TechEd North America 2014, Houston
Announcing Hybrid Connections: Building Amazing Hybrid Web Sites and Mobile Apps in Minutes – Santosh Chandwani

Day 4, 15 May 2014, 1:00PM-2:15PM (DEV-B307)

Disclaimer: This post contains my own thoughts and notes based on attending TechEd North America 2014 presentations. Some content maps directly to what was originally presented. Other content is paraphrased or represents my own thoughts and opinions and should not be construed as reflecting the opinion of either Microsoft, the presenters or the speakers.

Executive Summary—Sean’s takeaways

• Hybrid connection is a simple way to access on-premise resource from Azure
  • When you don’t want to do something more complex, like VPN / ExpressRoute
• Connection Manager allows connecting to an on-premise TCP or HTTP service
• Can connect to Azure web site or Mobile Service

Full video

Santosh Chandwani, Senior Program Manager, Azure, Microsoft
@santoshc1
santoshc@microsoft.com

Evolving Enterprise Infrastructure

• Traditionally, have put everything on a corporate network
• Azure also has its own network
  • Makes sense to move stuff into the cloud
• But common to want to keep some critical data on-premise
• One way to connect these networks
  • VPN, ExpressRoutes
  • Some limits
• But sometimes you just a simple connection to an asset running on-premise
  • Simple

Objective

• Reinforce ability to do hybrid applications on Azure
• Extend hybrid capabilities to all Azure services (e.g. PaaS)
• Don’t want custom code or infrastructure on-premise
• Secure access without changing network configuration
• Enterprise admins continue to have control and visibility

Introducing Hybrid Connections

• Feature of Azure BizTalk Services
  • But don’t require using all of BizTalk
• Fast, easy way to build Hybrid Apps in preview
• Connect Mobile Services to on-premises resources

BizTalk Services FREE Edition (Preview)

• Preview this week
• Use Hybrid Connections at no charge
• Hybrid Connections and Data Transfer now included w/all BizTalk Services tiers

Key Features

• Access to on-premises resources
  • SQL Server, or resources that use TCP or HTTP
• Works with most frameworks
  • Support for .NET, .NET for Mobile Services
  • No mention of Web API
• No need to alter network perimeter
  • No VPN gateway or firewall changes to allow incoming traffic
  • Applications have access only to the resource that they require
• Maintains IT control over resources
  • Group Policy controls, so enterprise admins can control

Hybrid Connections

• Hybrid Connection Manager
  • Can discover resources on premise
• From Web Sites or Mobile Services

Demonstration – Web sites

• Shows web site talking to SQL Server, both on corporate network
• Then publish web site up to Azure
• Talking to SQL Azure database
• Now, set up hybrid connection
  • From Azure Portal, add
  • Name
  • Hostname – on local network, also port name
  • Hostname—could it be IP?
  • Create or use BizTalk Service
• At this point, it’s just existing on Azure—doesn’t actually connect to anything
• Set it up from web site, so it knows that web site wants to connect to it
• Then Remote into desktop
• IP address could be any device
• Manager must run on Windows
• Listener Setup (thru portal)
  • Connected through the portal’s same account
  • They could also do manual setup, with MSI & connection string
• Where in connection manager did we specify IP address to expose?
  Or was it because we installed it directly on the node that we want to connect to?
• Now change conn string on web site
  • Replace connection string
• Refresh web site, now talking to SQL Server on-premises

Lift and Shift

• Lift web site up into Azure
• Shift connection to point back to on-premise database
• No code changes

Flow

• Identify application by host name and port
• Gave hostname and port to hybrid connection
  • Note: name could only be resolved on corporate network
• Hybrid Connection Manager
  • Has gone through all security and threat models from Microsoft
• Arrow directions—how is connection initiated
  • HCM initiates connection to both local resource and up to cloud
• HCM pushes data
• Once we spin up hybrid connection, we can use it from multiple services

Demo – Mobile Services

• Mobile Services – .NET back-end
• Can now launch and debug Mobile Service locally
• Creating hybrid connection for Mobile Service from BizTalk Services portal
• From Mobile Services part of portal, then pick existing Hybrid Connection (and BizTalk service)
• Then set conn string to point to local database
• Change code in Mobile Service to use the new connection string
• Now running local app that goes to Mobile Server to get data
  • Mobile Service in turn is connected to hybrid connection
• Remote to PC and install hybrid connection manager

Constraints

• Supports resources using TCP and HTTP for connectivity
  • Only static TCP ports
  • Need to know ahead of time what the port is
  • Also static IP address, presumably ?
  • Maybe dynamic ports in the future
• Hybrid Connections don’t buffer or inspect traffic
  • TLS can be negotiated end-to-end between application and on-premises resource
  • Dynamic port redirection, e.g. FTP passive mode – doesn’t work (not supported)

Security

• Uses Shared Access Signature Authorization
  • Secure, Simple, Familiar
• Separate roles for on-premises connector and application
• Application authorization is independent
  • Between web site and on-premise resource

Walkthrough

• Max 5 connections to start with
• On-premise setup
  • Link to download MSI will be available soon
  • Can use Powershell and MSI to create connection
• When you get the on-premise installer, the set of connection strings for the connection
• Mobile Services not yet in new Azure portal

Resiliency & Scale

• On-Premises Resources can be scaled out as usual
  • Clustering, availability for SQL
• Applications can be scaled out on Azure
  • Each instance of Website or Mobile Service will connect to Hybrid Connection
  • Don’t have to do anything special
• Multiple instances of Hybrid Connection Manager supported
  • But going to same IP address
  • Gives us scale

Enterprise IT in control

• Manage resource access for Hybrid applications
  • Group Policy controls for allowing access
  • Admins can designate resources to which Hybrid Applications have access
• Event and Audit Logging
  • IT has insight into resources being accessed
  • IT can use existing infrastructure investments for monitoring and control
• Dashboard on Azure portal
  • Access to connection health, status
  • Will provide insights on usage and metrics (future)

Pricing

Summary

• Fastest way to build hybrid applications
• List and Shift web workloads to Azure web sites whilst connecting to on-premises data
• On-premises data just clicks away from Azure Websites & Mobile Services