diff --git a/docs/reference-architectures/hybrid-networking/images/shared-services.svg b/docs/reference-architectures/hybrid-networking/images/shared-services.svg new file mode 100644 index 00000000000..8578a99c1b3 --- /dev/null +++ b/docs/reference-architectures/hybrid-networking/images/shared-services.svg @@ -0,0 +1,489 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + Sheet.1071 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Sheet.1071 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Sheet.1071 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + g5181 + + path3 + + + + path5 + + + + path7 + + + + path9 + + + + circle11 + + + + + + + + + Sheet.975 + + Sheet.976 + + + + Sheet.977 + + + + Sheet.978 + + + + + + + + + + Sheet.975 + + Sheet.976 + + + + Sheet.977 + + + + Sheet.978 + + + + + + + + + + Sheet.975 + + Sheet.976 + + + + Sheet.977 + + + + Sheet.978 + + + + + + + + + + + g5181 + + path3 + + + + path5 + + + + path7 + + + + path9 + + + + circle11 + + + + + + + + + Sheet.975 + + Sheet.976 + + + + Sheet.977 + + + + Sheet.978 + + + + + + + + + + Sheet.975 + + Sheet.976 + + + + Sheet.977 + + + + Sheet.978 + + + + + + + + + + Sheet.975 + + Sheet.976 + + + + Sheet.977 + + + + Sheet.978 + + + + + + + + + + g5181 + + path3 + + + + path5 + + + + path7 + + + + path9 + + + + circle11 + + + + + + + + + + Sheet.975 + + Sheet.976 + + + + Sheet.977 + + + + Sheet.978 + + + + + + + + + + + Sheet.28 + + + + Sheet.28 + + + + + + + + + Sheet.975 + + Sheet.976 + + + + Sheet.977 + + + + Sheet.978 + + + + + + + diff --git a/docs/reference-architectures/hybrid-networking/index.json b/docs/reference-architectures/hybrid-networking/index.json index d6226bf1010..0764d4746bb 100644 --- a/docs/reference-architectures/hybrid-networking/index.json +++ b/docs/reference-architectures/hybrid-networking/index.json @@ -26,6 +26,12 @@ "url": "./hub-spoke.md", "image": "./images/hub-spoke.svg", "summary": "The hub is a central point of connectivity to your on-premises network. The spokes are VNets that peer with the hub, and can be used to isolate workloads." + }, + { + "title": "Hub-spoke topology with shared services", + "url": "./shared-services.md", + "image": "./images/shared-services.svg", + "summary": "Deploy a hub-spoke topology that includes shared services, including Active Directory services and a network virtual appliance (NVA). Shared services can be consumed by all spokes." } ] } diff --git a/docs/reference-architectures/hybrid-networking/index.md b/docs/reference-architectures/hybrid-networking/index.md index 85c0393bd82..189d9ec3dc2 100644 --- a/docs/reference-architectures/hybrid-networking/index.md +++ b/docs/reference-architectures/hybrid-networking/index.md @@ -9,7 +9,7 @@ layout: LandingPage # Connect an on-premises network to Azure -These reference architectures show proven practices for creating a robust network connection between an on-premises network and Azure.
