Do not forget to add needed PowerShell Modules to your Azure Automation account

Posted on September 18, 2017 by workinghardinit

When you start automating Azure from the comfort of your desktop or laptop, things are slow going at first. You are constantly finding out things that do not work. Then you learn about the modules that you need to install, import. The dependencies that you need to take care of and the various ways of handling authentication to access the resources, you need.

Therefore, you put in the time, set up your PC/laptop (or multiple of those, you know how it goes as mobile, flexible IT professional) with the tools several editors from notepad++ over PowerShell ISE with or without plugins and Visual Code to full blown Visual Studio. You fight where you are with what you got, sometimes that is a lot, sometimes very little but it all takes time to set up.

Once you figured out how to automate with PowerShell against Azure, you learn not all code should live on premises and/or be run from there. There are solutions for that. You learn about run books, hybrid run books, workflows and Azure Automation accounts. For your comfort, you might integrate run books into your PowerShell ISE with Azure Automation ISE add-on.

Cool. You write your script, you test it, and decide you are golden and ready to use it. Happily, you deploy your run book only to find it does not work at all. You are beaten around the head with errors about missing functions like there is no tomorrow. Not because of authentication issues or so with ARM, you figured out already that an automation account with AzureRunAsConnections is how you get things done. Just plain missing function names like below.

Get-AzureRmLocalNetworkGateway : The term ‘Get-AzureRmLocalNetworkGateway’ is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again. At updatedynipvpn:27 char:27 + + CategoryInfo : ObjectNotFound: (Get-AzureRmLocalNetworkGateway:String) [], CommandNotFoundException + FullyQualifiedErrorId : CommandNotFoundException

Your automation account as a limited set of preconfigured modules available by default. However, you’ll often find you’ll need more. In our example case that is AzureRM.Network and AzureRM.profile on which AzureRM.Network has a dependency.

That is quite annoying when it happens but remember all the work you had to do to prep your scripting environment. Well there is a little extra work to do in Azure as well. You can add these modules or resources via “Shared Resources”, “Add a Module” under your automation account.

Once you have added them and they have been deployed you will find them under the CMDLETS tree branch of your run book, which gives you a handy list of what available to your automation account.

When you try to run your script now it should come alive. If it does not a little patience can do miracles. The portal test run-time environment is not always immediately up to speed with what has changed.

So remember, do not forget to prep the Azure automation environment just like your PC and remember to add the modules you need in order for your scripts to run. You might expect the entire library to be available out of the box but it is not.

Happy automating!

On premises access to Azure files services

Posted on March 1, 2016 by workinghardinit

Today we’ll have some fun with an Azure storage account and file services. We’ll show that you can actually get on premises access to Azure files services. You might not have tried this yet but you can expose this file share to your on premises physical or virtual machine as long as it’s an operating system supporting SMB 3.X. That means, Windows 8/8.1/10 and Windows 2012/2012R2 and 2016.

Realize that this is just a demo. Exposing an Azure File Services share to “and users” is not the primary use case for an Azure file service. It meant for applications in both public and hybrid cloud scenarios.

You set up an Azure file service (a file share) in a storage account. just like you do blobs, tables or queues.

What you need to access such a file share is the path to the share on your storage account on Azure and an access key

All you need to do is open up a command prompt and type

net use T: \\democloudwitness.file.core.windows.net\cloudsmb /u:democloudwitness Qzd4/fhHrt!45f*5652ddehse4qfjfqsfpKDMP45Hdg8etDlg2fyr8dtR^_pmL9QzedtrMhLcxo7Rsdew4U4E7A==

It’s a FAKE access key people, don’t bother. If you did not make a mistake it will report success and you have access to the Azure file share via letter T: from any interface that supports them.

But even if you did not, you can just enter the storage account and the access key to get access just like any other file share.

Voila, you have mapped that cloud share to your on premises machine. There’s no local users or AD based security settings so you can do whatever you want in regards to adding or deleting data. The storage account access key are literally the keys to the kingdom.

That’s right. It’s not limited to virtual machines or services in Azure nowadays. No need for a VPN or Express Route to Azure any more. Just an internet connection that allows you to connect remotely to port 445.

Pretty cool. Sure, end users are not the primary use case for this feature but it’s certainly nice to see what the capabilities are.

