Restricting remote access to Azure Virtual Machine

If you create virtual machines in Microsoft Azure, you typically connect to them using RDP (if they are of course Windows machines). What you may not be aware of is the fact that you restrict, or whitelist, which remote IP addresses are allowed to RDP to these machines. Here’s how you configure this.

You login to you Microsoft Azure console as shown above.

In here is a Windows Domain Controller machine. What I want to do is restrict remote RDP access to this machine for security reasons (since it is a Domain Controller after all).

To do that select the Virtual Machine from the list and then the Endpoints option from the menu across the top as shown above.

At the moment there are only have two endpoints, one for PowerShell and one for Remote Desktop (i.e. RDP). Both of these services are accessible to the outside world via the Public port (which I have obscured for privacy reasons). These Public ports map to familiar Private ports at the virtual machine.

Thus, Remote Desktop connects via a random port from the Internet and this then mapped to the familiar port 3389 port internally at the machine.

To set security on an Endpoint, simply select it and then select the MANAGE ACL button at the bottom of the screen.

You will then see a dialog that allows you to enter a description as well as a remote subnet. You can then set the action to be either Permit or Deny. With RDP traffic the default is to allow all inbound traffic for that endpoint. All other ports are blocked for inbound traffic unless endpoints are created for those ports.

Points to consider:

No ACL – By default when an endpoint is created, Azure permits all for the endpoint.
Permit – When you add one or more “permit” ranges, you are denying all other ranges by default. Only packets from the permitted IP range will be able to communicate with the virtual machine endpoint.
Deny – When you add one or more “deny” ranges, you are permitting all other ranges of traffic by default.
Combination of Permit and Deny – You can use a combination of “permit” and “deny” when you want to carve out a specific IP range to be permitted or denied.

(Reference – http://msdn.microsoft.com/en-us/library/azure/dn376541.aspx)

You can of course configure these ACLs using PowerShell and the reference for that is here:

http://msdn.microsoft.com/en-us/library/azure/dn376543.aspx

more information about setting endpoints for virtual machines can be found at:

http://azure.microsoft.com/en-us/documentation/articles/virtual-machines-set-up-endpoints/

Add a custom domain to Azure

Microsoft Azure shares many commonalities with Office 365. When you sign up you are given a default .onmicrosoft.com domain but you can also add you own custom domain. here’s how to do just that.

http://manage.windowsazure.com

From the menu on the left locate the Active Directory icon, which is near the bottom and select it.

You should then see a single entry called Default Directory displayed, select this.

From the menu that now appears across the top select DOMAINS. You’ll then see the above message indicating that you can add a custom domain.

Select ADD A CUSTOM DOMAIN.

In the field that appears, enter the custom domain you wish to use and then press the add button at the bottom.

You should now see a message at the top of the dialog saying that the domain has been successfully added.

Select the arrow in the bottom right to move to the next page in the process.

Much like Office 365 you’ll need to verify that you own this domain. You do that be adding a DNS record to your domain records and having Windows Azure verify it.

There are a number of verification options but the best is normally a simple TXT record. If you therefore select RECORD TYPE as TXT record at the top you’ll be provided with the DNS information you need to add to your domain.

You then got to the name records for you domain and add the supplied details to match the record selected in Windows Azure.

When you have updated your domain record return to Windows Azure and select the verify button at the bottom.

Windows Azure will then query the DNS records of your domain to verify that a matching record can be found. If so, you will receive a verification confirmation message at the top of the dialog as shown above.

Press the check mark in the lower right to complete the process.

You should now see the domain you just added listed in the domains option as shown above.

Again, much like Office 365 you can add multiple domains to Windows Azure as required.

With that done, now we can start utilizing this custom domain inside Windows Azure and I’ll cover that in upcoming blog posts.

Windows 7 and 8 machines come to Azure

Oh man, this blog is currently turning into the ‘I love Azure’ site isn’t it? But WOW, here’s another announcement that is a game changer in my mind.

