Archive for the ‘Windows Server 2012 R2’ Category

How to setup Azure VPN for Site-to-Site Cross-Premises or Create a Virtual Network for Point-to-Site #VPN #Azure #winserv

There are a lot of real good Blog post on how to create Azure Site to Site. And as the Vnext Windows Server is more and more connecting to the Cloud. I’ll show you how to create a S2S & P2P VPN setup. And The VPN option will get you to a real hybrid Network and This could be awesome. keep reading my blog posts. The Next blog post will be more about Hybrid Configurations.

image

So what do we need for a hybrid Environment Well I’ll setup a poor men’s version, that means One Hyper-v server home Router and an Azure Subscription.

First We setup a windows Server No special needs for this 4GB memory and 1 Disk but with two network cards. ( this is a VM )

So one NIC is on my corp network and the other NIC is connected to the friendly Internet.

When you have the server installed you only need to install RRAS Role Service and no direct configuration needed.

So by GUI or with Powershell   add-WindowsFeature DirectAccess-VPN,Routing

image

That is all what needed and you will need to create two NAT rules on your router ( however NAT is not supported )

image

But this all depends on you network configuration. 

The next step is Azure .

As I do net have a Network in azure I create a network that I will use for my VM’s that I will build after the network configuration, But I you already have a network in azure you can use that network.

 

image

But what Do I need Well It does not mater the Quick is configurable after creating the network. And the Custom is more Wizard driven.

For the screenshots I’ll pick Custom.

image The First step is pick a network name, No Change can me made afterwards ( well not easily )

 

image

Next step is Setting Checkboxes and DNS. I use an on premise DNS server but If you run a DNS in Azure You can use this server.

image

If you have already a network then you can pick the DNS servers from the list and pick also a local network.

I this case everything is New So give the DNS server a name and IP this is my local DNS server and I use a Internet DNS server. Just because this is an Easy IP address.

And I selected the Configure a point-to-site VPN and Configure a site-to-site VPN and on the Local Network I choose a new local network.

 

image

Now that the Diagram is filled we do some configuration, As my local network is a 10 network and I like to not have this in the same range in this Scenario.

image

So I pick a 172.16.32.0/24 For my point-to-site VPN.

The next step is more Complicated, We need to pick a Local-Network name and We need to find the External IP on you network.

 

image

To find My external IP I use Bing just ask “ what is my IP “

image

Easy

The Next step is create a Address space for this network.

image

 

image

You have to check the Add Gateway Subnet this is uses for the Site-to-Site VPN

see Virtual Network Address Spaces page in About Configuring a Virtual Network using the Management Portal.

 

image image

Check the Box and you can see it is creating the network configuration but not the Gateway this is done in the next step.

 

image

After the Network Creation is Done We add the Gateway Configuration / Creation

image

image

This will take about 30 minutes to create ( and Will cost you about 12 euro a month )

While this is creating we will configure the P2P VPN.

image

One way to create an X.509 certificate is by using the Certificate Creation Tool (makecert.exe). To use makecert, download and install Microsoft Visual Studio Express 2013 for Windows Desktop, which is free of charge.

In this case I’ll use make cert.

Generate a self-signed root certificate the name can be your name or what you like.

makecert -sky exchange -r -n "CN=BlogRootCert" -pe -a sha1 -len 2048 -ss My "BlogRootCert.cer"

Generate a client certificate

makecert.exe -n "CN=BlogClientCert1" -pe -sky exchange -m 96 -ss My -in "BlogRootCert" -is my -a sha1

image

All certificates are stored in your Personal certificate store on your computer. Check certmgr to verify. You can generate as many client certificates as needed based on this procedure. Recommend is that you create unique client certificates for each computer that you want to connect to the virtual network.

A client certificate must be installed on each computer that you want to connect to the virtual network. This means you will probably create multiple client certificates and then need to export them. To export the client certificates, use certmgr.msc. Right click on the client certificate that you want to export, click all tasks, and then click export.

image

Export the client certificate with the private key. This will be a .pfx file. Make sure to record or remember the password (key) that you set for this certificate.

image

Copy the .pfx file to the client computer. On the client computer, double-click the .pfx file in order to install it. Enter the password when requested. Do not modify the installation location.

But the ROOTCERT is needed in Azure and we need to import this. When the Gateway is ready you can see in the Clients that it needs a certificate

image

imageimage

Uploading the Certificate is the Certificate that we just Created

makecert -sky exchange -r -n "CN=BlogRootCert" -pe -a sha1 -len 2048 -ss My "BlogRootCert.cer"

 

image

Now that all the Azure Configuration is Done We configure the RRAS server as you can see in the overview the Gateway and P2P VPN is not Connected.

 

image

On the right there is a little list with some Download links

image

First we download the RRAS Configurations Script   Download VPN Device Script

Just make sure You select the Windows Server 2012 R2 as we are using this for the gateway.

imageimage

When running this script in the RRAS server there is a Common Error the RRAS service is restarted so therefor it can not connect just run the connect line again and it will work.

