In today’s rapidly changing technology landscape, the conventional model of infrastructure management—receiving user requirements, designing solutions, deploying infrastructure, and manually monitoring for health and availability—lacks the agility and efficiency we need to operate our network infrastructure in a modern work environment.

DevOps represents a mindset and a set of practices that bridge the gap between conventional infrastructure management and a modernized, agile approach to ensuring our network environment continually meets the requirements of our business.

Here in Microsoft Digital, the company’s IT organization, our journey into the DevOps mindset began with a cultural shift. We’ve emphasized collaboration and worked toward removing barriers to cross-team sharing. We’ve encouraged our engineering teams to embrace continuous improvement and align their work to common organizational goals. This shift in mindset has accelerated our project timelines, enhanced reliability, and sparked innovation within our teams.

[Explore moving Microsoft’s global network to the cloud with Azure. Read our ongoing series on moving our network to the cloud.]

Driving efficiency and resiliency with DevOps practices

DevOps is at the forefront of our service delivery cycle. It affects every step and choice our engineering teams make, and DevOps practices have revolutionized our infrastructure management processes.

From the first step of the process—gathering user requirements—our teams collaborate closely with stakeholders to ensure a thorough understanding of user needs and expectations. Our design process is a collaborative, collective effort, with multidisciplinary teams contributing toward efficient, scalable, and secure solutions. With Azure networking components at the core, our DevOps practices span the entire solution lifecycle.

We automate deployment using infrastructure as code (IaC) with Azure Resource Manager (ARM) templates, Bicep, Azure Blueprints, and Terraform. IaC is the cornerstone of our modernization efforts. We’ve automated most of our network deployment and management tasks by using IaC in ARM templates and across a robust suite of management tools. Massive network deployments now take minutes instead of months. Reconfigurations can be dynamically and sequentially deployed, honoring dependencies and network data flow requirements.

This IAC approach enables our engineers to maintain infrastructure consistency, enforce best practices, and improve team collaboration. This approach not only accelerates service delivery but also ensures the reliability and stability of our network environment.

We implement continuous integration and deployment (CI/CD) pipelines for network configurations. Using Azure DevOps services, we’ve set up CI/CD pipelines for our network configurations. Whenever our network infrastructure code changes, it automatically triggers a pipeline that tests and deploys these changes across our environments. This ensures that our network infrastructure can evolve rapidly and safely in response to new requirements or challenges.

We monitor and run diagnostics with Azure Monitor and Network Watcher. We’ve transformed our monitoring and alerting mechanisms by integrating Azure Monitor and Network Watcher. This gives us real-time visibility into our network performance and health, enabling our systems to proactively identify and resolve issues before they impact our users, often without human intervention. Automated alerts and diagnostics tools within these services allow us to respond swiftly to anomalies.

We automate security and compliance processes. Security is paramount in all our deployments. We automate compliance checks and security monitoring by integrating Azure Policy and Azure Security Center into our DevOps practices. This ensures our network infrastructure remains compliant with our stringent security standards and streamlines the process of identifying and mitigating potential security risks.

We incorporate feedback Loops for continuous improvement. We can continuously refine and improve our network infrastructure by incorporating feedback mechanisms into our processes. Azure DevOps provides tools for tracking user feedback, bug reports, and performance metrics, which we analyze to continuously refine our DevOps practices, aligning them with emerging technologies and industry best practices. This adaptive approach ensures that we stay agile and responsive to the ever-evolving needs of our users.

Modernization through virtualization

As we move forward in our DevOps journey, we’re pushing into new ways of thinking about networking and modern infrastructure management. Azure-based connectivity has emerged as a critical enabler in this pursuit. For example, our implementation of Azure Virtual WAN exemplifies DevOps-driven networking. Our Azure Virtual WAN solution connects branch offices, data centers, and Azure resources seamlessly, and it’s filled with DevOps practices. The Azure Virtual WAN environment is provisioned using ARM templates, defining the entire topology, including hubs, spokes, and VPN connections. Azure Monitor tracks performance metrics, such as latency and bandwidth utilization. Alerts trigger automatic scaling or failover actions. When new branches are added, Azure Virtual WAN scales dynamically to provide the throughput and performance necessary based on pre-configured auto-scaling rules.

