Microsoft Azure Infrastructure and Deployment -Course

Course Overview

AZ-100 Microsoft Azure Infrastructure and Deployment

Manage Azure Subscription and Resources 

·         Manage Azure subscriptions and billing, and implement Azure policies.

·         Implement access management with Azure users, groups, and role-based access control.

·         Use Azure Monitor to configure Azure alerts and review the Azure Activity Log.

·         Query and analyze Log Analytics data.

·         Deploy resources with ARM templates and organize Azure resources.

·         Optimize your use of Azure tools like the Azure portal, Azure PowerShell, Cloud Shell and the Azure CLI.

Implementing and Managing Storage

·         Create Azure storage accounts for different data replication, pricing, and content scenarios.

·         Implement virtual machine storage, blob storage, Azure files, and structured storage.

·         Secure and manage storage with shared access keys, Azure backup, and Azure File Sync.

·         Store and access data using Azure Content Delivery Network, and the Import and Export service.

·         Monitor Azure storage with metrics and alerts, and the Activity Log.

Deploying and Managing Virtual Machines 

·         Explain virtual machine usage cases, storage options, pricing, operating systems, networking capabilities, and general planning considerations.

·         Create Windows virtual machines in the Azure Portal, with Azure PowerShell, or using ARM Templates.

·         Deploy custom server images and Linux virtual machines.

·         Configure virtual machine networking and storage options.

·         Implement virtual machine high availability, scalability, and custom scripts extensions.

·         Backup, restore, and monitor virtual machines.

Configure and Manage Virtual Networks 

·         Understand virtual networking components, IP addressing, and network routing options.

·         Implement Azure DNS domains, zones, record types, and resolution methods.

·         Configure network security groups, service endpoints, logging, and network troubleshooting.

·         Implement site connectivity schemas including VNet-to-VNet connections and virtual network peering.

Manage Identities

·         Implement Azure Active Directory, Self-Service Password Reset, Azure AD Identity Protection, and integrated SaaS applications.

·         Configure domains and tenants, users and groups, roles, and devices.

·         Implement and manage Azure Active Directory integration options and Azure AD Application Proxy.

AWS Solution Architect –Associate -Course

 AWS Solution Architect –Associate

                AWS - AWS Technical Essentials

>Introduction and History of AWS
>AWS Foundational Services: EC2, VPC, S3, EBS
>AWS Security, Identity, and Access Management: IAM
>AWS Databases: RDS, Dynamo DB
>AWS Management Tools: Auto Scaling, Cloud Watch, Elastic Load Balancing, Trusted Advisor

Course Content

1 Domain 1.0: High Availability and Business Continuity

1.1 Demonstrate ability to architect the appropriate level of availability based on stakeholder requirements

1.2 Demonstrate ability to implement DR for systems based on RPO and RTO

1.3 Determine appropriate use of multi-Availability Zones vs. multi-Region architectures

1.4 Demonstrate ability to implement self-healing capabilities

Content may include the following:

