is only available for local endpoints.

If you already have PKI and/or have a mechanism to securely distribute X509 certificates (private + public key pairs) to your endpoints within your organization, you are just few steps away from benefiting from this new feature:

1. On your corporate network, pick a Certificate Issuer that issues certificates to endpoints via manual/auto-enrollment policies.

For example, the above snapshot shows that a machine that receives certificate from the issuer with CN=SecIssuer. In this case, the public key (.cer file) of CN=SecIssuer will need to be exported and saved for step 3 below.

Note: If you have deeper PKI hierarchy (example: CN=RootIssuer -> CN=SecIssuer -> CN=myendpoint), make sure you export the public key of the direct/immediate issuer i.e., CN=SecIssuer.

2. From the Windows Azure Management Portal, Click on the “Activation Options” as shown in the snapshot below.

3. This will bring up the certificate endpoint activation dialog (shown in the snapshot below):

a. Check the box that says “Require endpoints to use trusted certificate for activation”.

b. Click on “Add” button and choose the certificate (.cer file with public key only) file from Step 1 above.

4. At this point, all the new endpoints (excluding Azure roles) in this subscription will be required to prove their strong identity via the possession of a certificate issued by the issuer in step 1 above. The endpoint must have private keys for this certificate, but there is no requirement for the subject name to match the endpoint’s FQDN or hostname (example: CN=myendpoint can be used on a machine with name ContosoHost.Corp.AdventureWorks.com).

5. If you run into activation issues with this model, you can troubleshoot by checking the event viewer for any error messages such as below:

a. Verify that you have a certificate in the Local Computer\Personal\Certificates store. This certificate should have been directly issued by the issuer in step 1 above.

b. Verify that there is a private key for this certificate.

To change the relay location, click on “Relay Region” (the new button added in CTP refresh) and pick the relay location you desire, by default USA is chosen for you.

Please be aware that if you change your relay location, there will be a transition period of up to 5 minutes while your existing endpoints refresh their policy (which contains the relay location information), close their existing relay connections, and re-establish connections with the new relay location.  During this time period, endpoints may not be able to communicate with each other until they have completed the transition to the new relay location.

--Jason Chen

If you downloaded and installed the Windows Azure SDK 1.4 refresh from the Windows Azure web site before 4pm PST 4/25/2011, you will have to uninstall and reinstall it.

1. Go to Control Panel\Programs\Programs and Features, uninstall SDK 1.4 refresh.

2. Install Windows Azure SDK 1.4 refresh from the Windows Azure web site.

We apologize for any inconvenience this issue may have caused. Thank you.

--Jason Chen

1. Install the Windows Azure Connect Endpoint software on the LoB server and laptop using the install link from the Windows Azure Management Portal. Full instructions are at here.

2. Create an endpoint group containing all of the machines you would like connect. In the “Create a New Endpoint Group” dialog, check the “Interconnected” checkbox. This checkbox allows all of the machines in the group to connect to each other.

3. Wait up to 5 minutes for the endpoints to implement the new connectivity. At this point, your machines can connect. (If you’re in a hurry, you can also manually refresh on your machines if you follow the instructions here).

One caveat worth noting: in certain networks, if both Windows Azure Connect endpoints are in the same LAN, connections will go through Windows Azure Connect instead of the local LAN connection. If some of your machines are always on the same network, consider putting them in a separate, non-interconnected group and following the next set of instructions.

Using the “Interconnected” checkbox works well if you’re ok with having all of your machines connect to each other, but sometimes you want a little more control. For instance, say you have two roaming laptops that you want to connect to your LoB server, but you don’t want them to connect to each other. Maybe they belong to customers or outside contractors, or maybe you’re connecting branch offices to the central office. Instead of using interconnection, you can create endpoint groups and connect them to each other. Machines in the first group will be able to connect to machines in the second, but not to each other. To set this up, follow the steps below.

1. Install the Windows Azure Connect Endpoint on the LoB server and both laptops.

2. Create an endpoint group for the LoB server.

3. Create another endpoint group for the roaming laptops and connect it to the LoB group.

4. Wait up to 5 minutes for the endpoints to implement the new connectivity. At this point your laptops can connect to your LoB server, but not to each other.

You can mix and match interconnection and connecting endpoint groups and Windows Azure roles to build whatever kind of connectivity suits your needs.

--Morgan Brown