By using Azure Virtual WAN to virtualize our connectivity for Microsoft employees and buildings across the globe, we’re eliminating the constraints of physical infrastructure and unlocking new possibilities for scalability and efficiency.

Staying agile and looking forward

We know we’re working with a moving target as we continue our DevOps journey. The technological landscape constantly evolves, presenting new challenges and opportunities. Our engineers are committed to staying adaptive and flexible, ready to iterate and develop our practices as we progress.

Our DevOps journey has fundamentally transformed our approach to Azure cloud network engineering and infrastructure management. Our use of Azure Virtual WAN, ARM templates, CI/CD pipelines, Azure Monitor, and Network Watcher is a testament to our commitment as Customer Zero to use Microsoft technologies to meet the ever-evolving demands of our users and the industry. By embracing DevOps practices, we’ve improved collaboration and efficiency and paved the way for continuous innovation in the future.

Here are a few ways that you can start adopting a DevOps mindset, whether you’re a seasoned network engineer or a DevOps enthusiast:

• Embrace DevOps for agility: Accelerate projects and foster innovation by promoting collaboration and continuous improvement.
• Use IaC for efficiency: Use Azure Resource Manager templates and IaC tools to streamline and standardize network deployments.
• Automate monitoring and security: Use Azure Monitor and Security Center for real-time insights and automated compliance.
• Adopt virtualization and stay adaptive: Use Azure Virtual WAN for scalable connectivity and remain open to evolving technologies and practices.

Learn how to Integrate ARM templates with Azure Pipelines.

• Explore moving Microsoft’s global network to the cloud with Azure.
• Explore our series on moving our network to the cloud.
• Unpack our cloud-centric architecture transformation.

Want more information? Email us and include a link to this story and we’ll get back to you.

Please share your feedback with us—take our survey and let us know what kind of content is most useful to you.

The post Modernizing our cloud networking infrastructure with a DevOps mindset appeared first on Inside Track Blog.

In the modern workplace, Microsoft employees access their work from diverse locations. To ensure secure and efficient connectivity to cloud and on-premises resources for our global workforce, we’re adopting Azure Virtual WAN (VWAN) in conjunction with enterprise-scale security solutions.

Our enterprise-scale security solutions are vital in authenticating remote users across Azure and on-premises resources, enabling seamless service-to-service authentication. Our approach creates a more robust and reliable environment by removing interdependencies between network services and physical locations. Through strong authentication enforcement and role-based access control, our security solutions are tailored to support deployments at an enterprise scale.

We’re evolving remote access for our employees by migrating our remote and VPN access infrastructure to a modern, cloud-based solution using Azure VPN and Azure VWAN. Our new solution accommodates evolving security requirements and scales to support the changing demands of our remote workforce. This transition improves our security posture and enhances the overall efficiency of our remote access infrastructure, aligning seamlessly with our commitment to scalable and secure solutions for our global workforce.

Moving to the Azure-based solution allows us to support all remote access users with the Azure VPN client. This unified approach creates a simplified user experience and performs better for remote employees than our previous solution.

Our solution’s core is Azure Virtual WAN, a networking service that combines many networking, security, and routing functionalities to unify Azure and on-premises networking capability into a single operational interface.

Azure VWAN supports site-to-site, point-to-site, and private connections between Azure and on-premises users and resources using ExpressRoute, Azure VPN, Azure Firewall, and advanced routing configuration. The hub and spoke architecture of Azure VWAN provides enterprise scale and performance from cloud-hosted Azure VWAN hubs in Azure regions across the globe. Using the globally distributed Azure public cloud infrastructure, we can quickly deploy a global transit network architecture for our entire enterprise, supporting instant connectivity from the closest Azure VWAN Hub to any on-premises network endpoints.