Microsoft Azure now has Windows 7 and 8 virtual machines as you can see from the above screen shot. Before this I was using Windows Server 2012 as a workstation to have a ‘clean’ machine to test and demo Office 365.

With the availability of these new desktop Windows systems I can create an even more EXACT test/demo installation in the cloud. This is BRILLIANT since I can now dozens of machines in Azure to test all sorts of scenarios. I would have run out of disk space long ago if even attempted this on my workstation.

Here’s another thing to ponder. if Windows desktop systems are now available via Azure how far away can a full blown Virtual Desktop Offering be? How long can it be before this Virtual Desktop becomes an option in Office 365? My guess? Not long.

Enough. I’m off to spin up more Azure demo machines. What can I say? I love Azure more and more every day!

Clarification – I overlooked the fact that these images are currently only available to MSDN subscribers. Also these images are not meant for production just testing. However, none the less, it certain tells me where all this is going.

Problems mounting ISOs in Server 2012 R2

So here’s a weird one. I’m am running up a new Windows Server 2012 R2 Azure machine to use as a desktop for an Office 365 demo. I need to install Office 2013 on it so I download the trail IMG file (and oh man did it download to my Azure machine quick!).

I renamed the file to .ISO and then right mouse click on it and select Mount from the menu.

I get the nasty message above. I re-download the image and try again. Same result.

I do some research and discover that one option is simply to copy the file to a new location. I do this, to c:\, and now it will mount. Strange!

I suppose maybe some sort of file handle is still open after the initial download? Don’t know. All I can say is that copying the ISO after the download and mounting it worked for me.

I finally get Microsoft Azure

Ever since Microsoft Azure (recently renamed from Windows Azure) has been available I have struggled with a reason to use it. This also flows over into reasons of why other SMB reseller or customers would have cause to use it. Does that mean that it was merely a tool for the enterprise? The answer is definitely ‘NO’ now that I have come to better understand its application for me and potentially others in the SMB space.
So here’s the challenge that brought me to my Azure epiphany.
I have always been a big users of virtual machines. I have used products like Microsoft Virtual PC and Hyper V to allow me to have access to a number of different operating systems for support. Over time I migrated my six independent servers into a single Hyper V machine that used to host things like web sites and my old SharePoint blog. In an effort to save money, stay simple and utilize the cloud more I decommissioned this production Hyper V server a few years ago.
The problem was that besides running production environments that Hyper V box also had a number of test machines that I used to power up and down as required. My need for these virtual test machines continued even after decommissioning the Hyper V server.
I was able to use a product like Virtual Box on a more powerful laptop to achieve the testing environment I required. With 8GB of RAM and some big disks the laptop faired well for demos and training purposes. It certainly was a lot to lug around but with Virtual Box on there it did the job.
One of the other reasons I need a number of virtual servers is for when I do a SharePoint migration. Typically this involves swinging the database into a new version of SharePoint and allowing it to convert. Unfortunately, you can’t for example template a calendar element in SharePoint 2010 and import it directly into SharePoint 2013, you can only go from 2013 to 2013 version. Thus, this meant converting the data to the same version and then migrating.
Where this started to become an issue was the release of SharePoint Foundation 2013. No longer could I deploy a stand alone SharePoint Foundation server, I now needed to have a Domain Controller as well since SharePoint Foundation required a domain login to install. It was certainly possible to install SharePoint Foundation 2013 on a domain controller but that really wasn’t supported and it also provided a different experience. So now even to do the most simple thing with SharePoint Foundation 2013 I needed two virtual machines running.
The requirement of two virtual machines started to make it hard to work with the old laptop I was using. All I needed was more RAM but that wasn’t an option with this laptop. So my thoughts then turned to potentially replacing my aging desktop with a more ‘beefy’ box with plenty of RAM so I could run all the virtual machine I needed. This however wasn’t going to be cheap and would take up space and chew more power. It also wasn’t going in the direction I wanted to head, which was simplicity, small devices and cloud based systems. It also meant that I wouldn’t have a portable solution as I do now with the laptop. So where to now?
I considered perhaps getting my own equipment in a datacentre or ‘renting’ a server but then I wondered with Microsoft Azure could do the trick.
Spinning up a server is easy enough and after a few false starts when it came to networking everything together I finally got two servers connected together using Azure. I made one a domain controller and the other a SharePoint Foundation Server 2010 box. With that accomplished I then set up a SharePoint Foundation 2013 box with ease.