However this is a CFG script you can rename this to PS1 Or Run this in Powershell ISE like I did.

image

image

# Dial-in to Azure gateway
Connect-VpnS2SInterface -Name 191.233.89.184

image

image

The Site To –Site VPN is now connected

For the Client You will use the Download the 64-bit Client VPN Package

 

image

Keep in mind Windows Does not trust an Downloaded EXE file so before you can install this it needs to unblock 

image

imageimage

Now that the File is unblocked we can install the VPN this is a real quick install and no screens to view but in the network You can see a new network, in this case BlogHybrid.

For connecting just click the network and connect.

 

image  image

Now I’m Connected.

image

As you can see I’m connected With point-to-site VPN and a site-to-site VPN.

image

With a site-to-site VPN I can use Windows Azure Servers connecting To my local Domain.

With point-to-site VPN I can Connect With a Windows Azure VM on the Internal IP without using the VNname.cloudapp.net IP.

And you can also connect Azure to Azure VPN between Subscriptions

This Will be the basic’s for my next Blog post Azure is very useful for easy testing an getting a heavy machine for your workload even for one day.

 

Happy clustering

Robert Smit

@clusterMVP

http://robertsmit.wordpress.com

Technorati Tags: Windows Azure,Azure File service,Windows,Server,Clustermvp,Blob,cloud witness

Posted December 15, 2014 by Robert Smit in Windows Server 2012 R2

Tagged with ,

StorScore A test framework to evaluate SSDs and HDDs #Cloud Server Infrastructure Engineering #CSI #ssd #winserv @microsoft

StorScore is a component-level evaluation tool for testing storage devices.
When run with default settings it should give realistic metrics similar to
what can be expected by a Windows application developer.

image

You must download and install the following or StorScore will not work:

    A Windows Perl interpreter:
        ActiveState: http://www.activestate.com/activeperl
        Strawberry: http://strawberryperl.com/
   

Strawberry Perl is a perl environment for MS Windows containing all you need to run and develop perl applications. It is designed to be as close as possible to perl environment on UNIX systems.

http://www.microsoft.com/en-us/download/details.aspx?id=43739

imageimage

With the output you can create some pivot tables and get great output.

image

Posted August 21, 2014 by Robert Smit in Windows Server 2012 R2

Tagged with

Create a New Network Load Balancing NLB Cluster On Windows Server 2012 R2 #Winserv #nlb

Still I thought NLB is so common that there is no point here to create a blog. but recently I see a lot of misconfigurations of NLB or people trying to do the easy way and not listen to the guidelines. So this blog is all about NLB only in the private cloud you can’t extend this to Azure even if you have a S2S.

So I have two servers in my private cloud.  MVPNLB001 and MVPNLB002 Both Machines have two NIC’s one for LAN and the other is for the NLB actions.

and yes it can be with one but with two is it much easier and fault tolerant. Less errors and less administration.

Both domain joined and ready for Setup of my basic IIS.

First we setup IIS with the Management tools

image

Install-WindowsFeature -Name Web-Server Or Add-WindowsFeature Web-WebServer –IncludeAllSubFeature to get all the features

Install-WindowsFeature -Name Web-Mgmt-Tools
Add-WindowsFeature NET-Framework-45-ASPNET

Get-WindowsFeature nlb*

 

image

add-WindowsFeature –Name NLB

add-WindowsFeature RSAT-NLB

Now we are ready to configure the NLB. We can do this With powershell but the GUI also Works.  ( I show both )

image 

 

The First Step will be Create a New NLB Cluster. As I do like things clear and therefor I start with rename the NIC names

Rename-NetAdapter -Name "Ethernet 2" -NewName "NLB"

Rename-NetAdapter -Name "Ethernet" -NewName "LAN"

imageimage

Open the NLB Manager and select Cluster NEW

imageimageimageimageimage

Or use powershell

Rename-NetAdapter -Name "Ethernet 2" -NewName "NLB"

New-NetIPAddress -IPAddress 10.255.255.93 -InterfaceAlias "NLB" -AddressFamily IPv4 -PrefixLength 24

In this case we renamed the adapter and give the nic a static IP.

The next steps Will be creating the NLB with his own IP and Remove the default port rule and use only ports that I want say port 80

imageimageimage

Well that was easy Creating the NLB Next step will be delete the port rule and create a 80 port rule 

imageimage

We will remove the default line and just create a rule for one port that I need in this case port 80

Network Load Balancing parameters

http://technet.microsoft.com/en-us/library/cc778263(v=ws.10).aspx

 

 

These steps can be done in just a few more PowerShell lines ( I use variables see below the post for the complete script )

#Creating new cluster
Write-Host "Creating NLB Cluster…" -ForegroundColor yellow
New-NlbCluster -ClusterName $ClusterFqdn -InterfaceName $InterfaceName -ClusterPrimaryIP $ClusterPrimaryIP -SubnetMask $ClusterPrimaryIPSubnetMask -OperationMode $OperationMode

#Removing default port rule for the new cluster
Write-Host "Removing default port rule…" -ForegroundColor yellow
Get-NlbClusterPortRule -HostName . | Remove-NlbClusterPortRule -Force

image

But now what we have only One Server and we need to add the other node or nodes.