Using the Azure VPN client and integrated VPN support built into Azure VWAN, our employees connect to the closest regional hub, securely and efficiently integrating them with Azure VWAN and our global corporate network. Currently, Azure VPN is selectively deployed for specific use case scenarios. It doesn’t serve as the default network access now, but its versatility allows for such a role, and we plan to use Azure VPN as the default remote access solution soon.

Using Azure VWAN and Azure VPN to manage our global network and remote access has resulted in many improvements to our wide area network architecture and the employee experience when using the network.

We’re using infrastructure as code (IaC) to deploy and scale our VPN capacity, enabling us to quickly accommodate and host over 100,000 users. Our ongoing efforts include onboarding all Microsoft employees to Azure VPN.

Protecting intellectual property is paramount for Microsoft. Our solution provides a highly secure environment through Azure VPN, using industry-standard encryption protocols and advanced security features. This ensures that all data transmitted between employees and resources in Azure or on-premises remains confidential and protected from unauthorized access.

Our architecture is designed to scale seamlessly as the user base grows. With the inherent scalability of Azure Virtual WAN, we can accommodate additional users and network resources without compromising performance. This flexibility ensures that Microsoft can support its expanding workforce without sacrificing connectivity or user experience.

Our network build process uses IaC principles to create a highly adaptable, robust, and reliable network environment. Our deployment templates and resource modules—created using the Bicep language—define the desired state of our VWAN infrastructure in a declarative manner. Following Microsoft best practices, we maintain a central Bicep template that invokes distinct modules—also defined in Bicep—to instantiate the necessary resources for deployment. This modular framework allows us to be flexible and accommodate new changes or requirements by applying various deployment patterns. For more information, visit Deploying a VWAN using infrastructure as code and CI/CD.

Our solution offers centralized management and monitoring capabilities, enabling our support ecosystem to manage our VPN infrastructure efficiently. Our security team can easily configure VPN settings and management using Azure Dashboard, allowing them to monitor usage patterns in a smart way. This centralized control ensures streamlined administration and effective troubleshooting.

We design the user experience to maximize productivity. Our solution optimizes network connectivity, relying on a global profile to minimize latency and allow employees to access hosted resources seamlessly from anywhere in the world. This eliminates barriers to productivity and empowers users to collaborate efficiently, irrespective of their geographic location.

Intellectual property protection often involves compliance requirements. Our solution adheres to industry best practices and relevant regulations to ensure that we meet necessary compliance standards. This includes data privacy, access controls, and auditability, providing peace of mind that intellectual property is handled in a secure and compliant manner.

We’re excited about the successful enterprise-scale deployment of our Azure Virtual WAN and Azure VPN-based solution. This deployment increases our ability to safeguard intellectual property while seamlessly supporting the connectivity needs of Microsoft employees. We remain committed to supporting the internal networking needs of Microsoft and ensuring secure and seamless connectivity as our organization grows.

Contact us today to explore how our solutions can help protect your intellectual property, enable remote access at scale, and provide a robust and secure network infrastructure tailored to your organization’s unique requirements.

• Migrate to a cloud-based VPN solution. Transition your VPN and remote access infrastructure to Azure VPN and Azure VWAN for a more scalable and secure remote access solution.
• Leverage Infrastructure as Code for network management. Adopt infrastructure as code (IaC) using the Bicep language to efficiently manage and scale your network infrastructure, allowing for flexible and rapid deployment.
• Plan for scalability and user growth. Ensure your network architecture is designed to scale seamlessly with Azure Virtual WAN, accommodating additional users and resources without sacrificing performance.
• Centralize management and monitoring. Use centralized management and monitoring tools, such as the Azure Dashboard, to efficiently administer VPN settings and manage network usage.

Get started with Azure VWAN with routing intent and routing policies at your company.

• Check out our full series on moving our network to the cloud. 
• Learn more about Azure Virtual WAN.
• Get more insight on how Azure VPN Gateways work.

Want more information? Email us and include a link to this story and we’ll get back to you.

Please share your feedback with us—take our survey and let us know what kind of content is most useful to you.

The post Deploying global remote VWAN connectivity with Azure VWAN and Azure VPN appeared first on Inside Track Blog.