az group create -n RG-Hub-CentralIndia -l centralindia
az group create -n RG-OnPrem-Sim-CentralIndia -l centralindia
az group create -n RG-Prod-CentralIndia -l centralindia
az group create -n RG-SharedData-CentralIndia -l centralindia
az group create -n RG-DR-SouthIndia -l southindia
az network vnet create -g RG-Hub-CentralIndia -n vnet-hub-cin \
--address-prefix 10.0.0.0/16 \
--subnet-name GatewaySubnet --subnet-prefix 10.0.0.0/27
az network vnet subnet create -g RG-Hub-CentralIndia --vnet-name vnet-hub-cin \
-n snet-mgmt --address-prefix 10.0.1.0/24
az network vnet subnet create -g RG-Hub-CentralIndia --vnet-name vnet-hub-cin \
-n snet-shared-dns --address-prefix 10.0.2.0/24
---
# ⚠️ Student Account Reality Check (Read First)
| Constraint | Impact | Workaround |
|---|---|---|
| $100 credit, no top-up | VPN Gateway (~$27–140/mo even Basic/VpnGw1), VMs, Load Balancer all cost money | Deallocate VMs & delete Gateway after each learning session |
| No real "on-premises" office | Can't have a physical pfSense box | Simulate on-prem as a 5th VNet with a pfSense VM inside it (pfSense CE is free to deploy from an ISO/marketplace-like image) |
| Some regions restricted for student subs | Central India / South India usually work fine | Verify with `az account list-locations` before creating resources |
| No Reserved Instances / Spot in some cases | Not needed for this lab | Use B1s/B2s burstable VMs only |
| VPN Gateway can't be "stopped", only deleted | It bills 24/7 while it exists | Build it, test it, screenshot/document it, delete it, recreate later if needed |
**Golden rule for this whole lab:** build → test → document with screenshots → tear down expensive resources (VPN Gateway, Load Balancer, VMs) → move to next phase.
---
# Final Naming & IP Plan
```
Subscription : Azure for Students
Region Primary : Central India
Region DR : South India
RG-Hub-CentralIndia 10.0.0.0/16
RG-OnPrem-Sim-CentralIndia 192.168.10.0/24 (simulated office)
RG-Prod-CentralIndia 10.1.0.0/16
RG-SharedData-CentralIndia 10.2.0.0/16
RG-DR-SouthIndia 10.10.0.0/16
Naming convention: <resourcetype>-<workload>-<region>-<###>
e.g. vnet-hub-cin-001, nsg-web-cin-001, pip-vpngw-cin-001
```
---
# PHASE 1 — Foundation (Free, safe to leave running)
**1. Create the account & subscription**
- Sign up at azure.microsoft.com/free/students with your college email.
- `az login` from Cloud Shell or local CLI.
**2. Set spending awareness**
```bash
az consumption budget list
```
Go to Cost Management + Billing → Budgets → create a ₹1000/₹2000 alert budget immediately.
**3. Resource Groups**
```bash
az group create -n RG-Hub-CentralIndia -l centralindia
az group create -n RG-OnPrem-Sim-CentralIndia -l centralindia
az group create -n RG-Prod-CentralIndia -l centralindia
az group create -n RG-SharedData-CentralIndia -l centralindia
az group create -n RG-DR-SouthIndia -l southindia
```
**4. IP Planning** — use the table above. Write it in a spreadsheet before touching the portal; this is the #1 place students waste credit fixing overlapping CIDR mistakes.
**5. Naming convention** — decide now (as above), apply consistently. Renaming later means recreating resources = wasted money.