• High Availability vs. Fault Tolerance

2 Domain 2.0: Costing

2.1 Demonstrate ability to make architectural decisions that minimize and optimize infrastructure cost

2.2 Apply the appropriate AWS account and billing set-up options based on scenario

2.3 Ability to compare and contrast the cost implications of different architectures

3 Domain 3.0: Deployment Management

3.1 Ability to manage the lifecycle of an application on AWS

3.2 Demonstrate ability to implement the right architecture for development, testing, and staging

environments

3.3 Position and select most appropriate AWS deployment mechanism based on scenario

4 Domain 4.0: Network Design for a complex large scale deployment

4.1 Demonstrate ability to design and implement networking features of AWS

4.2 Demonstrate ability to design and implement connectivity features of AWS

5 Domain 5.0: Data Storage for a complex large scale deployment

5.1 Demonstrate ability to make architectural trade off decisions involving storage options

5.2 Demonstrate ability to make architectural trade off decisions involving database options

5.3 Demonstrate ability to implement the most appropriate data storage architecture

5.4 Determine use of synchronous versus asynchronous replication

6 Domain 6.0: Security

6.1 Design information security management systems and compliance controls

6.2 Design security controls with the AWS shared responsibility model and global infrastructure

6.3 Design identity and access management controls

6.4 Design protection of Data at Rest controls

6.5 Design protection of Data in Flight and Network Perimeter controls

7 Domain 7.0: Scalability and Elasticity

7.1 Demonstrate the ability to design a loosely coupled system

7.2 Demonstrate ability to implement the most appropriate front-end scaling architecture

7.3 Demonstrate ability to implement the most appropriate middle-tier scaling architecture

vSphere 6.7 Course Contents

VMware vSphere 6.7 with ESXi and vCenter

Detailed Chapter List

Chapter 1 – Virtualization Infrastructure Overview

• Virtualization explained

• How VMware virtualization compares to traditional PC deployments

• Common pain points in PC Server management

• How virtualization effectively addresses common IT issues

• VMware vSphere software products

• What's New and Improved in vSphere 6.7

Chapter 2 – How to Install, Configure ESXi 6.7

• Understanding ESXi

• Selecting, validating and preparing your server

• Storage controllers, disks and partitions

• Software installation and best practices

• Join ESXi to a Domain

• Local User Management and Policies

• First look at the VMware vSphere Client and VMware Host Client

Chapter 3 – Virtual and Physical Networking

• vNetwork standard and distributed virtual Switches

• Virtual Switches, Ports and Port Groups

• Creating VMkernel ports

• Creating, sizing and customizing Virtual Switches

Chapter 4 – Connecting to and Using NAS Shared Storage

• Benefits Shared Storage offer to Virtual Infrastructure

• NFS Overview

• Configuring ESX to use NFS Shares

• Configuring NFS for performance and redundancy

• NFS Use Cases

• Troubleshooting NFS connections

Chapter 5 – Virtual Hardware and Virtual Machines

• VM virtual hardware, options and limits

• Sizing and creating a new VM

• Assigning, modifying and removing Virtual Hardware

• Working with a VM’s BIOS

• VMware remote console applications

• Installing an OS into a VM

• Driver installation and customization

Chapter 6 – vCenter Server Appliance and Web Client

• The need for Identity Source management

• Installing and configuring vCenter Server Appliance with an embedded Platform Service Controller

• Connecting Single Sign On (SSO) to Active Directory and other identity sources

• vCenter feature overview and components

• Organizing vCenter's inventory views

• Importing ESX hosts into vCenter management

• Administering vCenter Server with Web Client

Chapter 7 – VM Rapid Deployment using Templates, Clones

• Templates – Virtual Machine Golden Master images

• Creating, modifying, updating and working with Templates

• Patching, and refreshing Templates

• Cloning, one time copies of VMs

• Best practices for cloning and templating

• Adding and resizing virtual disks

• Hotplug VM virtual CPUs and Memory

Chapter 8 – ESXi and vCenter Permission Model

• VMware Security model

• Configuring local users and groups

• Managing local permissions

• vCenter security model

• Local, Domain and Active Directory users and groups

• How permissions are applied

Chapter 9 – Using Fibre and iSCSI Shared Storage

• Fibre SAN overview

• Identifying and using Fibre Host Bus Adapters

• Scanning and Rescanning Fibre SANs

• iSCSI overview

• Virtual and physical iSCSI adapters

• Connecting to iSCSI storage

• Scanning and rescanning iSCSI SANS

• Performance and redundancy considerations and best practices

• Understanding the benefits of VMware VAAI compliant storage

Chapter 10 – VMware File System (VMFS)

