Pass Your Microsoft AZ-700 Exam Easy!

Microsoft AZ-700 Designing and Implementing Microsoft Azure Networking Solutions exam dumps vce, practice test questions, study guide & video training course to study and pass quickly and easily. Microsoft AZ-700 Designing and Implementing Microsoft Azure Networking Solutions exam dumps & practice test questions and answers. You need avanset vce exam simulator in order to study the Microsoft AZ-700 certification exam dumps & Microsoft AZ-700 practice test questions in vce format.

Point-to-Site VPN

1. Introduction to Point-to-Site VPNs

Now we'll return to talk about inter-Azure communications in a future lecture. But for now, we're talking about hybrid networking, which involves connecting Azure to locations that are outside of Azure. And we're going to continue on with the VPN concept. In this section of the course, we're going to talk about point-to-site VPNs. When we built our VirtualNetwork gateway, we discovered that it supported both site-to-site and point-to-site VPNs. And the higher the skew, the more possible connections we could have; the higher the bandwidth, the more connections we could have for point-of-site connections. Now, the concept of point-to-site VPN is that you have individuals with their workstations and their desktop computers that are able to connect into the Azure network and use those resources as if they were local, basically extending the Azure Virtual Network to those individual devices. So we meant the Virtual Network Gateway. I already have it set up from the previous section. We already have this as part of a virtual network, and the network subnet is specifically for a gateway. So I'm going to switch up to the point of site configuration. Currently, Point to Site is not configured, andso we're going to have to do that. Now, one of the things we're going to find when we start to create point-to-site access is that we're going to need certificates. So each client that connects to your network is going to have to have a client certificate installed on their computer. You can't just log into a point-to-site VPN using a password. You need an actual certificate. So what we're going to have to do to start is create or, if you already have them, get certificates. So Microsoft provides instructions on how to create this root certificate and the client certificates. And so in this video, we're going to follow these instructions. I will attach this link to this video as an external resource so that you can follow along on your own computer. Now this is the instruction for Windows 10 or Windows Server 2016. If you have Linux or some other operating system, then you should go follow the other instructions. We're just going to do 2016 at this point. So there are two components here. There is the root certificate, and there is the client certificate. Now we're creating what's called a self-signed certificate because there's no certification authority that recognises us as having the privilege to create certificates that other people can trust. So any certificates we're creating using this technique are not going to be trustable by anyone else. By default, it's going to warn us—we're going to have to accept it. Now we're creating it for ourselves, so we can trust it. But this isn't something you're going to want to use in production. You're going to purchase a certificate from a certificate authority, but we don't need to do that. Now, we're going to start with PowerShell with elevated privileges. So we do need to use the administrator capacity, and it does not work in Cloud Shell. So I'm going to go into PowerShell and I'm going to say "run as administrator." Now, the script is asking us to sign in to Azure to start. So I'm going to go in here and connect to my AC account. Now it's going to pop up a window, and I can sign into the account I'm already signed in at, and it says I can close it, so I will. and we have signed in. Now, the next step is to create the root certificate. The root certificate, it has aname, P two S, roots Cert. And it's going to install it in this location by default, which I'll show you in a second. And so if you want to change the name, you're going to have to change that part. But we'll leave it the way it is. So I copied this, went back to PowerShell, and pasted in the code. So that's going to create a root certificate, and it's going to store it in my certificate store for Windows. So the instruction says to leave the PowerShell console open because we want to create the client certificate. We already have the certificate stored in this variable "dollar sign cert." So we're going to use this PowerShell session that's already open. Now you'll see that the client certificate has a name: P 2 S, child cert. We could obviously change that if we wanted to, but I won't. So we'll go back here and create one child certificate and hit Enter. And so we can see that it is installed in our certificate store as well. Who should realise that there's a programme on Windows called Certificate Manager (Certmgr)? And there are a few options for that. So if I go under the Windows menu here and say "Manage computer certificates," then I'm presented with the whole computer scope. And my certificate is not in the computer scope. The certificate is in the current user scope. We've been installing it under the current user. so you have to use the certificate manager from PowerShell. And then we get here, and now we see thatI've created a couple, I was doing some testing, createda couple of root certificates, couple of child certificates here. So we're going to have to make sure wegot the right one when we're exporting, obviously. So I deleted the certificate that wasolder, kept the more recent ones. And so we have the root certificate and the child certificate in our Windows certificate store here. So to start, we're going to need to export the CER file from our root certificate. So we can go to the root certificate, and we can say, "Right-click Altas Export." And so this is called the certificate export wizard. Now, in this case, we do not want to export the private key. We're exporting the public key only. We're going to want this in a CER file that's base 64 encoded. We do need to store this on our local machine. And I gave that a name. And when I say next, this is the summary, and I can say finish. And the export appeared to be successful. So here's the certificate that I just created. I'm going to copy the information in blue here. So I'm not including the comments at the beginning. And we're going to see the root certificate and paste it into the certificate's public data. Now back to the certificate manager. We also need these child certificates. So we're going to need to export this. All tasks export. And in this case, we do want the private key. Because when you're dealing with the child certificate, we do need to encrypt things in the private key. And the private key is going to be used in this private key exchange style. And we can include allcertificates, enable the certification, privacy. Now if you want to give this a password, you certainly can. It's optional. It says you must use a password. Okay, say next again. We'll have to say this to our local next and then finish. And that says exports were successful. All right. So similar to creating the local gateway, we do have to give this an address pool. And we can give this a pool that we know is not going to overlap with our existing VPN. So this is basically a unique set of addresses. It's going to be dynamically assigned to clients that connect to this point-to-site VPN. You might know this, but any client that is connected to a VPN is going to be assigned an address that that network recognizes. And, in order to be a part of that network, it does not retain its current IP address. So here's a non-conflicting address. Certainly, if you're going to have a site-to-site VPN and a point-to-site VPN, you'll have to give special attention to this. So, we need to wait a couple of minutes for this to save. And once this is all set up, then we should be able to get out of here, come back, and then download the VPN client that will allow us to connect to this point-to-site VPN. Once that is downloaded, we can see that there is a VPN client embedded in the zip file. So we can then go ahead, run that, and that will basically allow us to connect to our VPN, to our private network in Azure.