imageimage

With two more confirmations screens you are done and have a Configured NLB on One 1 IP listening on port 80

Suppose you have multiple websites and all running on different IP or hostnames just add a cluster IP

imageimageimage

Now that the NLB is created We can do some testing

Now to get this to work with IIS

image

That is right page not found. Check the DNS see if the record is created. and make sure the website IIS is running on this IP

Go to the IIS manager and check the website bindings, default it is listening on all IP but this is not the behavior that I want I want a NLB. So we need to set the website on the NLB IP configured earlier.  When Having multiple IP on the NLB pick the right IP!

imageimageimageimage

Remember this you need to do this on all the Webservers!

image

 

A complete script to automate all these steps and add a second node. only the IP is fixed in the script and can be set as variable but this is up to you.

use this at free will. I created small steps so you can use also little steps if you need this or just give you an Idea.

<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

#Set IP for NLB
Write-Host "Set NLB IP and change Network adapter" -ForegroundColor yellow
Rename-NetAdapter -Name "Ethernet 2" -NewName "NLB"
New-NetIPAddress -IPAddress 10.255.255.93 -InterfaceAlias "NLB" -AddressFamily IPv4 -PrefixLength 24

#Set ExecutionPolicy
Write-Host "Set ExecutionPolicy" -ForegroundColor yellow
Set-ExecutionPolicy -scope LocalMachine RemoteSigned –force

#Add-WindowsFeature
Write-Host "Add-WindowsFeature NLB" -ForegroundColor yellow
add-WindowsFeature NLB
add-WindowsFeature RSAT-NLB

#Variables for creating the new cluster
Write-Host "Variables for creating the new cluster" -ForegroundColor yellow
$ClusterFqdn = Read-Host "Enter NLB cluster Name FQDN"
$InterfaceName = Read-Host "Enter interface name for NLB-adapter"
$ClusterPrimaryIP = Read-Host "Enter cluster primary IP"
$ClusterPrimaryIPSubnetMask = Read-Host "Enter subnetmask for cluster primary IP"

Write-Host "Choose cluster operation mode"
Write-Host "1 – Unicast"
Write-Host "2 – Multicast"
Write-Host "3 – IGMP Multicast"
switch (Read-Host "Enter the number for your chosen operation mode")
{
1 {$OperationMode = "unicast"}
2 {$OperationMode = "multicastcast"}
3 {$OperationMode = "igmpmulticast"}
default {Write-Warning "Invalid option, choose ‘1’, ‘2’ or ‘3’";return}
}

#Creating new cluster
Write-Host "Creating NLB Cluster…" -ForegroundColor yellow
New-NlbCluster -ClusterName $ClusterFqdn -InterfaceName $InterfaceName -ClusterPrimaryIP $ClusterPrimaryIP -SubnetMask $ClusterPrimaryIPSubnetMask -OperationMode $OperationMode

#Removing default port rule for the new cluster
Write-Host "Removing default port rule…" -ForegroundColor yellow
Get-NlbClusterPortRule -HostName . | Remove-NlbClusterPortRule -Force

#Adding port rules

Add-NlbClusterPortRule -Protocol Tcp -Mode Multiple -Affinity Single -StartPort 80 -EndPort 80 -InterfaceName $InterfaceName | Out-Null
Write-Host "Added port rule for http (tcp 80)" -ForegroundColor yellow

Add-NlbClusterPortRule -Protocol Tcp -Mode Multiple -Affinity Single -StartPort 443 -EndPort 443 -InterfaceName $InterfaceName | Out-Null
Write-Host "Added port rule for https (tcp 443)" -ForegroundColor yellow

#Adding additional cluster nodes based on user input
Write-Host "Give Second NLB host" -ForegroundColor yellow
$Node2Fqdn = Read-Host "Enter 2e NLB node"

#Set Network Adapter
Enter-PSSession -ComputerName $Node2Fqdn
invoke-command -computername $Node2Fqdn -scriptblock { Rename-NetAdapter -Name "Ethernet 2" -NewName "NLB"}
invoke-command -computername $Node2Fqdn -scriptblock { New-NetIPAddress -IPAddress 10.255.255.92 -InterfaceAlias "NLB" -AddressFamily IPv4 -PrefixLength 24}
Write-Host "Placed NLB IP and changed NIC to NLB" -ForegroundColor yellow
exit-PSSession

#Add-WindowsFeature
Write-Host "Add-WindowsFeature NLB" -ForegroundColor yellow
Enter-PSSession -ComputerName $Node2Fqdn
invoke-command -computername $Node2Fqdn { add-WindowsFeature NLB}
invoke-command -computername $Node2Fqdn { add-WindowsFeature RSAT-NLB}
exit-pssession

#Add Remote Node To NLB
Write-Host "Adding cluster node $Node2Fqdn" -ForegroundColor yellow
Get-NlbCluster | Add-NlbClusterNode -NewNodeName $Node2Fqdn -NewNodeInterface NLB

 

Have fun

Robert Smit

Twitter : @clustermvpTwitter : @clustermvp

http://robertsmit.wordpress.com/

  • Tag