• Unique file system properties of VMFS

• Managing shared Volumes

• Creating new VMFS partitions

• Explanation of new VMFS 6 features and capabilities

• Managing VMFS capacity with LUN spanning and LUN expansion

• Native and 3rd party Multipathing with Fibre and iSCSI SANs

• VMFS performance considerations

• VMFS scalability and reliability

Chapter 11 – Infrastructure Monitoring with vCenter Alarms

• Alarm categories and definitions

• Creating custom alarms and actions

• Configure vCenter so it can send E-mail and SNMP alerts

• Reviewing alarms and acknowledging them

• Work with alarm conditions, triggers and actions

• Identify most useful alarms to review and enable

Chapter 12 – Resource Management and Resource Pools

• Delegate resources in bulk using Resource Pools

• How ESX delivers resources to VMs

• Shares, Reservations and Limits

• CPU resource scheduling

• Memory resource scheduling

• Resource Pools

Chapter 13 – VMotion Migration, Cold Migration, Storage VMotion

• Cold VM migrations to new ESX hosts, datastores

• Hot Migrations with VMotion

• VMotion requirements and dependencies

• How VMotion works – detailed explanation

• Troubleshooting VMotion

• How to test hosts for VMotion compatibility

• Storage VMotion for hot VM disk migrations

Chapter 14 – Distributed Resource Scheduling Clusters

• CPU and Memory resource balanced clusters with VMware Distributed Resource Scheduler

• DRS Cluster configuration and tuning

• Per-VM cluster policy overrides

• Learn the features and benefits of DRS Power Management

Chapter 15 – Failure Recovery with High Availability Clusters

• High Availability options to minimize unplanned down time

• How VMware HA protects against ESXi host, storage network and SAN volume failures

• Understand and review HA’s many policies

• Introduction to continuous VM availability using VMware Fault Tolerance

Chapter 15.1 – Failure Recovery with High Availability Clusters

• How Fault Tolerance provides continuous VM availability during ESXi host, storage network and SAN

storage failures

• How to configure ESXi hosts and networks to enable Fault Tolerance

• How to configure, enable and monitor Fault Tolerance on VMs

• Managing Fault Tolerance protected VMs

• Fault Tolerance scalability, performance and limitations

Chapter 16 – Disaster Preparedness with vSphere Replication

• Explain vSphere Replication features and Use Cases

• Import the vSphere Replication virtual appliance

• Configure vSphere Replication including Recovery Point Objectives (RPOs)

• Performing an initial VM replication

• Scheduling periodic VM synchronization to the replication target site

• Recover a VM using vSphere Replication

Chapter 17 – Patch Management with VMware Update Manager

• Configure and enable VMware Update Manager

• Establishing a patch baseline

• Verifying compliance and patching ESXi hosts

Chapter 18 – Managing Scalability and Performance

• VMkernel CPU and memory resource management mechanisms

• Tuning VM storage I/O performance

• Identifying and resolving resource contention

• Monitoring VM and ESX host performance

• Performance and capacity planning strategies

Free vSphere 6.5 Host Resources Deep Dive E-Book

Free vSphere 6.5 Host Resources Deep Dive E-Book

http://frankdenneman.nl/2017/11/07/free-vsphere-6-5-host-resources-deep-dive-ebook/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed:+frankdenneman%2FZjZC+(frankdenneman.nl)

VMware Validated Design

VMware Validated Design is a family of solutions for data center designs that span compute, storage, networking, and management, serving as a blueprint for your Software-Defined Data Center (SDDC) implementation.

VMware Validated Design for Software-Defined Data Center

VMware provides three implementations of VMware Validated Design for Software-Defined Data Center.

• The standard implementation of VMware Validated Design for Software-Defined Data Center provides single or dual region data center architecture for an organization’s primary data centers. You can use this implementation a base for additional implementations such as VMware Validated Design for Remote Office and Branch Office (ROBO).
• The ROBO implementation extends the standard implementation to include remote locations that require fewer resources. This implementation is suitable for deployments that are spread out geographically but that you want to manage more centrally. You must have the VMware Validated Design for Software-Defined Data Center primary data centers in place before working with the ROBO implementation.
• The Consolidated SDDC implementation is an alternative to a single-region VMware Validated Design for Software-Defined Data Center configuration where you use one consolidated pod to run both management and tenant workloads. This implementation is suitable for configurations with lower startup cost and hardware footprint.