**6–9. Create VNets + Subnets**
```bash
# Hub
az network vnet create -g RG-Hub-CentralIndia -n vnet-hub-cin \
--address-prefix 10.0.0.0/16 \
--subnet-name GatewaySubnet --subnet-prefix 10.0.0.0/27
az network vnet subnet create -g RG-Hub-CentralIndia --vnet-name vnet-hub-cin \
-n snet-mgmt --address-prefix 10.0.1.0/24
az network vnet subnet create -g RG-Hub-CentralIndia --vnet-name vnet-hub-cin \
-n snet-shared-dns --address-prefix 10.0.2.0/24
# Simulated On-Prem
az network vnet create -g RG-OnPrem-Sim-CentralIndia -n vnet-onprem-sim \
--address-prefix 192.168.10.0/24 --subnet-name snet-office --subnet-prefix 192.168.10.0/25
# Production
az network vnet create -g RG-Prod-CentralIndia -n vnet-prod-cin \
--address-prefix 10.1.0.0/16 \
--subnet-name snet-web --subnet-prefix 10.1.1.0/24
az network vnet subnet create -g RG-Prod-CentralIndia --vnet-name vnet-prod-cin \
-n snet-app --address-prefix 10.1.2.0/24
az network vnet subnet create -g RG-Prod-CentralIndia --vnet-name vnet-prod-cin \
-n snet-data --address-prefix 10.1.3.0/24
# Shared Data
az network vnet create -g RG-SharedData-CentralIndia -n vnet-shared-cin \
--address-prefix 10.2.0.0/16 --subnet-name snet-pe --subnet-prefix 10.2.1.0/24
# DR (South India)
az network vnet create -g RG-DR-SouthIndia -n vnet-disaster-sin \
--address-prefix 10.10.0.0/16 --subnet-name snet-web-dr --subnet-prefix 10.10.1.0/24
---
# PHASE 2 — Connectivity (⚠️ this is where money burns — do this in ONE sitting)
**10. VNet Peering (Hub ↔ Prod, Hub ↔ SharedData)** — free, do this anytime.
```bash
az network vnet peering create -g RG-Hub-CentralIndia -n hub-to-prod \
--vnet-name vnet-hub-cin --remote-vnet vnet-prod-cin --allow-vnet-access
az network vnet peering create -g RG-Prod-CentralIndia -n prod-to-hub \
--vnet-name vnet-prod-cin --remote-vnet vnet-hub-cin --allow-vnet-access
```
Repeat both directions for Hub↔SharedData.
**11. Global VNet Peering (Hub ↔ DR, cross-region)** — same commands, cross-region works fine, still free.
**12–16. VPN Gateway + Simulated pfSense (do this last, and budget 2–3 hours max)**
- Deploy VPN Gateway on **Basic SKU** (cheapest, ~$27/month prorated to hours — still charges even for a few hours, so plan the session):
```bash
az network public-ip create -g RG-Hub-CentralIndia -n pip-vpngw-cin --sku Basic
az network vnet-gateway create -g RG-Hub-CentralIndia -n vpngw-hub-cin \
--public-ip-address pip-vpngw-cin --vnet vnet-hub-cin \
--gateway-type Vpn --sku Basic --vpn-type RouteBased --no-wait
```
This takes 30–45 minutes to provision — go do something else, don't leave it half-built across days.
- Deploy pfSense CE inside `vnet-onprem-sim`/`snet-office` (free/community edition ISO, or use a plain Ubuntu VM with strongSwan if pfSense image isn't available for student subs — functionally teaches the same IPSec concepts).
- **13–15. Local Network Gateway + Site-to-Site connection**:
```bash
az network local-gateway create -g RG-Hub-CentralIndia -n lng-onprem \
--gateway-ip-address <pfSense-public-IP> --local-address-prefixes 192.168.10.0/24
az network vpn-connection create -g RG-Hub-CentralIndia -n cn-hub-to-onprem \
--vnet-gateway1 vpngw-hub-cin --local-gateway2 lng-onprem \
--shared-key "YourStrongPSK123!"
```
Configure the matching IPSec Phase1/Phase2 params on pfSense/strongSwan side.
**16–17. Test & validate**
```bash
az network vpn-connection show -g RG-Hub-CentralIndia -n cn-hub-to-onprem --query connectionStatus
```
Ping across the tunnel from a VM in `snet-office` to a VM in `snet-web`. Screenshot it.
**➡️ Once tested and documented: `az network vnet-gateway delete -g RG-Hub-CentralIndia -n vpngw-hub-cin`** to stop the bleeding. Recreate later only when you want to re-demo it.
---
# PHASE 3 — Security (cheap/free, keep these)
**18. NSGs**
```bash
az network nsg create -g RG-Prod-CentralIndia -n nsg-web-cin
az network nsg rule create -g RG-Prod-CentralIndia --nsg-name nsg-web-cin \
-n Allow-HTTP-Internal --priority 100 --direction Inbound --access Allow \
--protocol Tcp --destination-port-ranges 80 443 --source-address-prefixes 10.0.0.0/8
az network vnet subnet update -g RG-Prod-CentralIndia --vnet-name vnet-prod-cin \
-n snet-web --network-security-group nsg-web-cin
```
Repeat similarly for `snet-app` (allow only from web subnet) and `snet-data` (allow only from app subnet).
**19. ASGs (Application Security Groups)**
```bash
az network asg create -g RG-Prod-CentralIndia -n asg-web-cin
az network asg create -g RG-Prod-CentralIndia -n asg-app-cin
```
Attach ASGs to VM NICs later; reference ASGs instead of IP ranges in NSG rules — cleaner at scale.
