Tag: azure

Do not let ExpressRoute, VPN and SDWAN traffic bypass your firewall

by erjosito

I have recently expanded my SDWAN in hub-and-spoke networks design guide to include SDWAN-to-firewall routing. Initially I didn’t have this point, but recent conversations have made me realize that not everybody understand this. The main difficulty in this topic is related to the fact that you cannot inspect the effective routes of your Virtual Network … Continue reading Do not let ExpressRoute, VPN and SDWAN traffic bypass your firewall

Get certificates with Azure Key Vault extension to your Linux VMs

by erjosito

Certificate management is one of those IT disciplines that is nobody’s dream, and still it can have quite a dramatic (negative) impact in your web presence if not done properly, such as users being told by the browser that your site is not secure. Azure has a nice little tool to manage certificates and bring … Continue reading Get certificates with Azure Key Vault extension to your Linux VMs

IPvlan with Docker in Azure

by erjosito

Today I was looking at IPvlan on a docker container in Azure along a colleague, and we found that there are plenty of documentation and blogs out there that might be confusing when running this setup on Azure. What is this IPvlan thing, I hear you ask? Docker has a good explanation here, but let … Continue reading IPvlan with Docker in Azure

Azure Networking is not like your on-prem network

by erjosito

I often get asked about the differences between Azure Networking and a traditional, on-premises network. I have been hit with a flu the last few days, so I had some time to think about this, and I decided to start writing whatever thoughts were not actually the result of the fever. In this post I … Continue reading Azure Networking is not like your on-prem network

Workload identity on AKS with Python: boring

by erjosito

I finally decided to carve out an afternoon to test workload identity on AKS. I had done some preliminary reading, and my conclusion was that there had to be some voodoo magic and quantum entanglement at play there to make it work, so I braced myself for failure. The goal of the exercise was clear: … Continue reading Workload identity on AKS with Python: boring

Azure DNS Private Resolver without VNet Peerings

by erjosito

As you might already know, Azure DNS Private Resolver is an Azure service that support DNS forwarding between Azure and on-premises DNS servers. It is very useful to provide Azure DNS resolution to on-premises clients (for example to access private endpoints), or to provide on-premises DNS resolution to Azure clients (to access on-prem resources). Last … Continue reading Azure DNS Private Resolver without VNet Peerings

Pimp your serial console with tmux

by erjosito

I have a short one for today, which I just found out with a colleague when troubleshooting Kubernetes: we only had connectivity to a VM over the console, but we needed to execute two commands at the same time: generate some traffic on one side, and have some tcpdump running on the other. First of … Continue reading Pimp your serial console with tmux

Azure Route Server: to encap or not to encap, that is the question

by erjosito

Azure Route Server is a very powerful tool that thas been recently brought to the Azure Networking toolset: it offers a BGP API so that virtual machines can communicate with a VNet to learn and advertise routes. I have written some articles about Route Server in the past on how to achieve certain scenarios, but … Continue reading Azure Route Server: to encap or not to encap, that is the question

“You are doing your design reviews wrong”

by erjosito

I have the privilege of working in a team in Microsoft with very talented individuals, where we help Microsoft customers to overcome technical challenges with their Azure deployments. One of the most common engagements that we do for organizations using Azure is helping them to verify that their Azure designs fulfill their functional and non-functional … Continue reading “You are doing your design reviews wrong”