Logical Design of an SDDC

AWS Certified Advanced Networking Prep – Direct Connect

  

This post is part of a multi-series blog to help folks prepare to take the AWS Certified Advanced Networking Exam. As the title indicates, this section is dedicated to Direct Connect, which is a major topic for the exam.

Introduction to BGP

BGP operates over tcp_179 and requires manual peering. By design, there is no auto-discovery. BPG is a path-vector – not link-state or distance-vector. BGP shares the best path to a destination with its peers – it does not share every path it knows. BGP will take the path with the least amount of hops. If two routes are equal, it will use the first route that it receives. A router only knows about its directly connected links or those learned from some other protocol. It will advertise those routes and prepend its own routes when advertising to its neighbors. Path choice can be flexibly changed as needed to ensure the desired path between networks. BGP does not care about the speed of the links to a network, therefore features such as AS_Path Prepending, MED, Local_Preference, and weights are critical to ensuring ideal routing.

• AS Path Prepending – can be used to influence traffic patterns – basically it advertises the link to look like it has more hops, making the route look less desirable to the receiving router.
  • BGP prefers routes with the fewest hops, therefore lower is preferred
  • for Direct Connect, advertising more hops affect return traffic from AWS back to your premises
  • an example would be to advertise additional hops for 1GB Direct Connect to a DR site rather than the Direct Connect to the primary data center
• MED – Multi-Exit Discriminator – used to influence inbound routing for a site with multiple links
  • lowest preferred
  • used to influence return traffic from AWS
• Local_Pref – similar to weight, allows you to change the preference to the desired link over another – unlike weights, local_pref is advertised to other routes via iBGP
  • local to the AS using the same AS number (iBGP)
  • default value = 100
  • the route with highest local_pref is preferred
  • For DX, it affects outbound traffic to AWS
• Weight – change preference to a link – local to only the router the weight is configured on and is not always supported – weights are not advertised to other routes
  • affects outbound traffic from the router
  • highest weight wins
  • Cisco default weight is 0 and the value can be from 0 to 65535

Direct Connect Introduction

Direct Connect is one of the few solutions on the AWS platform that is actually a hardware solution. However, because it requires physical hardware, it is not an instant setup. Through a Direct Connect location, you co-locate your own router which will physically connect to the AWS Direct Connect router with a cross-connect fiber. When ordering from AWS, you can only order a 1GB or a 10GB connection. You can, however, order slower speeds when working with a 3rd-party partner, like CenturyLink or Equinix. The location is generally a co-location facility where AWS owns its own racks and equipment. They are NOT located in an AWS region, however, each AWS Direct Connection is affiliated with one, and only one, AWS region and it’s important to ensure you’re selecting the correct region and location when requesting a connection through the AWS console. Once the request is made for a connection, AWS will provide a Letter of Authority (LOA) to connect to their router.

It’s important to note that Direct Connect is not resilient by default and if you require redundancy, you need to either order a second DX connection or combine it with a secondary solution, such as a VPN backup. Using BGP, these solutions can be configured to provide automatic failover. If you do order multiple connections through the same facility, AWS will ensure that the connections are provisioned on different routers to ensure the routers are a not single point of failure. To design an even better solution, use multiple DX locations, as most of the regions have multiple Direct Connection locations to allow customers to create connections through multiple facilities.

A DX connection is much more expensive than using VPN but you get additional benefits, such as reduced bandwidth costs, consistent network latency between your premises and the AWS VPC(s) you’re connecting to, as well as consistent network performance. Remember that a DX is a private, physical connection and does NOT traverse the public Internet (like VPN does). Due to the cost, many businesses choose to use a Direct Connect connection with multiple AWS accounts and multiple VPCs for connectivity. It’s also important to note that traffic traversing a Direct Connect is NOT encrypted by default unless you are encrypting it at the application level before transit. You can configure an IPSEC VPN over the Direct Connect (using public VIFs – more on that later) to ensure traffic is encrypted in transit, if needed.

