Author: erjosito

My name is Jose Moreno, I am a Microsoft architect passionate about increasing efficiencies in the DC. Today I focus in Microsoft Azure, which I find fascinating. In my private time I can't help being a Star Wars fanboy... You can follow me in Twitter under @erjosito

ExpressRoute multi-region: triangles or squares?

by erjosito

The square design in ExpressRoute is not a recommended practice, but it can mean savings in ExpressRoute costs of up to 90%.

Azure Subnet Peering

by erjosito

First of all, my apologies for the radio silence, there have been some private projects going on during the Summer months that have kept me away from blogging. With that out of the way: what the heck is subnet peering? You probably know VNet peering, but is “subnet peering” now a thing? Well, not yet, … Continue reading Azure Subnet Peering

Simulating VPN sites in Azure with Ubuntu 24.04 and StrongSwan

by erjosito

Disclaimer: this post is going to be quite geeky. So this is not the kind of post you want to read if you don’t need this stuff. But hey, I needed to tell someone after getting this to work, plus this might be useful for somebody else, since I struggled to find these details out … Continue reading Simulating VPN sites in Azure with Ubuntu 24.04 and StrongSwan

ExpressRoute traffic visibility: Flow Logs or Traffic Collector?

by erjosito

You might have heard about VNet Flow Logs, I posted about this new Azure feature here. One of the applications of VNet Flow Logs is to gain visibility into traffic in places that had been blind spots until now, such as in the Gateway Subnets to inspect traffic on VPN or ExpressRoute. Talking about ExpressRoute, … Continue reading ExpressRoute traffic visibility: Flow Logs or Traffic Collector?

VNet Flow Logs recipes

by erjosito

You might have heard about the General Availability of Virtual Network Flow Logs in Azure, and even read the announcement blog post. When writing that post with Harsha CS I had the chance to play a bit with VNet Flow Logs and Traffic Analytics, and I would like to share some of the learnings. What … Continue reading VNet Flow Logs recipes

Do not let ExpressRoute, VPN and SDWAN traffic bypass your firewall

by erjosito

I have recently expanded my SDWAN in hub-and-spoke networks design guide to include SDWAN-to-firewall routing. Initially I didn’t have this point, but recent conversations have made me realize that not everybody understand this. The main difficulty in this topic is related to the fact that you cannot inspect the effective routes of your Virtual Network … Continue reading Do not let ExpressRoute, VPN and SDWAN traffic bypass your firewall

Azure network monitoring with synthetic traffic

by erjosito

Wow, that was a mouthful. But it describes what I would like to discuss in this post. Networks are at the basis of every IT infrastructure, so when they don’t work, everybody notices (and when they do work, nobody notices). Hence, monitoring computer networks to detect and fix problems as quickly as possible is a … Continue reading Azure network monitoring with synthetic traffic

Taxonomy of Azure PaaS service access

by erjosito

Azure PaaS service networking is quite a complex landscape to navigate. Documentation in Azure about this topic is located in different areas (under Networking and each specific PaaS service), and sometimes using inconsistent terminology. My goal in this blog post is setting a classification of PaaS services that can be used to navigate this complexity. … Continue reading Taxonomy of Azure PaaS service access

Designing your SDWAN and Firewall into Azure Hub and Spoke

by erjosito

Designing network connectivity in public cloud can very quickly become a daunting task. Of course, public cloud providers do offer native networking services, and with those it is fairly easy. This should always be your primary route (pun intended). For example, in the case of Azure, using Virtual WAN and its native integration with both … Continue reading Designing your SDWAN and Firewall into Azure Hub and Spoke