So here’s one of the first benefits of Azure. As I have documented in this blog previously, SharePoint Foundation 2013 requires a lot more resources than SharePoint 2010. In Azure that’s no problem. I can start with the lowest spec machine and easily scale up as required. So for this initial machine I have bumped it up to 2 cores and 3.5GB of RAM (which still isn’t really enough) and I can continue to bump it up if required.
After also building a stand alone Windows SharePoint Services v3.0 server also in Azure I now have all the machines I need to do a migration. Best of all, say the migration has a lot of data that will take a while to process I can simply ramp up the power of each Azure virtual machine to allow it to complete the task quicker. When I have finished, I simply scale it back to what it was before.

Previously, people would physically mail me their SharePoint data to convert, now I can simply give them access to the Azure virtual machine and they can directly upload it there. Once I convert the data I can also give them access to the same machine so they can check it before proceeding. Easy.
So now I no longer to carry around my laptop with my SharePoint migration machines, I can do it all on Azure from any machine on which I can access the Internet with, including my Mac! That means that I don;t have to ‘waste’ my money on getting another super powered desktop. I can throw it out and use my Surface PC instead.
Now enamoured with Azure I began to consider what else I could use it for and found yet another example.
Another virtual machine that I maintain is one that is set up to use for PowerShell access to Office 365. That way it is isolated and can be used independently of what maybe installed on my desktop. I have now set up a similar machine in Azure so now I can use PowerShell with Office 365 no matter where I am. This makes it far more convenient than having to fire the laptop up to do something simple. Again, I can do this wherever I have a browser.
Now you might be asking about the cost of all this. Because most of the time these machines are powered off the cost of usage is extremely low. With all the running up of a domain controller, three SharePoint servers and a PowerShell machine my total cost (including all the data transfers for install files) is less than $5! A new powerful desktop would have cost be probably in the range of $2,400 dollars. That is an allowance of about $200 per month for 12 months of Azure which I can’t see myself getting anywhere near. Thus, it may only cost me $10 – $50 per month which over the year is a huge saving from shelling out for a desktop (not to mention the run up time which I didn’t include).
Thus, Azure now makes sense to me in terms of agility for my business. It now makes sense to me in terms of cost saving. It also makes sense to me in the opportunity to do so much more with the product. All I have done is play with virtual machines, which is only a very small component of what is possible with the product.
I have a long, long way to go to truly understand and utilize the product to its full extent but now I GET IT. I am beginning to see the benefits it can provide me and thus it is opening my eyes as to what is possible for customers.
So if you are an IT Professional I urge you to get into Azure and understand what it can do. Like me, I’m pretty sure that once you do you’ll see the light like I have.
I’ll be posting more about Azure from now on as I discover more about how it works and how to configure it so stay tuned.

Great Azure intro demo

I’ve been lucky enough to have MVP Troy Hunt on a CIAOPS podcast (http://ciaops.podbean.com/2012/02/28/episode-24-troy-hunt/) as well as present on a Desktop to Cloud webinar (https://www.youtube.com/watch?v=bxu5qYCtv1s).

Troy has now done an excellent introduction/overview video on Windows Azure. This is really great if you are wanting to know what Azure actually does and for resellers it also goes into how you can make money with the platform.

The video is about 90 minutes but well worth setting aside the time to watch as it will answer many questions you may have.

Great work Troy. If you haven’t already, head over to Troy’s blog (http://www.troyhunt.com/) and follow all the amazing stuff he blogs about and the information he provides.