A Direct Connect is actually trunk from a port on a router using 802.1q. Using that port, you’ll connect to your router, signifying a vlan for the connection. The connection between your router and the AWS router requires single-mode fiber:

• 1GB = 1000Base-LX
• 10GB = 10GBASE-LR

If the Direct Connect is acquired through a third-party partner, that connection is likely shared among multiple customers and the partner will use VLANs to segregate traffic between customers. The partner owns the cross-connect (and associated charges for it) and because you don’t own the link, you don’t get to modify or control the VLANs traversing that link. This connection will be referred to as a hosted connection and each hosted connection is a single VLAN for a public or private virtual interface (VIF). If you need multiple VIFs or connections to multiple VPCs, you’ll likely need multiple hosted interfaces from your partner.

By default, Direct Connect = single router, single port, single region.

In the console, a Direct Connect is identified as follows: DXConn-xxxxxxxx

Direct Connect – Virtual Interfaces

Virtual Interfaces are used to connect to your account/VPC (using private VIF) or to connect to public AWS resources such as S3, SES, SQS, etc (using a public VIF).

For a private VIF, there is a BGP session established between customer router and DX router. You provide the BGP AS number or you can have it auto-generated and the VLAN number which links the physical layer of the customer route with this virtual interface. You can also enter the router peer addresses (/30) or have AWS auto-generate one for you.

For a public VIF:

• You should use a public AS number, preferably one that you own. You can use a private AS number but it removes capabilities over the connection (like AS path prepending).
• You need to use public IP addresses for the peer addresses. You can use your own or log a ticket to have AWS assign you a /30.
• Enter a VLAN

For a private VIF:

• You can use a private ASN which is 64512 through 65535.
• You can use your own private IP addresses or have it auto-generate a 169.x.x.x/30
• Enter a VLAN

If you’re creating the VIF in your own account  (same as where the DX connection lives), you’ll need to specify the VPG when it will terminate. If you’re creating the VIF for another account, regardless if it’s another account you own or somebody else’s, you’ll need the account number and you will NOT need to specify the VPG which to terminate. The account owner will need to accept the hosted connection in their account as that account will be responsible for the data charges over that VIF (but won’t be responsible for port-charges for the DX itself).

For a public VIF, you will advertise your public IP addresses to AWS and AWS will advertise the public IP addresses of its public services to your DX router. In the USA, you will get IP addresses of ALL public services from ALL of the US regions, which means that you can connect to any public service over a public VIF in any US region, regardless of which region your DX terminates. AWS uses BPG communities to identify the order of a prefix, specifically the NO EXPORT entry, which allows the BPG advertisement to internal neighbors but not external neighbors. Other BGP communities uses are:

• Internet – informs a BGP neighbor to advertise the prefix to all BGP neighbors
• No Advertise – not to advertise the route to any BGP neighbors

In addition to the text entries, AWS also makes use of numerical entries to identify where advertisements came from:

• 8100 – Prefix is local region
• 8200 – Prefix is Local continent
• 9100 – YOU advertise to local AWS region
• 9200 – YOU advertise to local; AWS continent

Community string means that the prefix came from the local region indicated by community value and that it originated on this continent indicated by 8200 – since a region is in the continent it makes sense that 8100 & 8200 would be used together.

Direct Connect Billing

DirectConnect itself has two charges associated with it, the hourly port charge and data transfer.

Hourly Port Charge

There is an hourly port charge for the physical connection between your router and the DX router. The amount of this charge depends on the speed and location of the Direct Connect and it is billing to the account where the Direct Connect interface is added (the physical connection, not the VIF).

Data Transfer

The second charge is for data transferring over the virtual interfaces. Remember that data IN to AWS is always free and data charges are for data from the VPC going OUT of AWS, measured in GB/month. It’s important to notate that the account where the virtual interface appears in the account is charged for the data traversing the interface and not necessarily the DX owner (although they may be the same account in some/most instances).

Data Charges – A Flow Chart

Here’s a good example of where and when you should expect charges within your AWS account, VPCs, and external connections