Security wise you might have some objections. In reality it’s just another way people don’t realize yet that data might be leaving the organization. No need to panic or to create a fuzz. Chances are most people have a dozen more popular and better known ways of getting data in and out in many environments. But if you have a dreamy eyed security officer whose mainly in place because they’re convenient, you can scare him/her a little with this. Let’s imagine you’re working at one of those <sarcasm> rare </sarcasm> companies where the firewall only seems to works in one way, for the ingress traffic. Egress is free fire zone as it avoids many support tickets and issues. That it opens the gates to others is another issue, but hey, the firewall is dead in the brave new world of BYOD and IoT anyway. What if you need some extra storage, temporarily, but you can’t get it on the file servers? Nor do they want to give you an external disk, a large thumb drive, or let you bring one in yourself. Maybe they’ve even spent money on disabling some of the USB ports or glued them up. Well get a trial account for Azure, set up the above. You’ll have a temp data dump that you can access from another location just as easily. I actually had more issues at home with my UTM firewall than in the few business settings where I tested this. Some ISPs do block this port outbound. So be ware when testing at home

Now forget about the security officer bashing and FUD. The real take away here is that you can expose a file share for an application easily both inside of Azure and on premises. That’s a powerful thing to do and it’s actually documented. It helps in new cloud service development, hybrid scenarios, migration or transition scenarios etc. All this highly available with the benefits SMB 3.x offers or over REST API. Now, imagine the possibilities! As said, for now there is no Active Directory authentication support, but who knows what the future brings? You can read more about getting started with Azure file services here.

Veeam FastSCP for Microsoft Azure IAAS went in to Beta

Posted on May 5, 2015 by workinghardinit

VEEAM is also keeping us on our toes here at Ignite in Chicago. They just publicly announced the beta of a new free tool that looks extremely handy, VEEAM FastSCP. It’s a tool that enables you to copy files in and out of Azure virtual machines without the need for a VPN. People who have been working with IAAS in Azure for labs or production known that sometimes even benign tasks on premises can be a bit convoluted in the cloud without a VPN or Express Route to Azure.

Until today our options without a VPN (to leverage file shares / SMB) are to use either RDP which gives us 2 options:

Direct copy/paste (limited to 2GB)
Mapped local drives in your VM

or leverage the portability of a VHD.

So why is VEEAM FastSCP a big deal? Well the virtual hard disk method is painstakingly tedious. Putting data into a VHD and moving that around to get data in and out of a virtual machine is a nice workaround but hardly a great solution. It works and can be automated with PowerShell but you only do it because you have no other choice.

The first RDP method (copy/paste) is fast and easy but it lacks ease of automation and it’s a bit silly to launch an RDP session to copy files. It also has a file size limit of 2GB. Anything bigger will just throw you an error.

Another option is to leverage your mapped local disks in the VM but that’s not a great option for automation either.

Sure you could start running FTPS or SFTP servers in all your VMs but that’s borderline silly as well.

VEEAM FastSCP for Microsoft Azure

VEEAM is offering this tools as a quick, secure and easy tool to copy files in and out of Azure virtual machines without the need for a VPN or turning your virtual machine into a free target to bad people in the world. Do note this is not meant for blob storage or anything else but an Azure virtual machine. Plenty of tools to go around for blob storage already.

The tool connects to the PowerShell endpoint port of your public IP address. No VPN, 3rd party tool or encryption required, it’s all self-contained. Inside the VM it’s based on winrm.

This will not interfere with your normal RDP or PowerShell sessions at all, so no worries there. When using this tool there is also no file size limit to worry about like with copy/paste over RDP.

Via the GUI you connect to the Virtual Machine with your credentials. After that you can browse the file system of that VM and copy data in and out. All of this is secured over SSL.

A nice thing is that you don’t need to keep the GUI open after you’ve started the copy just close it and things will get done. No babysitting required.

It’s all wizard driven so it’s very easy and to top it all off you can schedule jobs making it a perfect little automation tool bypassing the limitations we’re facing right now.

Some use cases

Any one who has an IAAS lab in Azure will appreciate this tool I think. It’s quick and easy to get files in and out of your VMs and you can schedule this.

Backups. I create a backup of my WordPress blog and the MySQL database regularly to file. While these are protected in the cloud themselves I love backup in depth and have extra option incase plan A fails. Using the build in scheduler I can now easily download a copy of those files just in case Azure goes south longer than I care to suffer. Having an off-cloud copy is just another option to have when Murphy comes knocking.

This is another valuable tool in my toolkit courtesy of VEEAM and all I can say is: thank you! To get it you can register here and download the Beta bits.