2. Tunnels and Authentication Types

Other features of the network gateway that we haven't discussed yet include IKEv2 type connections and Open VPN authentication. But we're currently running on a general, basic skew, and we can see here that those features are not supported. Now, there is a way to do an in-place upgrade from basic to standard or high performance. But standard and high performance are not even on this chart. Scroll down here and you can see that the basic skew is a legacy skew. It has feature limitations. In order to move from Basic to a VPN GW SKU, you must delete the Basic ski gateway and create a new gateway. So there appears to be some stock between the generation one basis queue and some of these more modern generation two connections. Now, even switching back to the Virtual Network Gateway and onto the configuration tab, we can see that we are given this choice. So I'm going to upgrade to the standard skew here. So that did take some time to go into effect. When we go to the Point to SiteConfiguration tab now, we see a slightly different view. Now we can choose the tunnel type. So the tunnel type is going to be how your VPN client connects to the VPN network gateway in Azure. So if you're using Android or iOS, it's going to have one tunnel type. Windows will have a default. I think the Windows default is IKEV 2. If you want some extra centrication—sort of two layers on top of each other—of security, you could choose both. Now, there is also OpenVPN, which is obviously an open standard for authentication, and that's another option. The other way is how you authenticate. And so we have created a certificate, and we're using certificate authentication. But if you use the Standard, Abovepool, or one of those other SKUs, you can choose Radius Authentication or Azure Active Directory. Now, Radius authentication requires an extra piece of hardware called a Radius server. This is what's going to allow you to use your Active Directory domain service authentication over the VPN. So basically, a single sign-on means not having to even sign in again; you can just connect and the authentication credentials will be passed. And the third type of authentication is Azure Active Directory. So this is on the premises of Active Directory and Azure? Active directory is related to active directory. Obviously installed in Azure And this uses an open VPN. And you're basically granting your open VPN access to your Azure Active Directory tenant. Then, those with valid Azure Active Tenant accounts can use that to connect to your point-to-site VPN. So you do have multiple options for security—not just installing certificates but also the on-premises ad and Azure ad, which is pretty cool.