[Which should I choose?](./considerations.md) +These reference architectures show proven practices for creating a robust network connection between an on-premises network and Azure. [Which should I choose?](./considerations.md)
diff --git a/docs/reference-architectures/hybrid-networking/shared-services.md b/docs/reference-architectures/hybrid-networking/shared-services.md index 0b55ddb19f1..5a7a54b082e 100644 --- a/docs/reference-architectures/hybrid-networking/shared-services.md +++ b/docs/reference-architectures/hybrid-networking/shared-services.md @@ -10,7 +10,7 @@ pnp.series.prev: hub-spoke --- # Implement a hub-spoke network topology with shared services in Azure -This reference architecture builds on top of the [hub-spoke][guidance-hub-spoke] reference architecture to include shared servcices in the hub that can be consumed by all spokes. As a first step into migrating a datacenter to the cloud, and building a [virtual datacenter], the first services you need to share are identity, and security. This reference archiecture shows you how to extend your Active Directory services from your on-premises datacenter to Azure, and how to add a network virtual appliance (NVA) that can act as a firewall, in a hub-spoke topology. [**Deploy this solution**](#deploy-the-solution). +This reference architecture builds on the [hub-spoke][guidance-hub-spoke] reference architecture to include shared services in the hub that can be consumed by all spokes. As a first step toward migrating a datacenter to the cloud, and building a [virtual datacenter], the first services you need to share are identity and security. This reference archiecture shows you how to extend your Active Directory services from your on-premises datacenter to Azure, and how to add a network virtual appliance (NVA) that can act as a firewall, in a hub-spoke topology. [**Deploy this solution**](#deploy-the-solution). ![[0]][0] @@ -66,13 +66,13 @@ ALso, the following recommendations apply for most scenarios under shared servic Most enterprise organizations have an Active Directory Directory Services (ADDS) environment in their on-premises datacenter. To facilitate management of assets moved to Azure from your on-premises network that depend on ADDS, it is recommended to host ADDS domain controllers in Azure. -If you make use of Group Policy Objects, that you want to control separately for Azure, and your on-premises environment, use a different AD site for each Azure region. And place your domain controllers in a central VNet (hub) that dependent workloads can access. +If you make use of Group Policy Objects, that you want to control separately for Azure and your on-premises environment, use a different AD site for each Azure region. Place your domain controllers in a central VNet (hub) that dependent workloads can access. ### Security -As you move workloads from your on-premises environment to Azure, some of these workloads will require to be hosted in VMs. And due to compliance you may need to enforce restrictions on traffic traversing those workloads. +As you move workloads from your on-premises environment to Azure, some of these workloads will require to be hosted in VMs. For compliance reasons, you may need to enforce restrictions on traffic traversing those workloads. -You can use network virtula appliances (NVAs) in Azure to host different types of security and performance services. If you are familiar with a given set of appliances on-premises today, it is recommended to use the same virtualized appliances in Azure, where applicable. +You can use network virtual appliances (NVAs) in Azure to host different types of security and performance services. If you are familiar with a given set of appliances on-premises today, it is recommended to use the same virtualized appliances in Azure, where applicable. > [!NOTE] > The deployment scripts for this reference architecture use an Ubuntu VM with IP forwarding enbaled to mimic a network virtual appliance. @@ -99,7 +99,7 @@ Before you can deploy the reference architecture to your own subscription, you m 2. Make sure you have the Azure CLI 2.0 installed on your computer. For CLI installation instructions, see [Install Azure CLI 2.0][azure-cli-2]. -3. Install the [Azure buulding blocks][azbb] npm package. +3. Install the [Azure building blocks][azbb] npm package. 4. From a command prompt, bash prompt, or PowerShell prompt, login to your Azure account by using the command below, and follow the prompts. @@ -261,6 +261,7 @@ To create a peering connection from the hub VNet to the spoke VNets, perform the [hybrid-ha]: ./expressroute-vpn-failover.md [naming conventions]: /azure/guidance/guidance-naming-conventions [resource-manager-overview]: /azure/azure-resource-manager/resource-group-overview +[virtual datacenter]: https://aka.ms/vdc [vnet-peering]: /azure/virtual-network/virtual-network-peering-overview [vnet-peering-limit]: /azure/azure-subscription-service-limits#networking-limits [vpn-appliance]: /azure/vpn-gateway/vpn-gateway-about-vpn-devices diff --git a/docs/reference-architectures/toc.yml b/docs/reference-architectures/toc.yml index 79ecac613c6..57b20d8bbb0 100644 --- a/docs/reference-architectures/toc.yml +++ b/docs/reference-architectures/toc.yml @@ -27,6 +27,8 @@ href: hybrid-networking/expressroute-vpn-failover.md - name: Hub-spoke topology href: hybrid-networking/hub-spoke.md + - name: Hub-spoke topology with shared services + href: hybrid-networking/shared-services.md - name: Identity management href: identity/index.md