Essential to my Modern Datacenter Lab: Azure Site 2 Site VPN with a DELL SonicWALL Firewall

Posted on March 30, 2015 by workinghardinit

If you’re a serious operator in the part of IT that is considered the tip of the spear, i.e. you’re the one getting things done, you need a lab. I have had one (well I upgraded it a couple of times) for a long time. When you’re dealing with cloud as an IT Pro, mostly Microsoft Azure in my case, that need has not changed. It enables you gain the knowledge and insights that you can only acquire by experimenting and hands on work, there is no substitute. Sometimes people ask me how I learn. A lab and lots of hands on experimenting is a major component of my self education and training. I put in a lot of time and some money, yes.

Perhaps you have a lab at work, perhaps not, but you do need one. A lab is a highly valuable investment in education for both your employers and yourself. It takes a lot of time, effort and it cost a bit of money. The benefits however are huge and I encourage any employer who has IT staff to sponsor this at the ROI is huge for a relative small TCO.

I love the fact that in a lab you have (and want) complete control over the entire stack so you experiment at will and learn about the solutions you build end to end. You do need to deal with it all but that’s all good, you learn even more, even when at times it’s tough going. Note that a home lab, even with the associated costs, has the added benefit of still being available to you even if you move between employers or between clients.

You can set up a site to site VPN using Windows Server 2012 R2 RRAS (see Site-to-Site VPN in Azure Virtual Network using Windows Server 2012 Routing and Remote Access Service (RRAS) that works. But for for long term lab work and real life implementations you’ll be using other devices. In the SOHO lab I run everything virtualized & I need internet access for other uses cases than the on premises lab. I also like to minimize the hosts/VMs/appliances I need to have running to save on electricity costs. For enterprise grade solutions you leverage solutions form CISCO, JUNIPER, CheckPoint etc. There is no need for “enterprise grade” solutions in a SOHO or small branch office environment.Those are out of budget & overkill, so I needed something else. There are some options out there but I’m using a DELL SonicWALL NSA 220. This is a quality product for one and I could get my hands on one in a very budget friendly manner. UTMs & the like are not exactly cheap, even without all the subscription, but they don’t exactly cater to the home user normally. You can go higher or lower but I would not go below a TZ-205 (Wireless) which is great value for money and more than up for the task of providing you with the capabilities you need in a home lab.

I consider this minimum level as I want 1Gbps (no I do not buy 100Mbps equipment in 2015) and I want wireless to make sure I don’t need to have too many hardware devices in the lab. As said, the benefit over the RRAS solution are that it serves other purposes (UTM) and it can remain running cheaply so you can connect to the lab remotely to fire up your hosts and VMs which you normally power down to safe power.

Microsoft only dynamic routing with a limited number of vendors/devices but that doesn’t mean all others are off limits. You can use them but you’ll have to research the configurations that work instead of downloading the configuration manual or templates from the Microsoft web site, which is still very useful to look at an example configuration, even if it’s another product than you use.

Getting it to work is a multistep proccess:

Set up your Azure virtual network.
Configure your S2S VPN on the SonicWall
Test connectivity between a on premises VM and one in the cloud
Build out your hybrid or public cloud

Here’s a reference to get you started Tutorial: Create a Cross-Premises Virtual Network for Site-to-Site Connectivity I will be sharing my setup for the SonicWall in a later blog post so you can use it as a reference. For now, here’s a schematic overview of my home lab setup to Azure (the IP addresses are fakes). At home I use VDSL and it’s a dynamic IP address so every now and then I need to deal with it changing. I’d love to have a couple of static IP address to play with but that’s not within my budget. I wrote a little Azure scheduled run book that takes care of updating the dynamic IP address in my Azure site-to-site VPN setup. It’s also published on the TechNet Gallery

You can build this with WIndows RRAS, any UTM, Firewall etc … device that is a bit more capable than a consumer grade (wireless) router. The nice things is that I’ve had multiple subnets on premises and the 10 tunnels in a standard Azure site-to-site VPN accommodate that nicely. The subnets I don’t want to see in a tunnel to azure I just leave out of the configuration.

Tip to save money in your Azure lab for newbies, shut down everything you can when your done. Automate it with PowerShell. I just make sure my hybrid infra is online & the VPN active enough to make sure we don’t run into out of sync issues with AD etc.

Working Hard In IT

My view on IT from the trenches

Tag Archives: Azure

Do not forget to add needed PowerShell Modules to your Azure Automation account

Veeam FastSCP for Microsoft Azure IAAS went in to Beta

VEEAM FastSCP for Microsoft Azure

Some use cases

Essential to my Modern Datacenter Lab: Azure Site 2 Site VPN with a DELL SonicWALL Firewall