ExpressRoute

1. Introduction to ExpressRoute

So the last subject we'll discuss here in terms of hybrid networking is Express Route. Express Route, on the other hand, is a pretty cool solution that allows you to connect your corporate on-premises network to a Microsoft Azure region via a private connection. And so in the case of the default ExpressRoute, you're going to connect with some type of Internet Exchange Partner, and they're going to have a private connection between your office and their network. And so that's going to be a high-speed connection, a fiber-optic connection. And that partner already has ExpressRoad circuits going from their location to the Microsoft Edge locations. Now Microsoft Edge locations are different than Microsoft regions. There are way more of them. So there are over 100 edge locations. That means that you do not need to—let's say you're in Canada and your office is in Ottawa. So you do not need to then create a high-speed fibre optic network from your office into Toronto, which may be the location of Microsoft's region in Canada. But you might have a partner who already has a connection to a Microsoft Edge location and is also an Autobah, right? So the edge locations might be a lot closer to you than the regional data centers. Now, as we can see here, there are two types of Microsoft networks. We haven't really talked about them. Microsoft has peering for their public services. So all of their Office, Skype, Azure Portal, and things like that that are publicly available can go over one connection. And then there's another connection in blue here that goes into your networks—your VNet and private connections that you're hooking up to. So those are different connectivity models. It's also redundant. So if one of them fails, there's a secondary connection that comes with it by default. By default, there are two connections and not just one. So that's the fundamentals of Express Route. Now, Express Route basically gives you access to a region by default. Okay? So to sign up, you're going to get relatively high-speed access. There are various levels of speed available. If we switch over to the pricing table, we can see that pricing is broken out between the gateways themselves, which we were just looking at, a VNet gateway for site-to-site VPN, and an Express Route gateway, and you're also paying for the connectivity. And the connectivity is going to be charged based on the bandwidth. So you can get as low as 50 megabits per second, but here we see as high as ten gigabits per second connectivity into Azure, and you're going to pay for that. So it's a lot quicker connection than you can get over the public Internet, but you're obviously paying for that. And inbound data transfer is free, and then you're also paying for data transfer outbound. And there are prices per gigabyte, which could get quite expensive for data leaving Azure. There is an unlimited data plan, and you're going to pay extra for that. Now there is a feature called Express Route Premium that goes from being regional-level express routes to ones that connect to all regions of the world. So that's even a different level of service. As we can see in the pricing table, there are standard prices and premium prices. In comparison, premium gives you access to all regions of the world, whereas this is limited to one geopolitical zone. Now, Expresso has even more options, right? There is the concept of a local SKU, which allows you to connect extremely locally to you rather than even to the region level. And there's a concept called "Global Reach," which allows your offices to basically have a wide area network. It allows multiple express route connections to be connected together. And so your own private data centres can be connected through two express-route circuits. It basically allows you to enable a win. The final concept that we'll talk about is the concept of Express Route Direct. So we started off at the beginning talking about the need to have a partner, the Internet Exchange Provider in this case. Well, Express Road Direct allows you to bypass having a provider and then tie your network directly into a Microsoft Edge location through a fibre optic connection. Of course, that's going to be even more expensive, but you're going to be able to basically get maximum bandwidth. You're not going through that. It is connectivity at scale. Now this is really good if you've got a lot of data that needs to get ingested into Azure. So if you are talking about terabytes, petabytes, and exabytes of data that needs to be ingested, then perhaps this is a good solution for you. And maybe you do have industries like banking or government that have money and need to protect their data to another degree. So removing that middleman is one of those things, and basically, you can get total control over the express route circuit. That's an overview of the express route options that are going to be covered by the signal.

2. DEMO: Create an ExpressRoute Gateway

So let's just briefly talk about how to create an Express Route gateway. So we have our virtual network and our subnet. We are going to maintain the existing subnet. I've deleted the Virtual Network Gateway that we used to have on this. And so what we're going to do is create a network gateway, but this time instead of choosing a virtual network gateway, we're going to choose an express route gateway. So we give it a name, and of course we want to put that into the region. Now, the region is very important because Express Heart is a physical network. Basically, you're connecting from your office to Azure, again through an exchange provider or directly. and so the region that you connect to is going to be extremely important. It has to be something close to your office. You don't have the same flexibility when it comes to creating ExpressRoad circuits around the world if you don't have physical networks around the world to connect them to. So we chose the express route circuit.Now, we do have, again, several types of SKUs for this Express Route circuit. Now, if we look at the documentation for this, we can see that we have those three gateway SKUs, standard, high performance, and ultra. The standard skew does not support a site-to-site VPN or point-to-site VPN gateway or Express Route and has a maximum of four circuits. When you upgrade to a high-performance SKU, you can have a VPN gateway and Express Route on the same gateway and have up to eight circuits. And Ultra also supports both 8 and 16 circuits. We can also see that there are two SKUs per feature. So the standard SKU and the ERGW are both one AZ, and the AZfeature is the availability zone supported edition. So, if we scroll down here, to the pricing page, we can see that the same ones, twos, and threes skew numbers as standard high performance and ultra performance, but with Availability Zone support. Okay? The pricing is, of course, radically different as well. You have the standard gigabit per second bandwidth, high performance at 150%, higher at doubling the bandwidth, and Ultra at three and a half times the price, but you get five times the bandwidth as high performance, and then the Availability Zone addition appears to be roughly double the price. So we can see that there are performance considerations. We talked about there being one gigabit per second for the gateway, so the circuit is going to be capped at one gigabit. So you can have multiple circuits, each with 1GB. And we can see that there are a number of routes advertised, and the number of routes learned has different numbers as well. We can see the performance as being one gigabit, two gigabits, or ten gigabits, even though the current bandwidth of the circuit is only one. All right, so that's our consideration here between standard and high performance. I'm just going to start with the standard again. That's nineteen cents per hour. We'll add this to our Oh, I have to put this in; I think it was in the west. In order to put this into the same virtual network that we created, we have to be in the same region as the virtual network. That obviously makes sense. It adds itself to the Gateway subnet that already exists. You have to create a public IP address for your express route to be able to connect to this, even though it's not over the public internet. So we give this a name, and that's pretty much it. We can say "review and create," and we would get an express route gateway. Now, we haven't yet created the circuits, so this is just the device that handles the communications. When we start to establish the communications, we're going to have to create circuits. And as we saw, you could have four, eight, or 16 circuits on these gateways, depending on your skew.

Go to testing centre with ease on our mind when you use Microsoft AZ-700 vce exam dumps, practice test questions and answers. Microsoft AZ-700 Designing and Implementing Microsoft Azure Networking Solutions certification practice test questions and answers, study guide, exam dumps and video training course in vce format to help you study with ease. Prepare with confidence and study using Microsoft AZ-700 exam dumps & practice test questions and answers vce from ExamCollection.