**20–21. UDRs / Route Tables** (force traffic through Hub if you build a firewall/NVA later)
```bash
az network route-table create -g RG-Hub-CentralIndia -n rt-prod-cin
az network route-table route create -g RG-Hub-CentralIndia --route-table-name rt-prod-cin \
-n route-to-onprem --address-prefix 192.168.10.0/24 --next-hop-type VirtualNetworkGateway
az network vnet subnet update -g RG-Prod-CentralIndia --vnet-name vnet-prod-cin \
-n snet-web --route-table rt-prod-cin
```
**22. Effective Routes** — check via portal: NIC → Networking → Effective routes. Free, just a view.
**23. Service Tags** — use `VirtualNetwork`, `Storage`, `Internet` tags in NSG rules instead of hardcoded IPs; explore in portal under NSG rule source/destination dropdown.
---
# PHASE 4 — Shared Services (mostly free, Storage account is cheap)
**24–25. Private DNS Zone + Linking**
```bash
az network private-dns zone create -g RG-Hub-CentralIndia -n privatelink.blob.core.windows.net
az network private-dns link vnet create -g RG-Hub-CentralIndia \
-z privatelink.blob.core.windows.net -n link-hub \
--virtual-network vnet-hub-cin --registration-enabled false
# Repeat: link-prod, link-dr, link-shared for their respective VNets
```
**26. Storage Account (LRS to save cost — GRS costs more)**
```bash
az storage account create -g RG-SharedData-CentralIndia -n stsharedcin001 \
--sku Standard_LRS --kind StorageV2 --location centralindia \
--public-network-access Disabled
```
**27–28. Private Endpoint + Private Link**
```bash
az network private-endpoint create -g RG-SharedData-CentralIndia -n pe-blob-shared \
--vnet-name vnet-shared-cin --subnet snet-pe \
--private-connection-resource-id $(az storage account show -g RG-SharedData-CentralIndia -n stsharedcin001 --query id -o tsv) \
--group-id blob --connection-name conn-blob-shared
```
Then create a DNS zone group to auto-register the private endpoint's IP into the Private DNS zone:
```bash
az network private-endpoint dns-zone-group create -g RG-SharedData-CentralIndia \
--endpoint-name pe-blob-shared -n zg-blob \
--private-dns-zone privatelink.blob.core.windows.net --zone-name blob
```
**29. Compare with Service Endpoints** — just study the difference (no billable resource needed): Service Endpoints keep the public IP but restrict via VNet, Private Endpoints give the storage account a private IP inside your VNet. This is theory + portal comparison, no cost.
**30. Test DNS resolution** — from a VM in Prod VNet:
```bash
nslookup stsharedcin001.blob.core.windows.net
```
Should resolve to a `10.2.1.x` private IP, not a public one.
---
# PHASE 5 — Applications (spin up only for the session, deallocate immediately after)
**31. Internal Load Balancer**
```bash
az network lb create -g RG-Prod-CentralIndia -n ilb-web-cin --sku Standard \
--vnet-name vnet-prod-cin --subnet snet-web \
--frontend-ip-name feip-web --backend-pool-name beap-web --private-ip-address 10.1.1.100
```
**32–33. Backend Pool + Health Probes**
```bash
az network lb probe create -g RG-Prod-CentralIndia --lb-name ilb-web-cin \
-n probe-http --protocol Http --port 80 --path /
az network lb rule create -g RG-Prod-CentralIndia --lb-name ilb-web-cin \
-n rule-http --protocol Tcp --frontend-port 80 --backend-port 80 \
--frontend-ip-name feip-web --backend-pool-name beap-web --probe-name probe-http
```
**34. VM Scale Concepts** — deploy 2× `Standard_B1s` VMs (cheapest burstable, eligible for student credit), add both NICs to `beap-web`. Don't use a full VMSS unless you want to burn credit faster; two manual VMs teach the same LB concept.
**35. Application testing** — install nginx/IIS on both, hit the ILB's private IP from another VM in the VNet, confirm round-robin. Screenshot, then **deallocate both VMs**:
```bash
az vm deallocate -g RG-Prod-CentralIndia -n vm-web-01
az vm deallocate -g RG-Prod-CentralIndia -n vm-web-02
```
---
# PHASE 6 — Monitoring (mostly free-tier eligible)
**36. Network Watcher** — enabled automatically per region, no extra cost for the watcher itself.
**37. Connection Troubleshoot**
```bash
az network watcher test-connectivity -g RG-Prod-CentralIndia \
--source-resource vm-web-01 --dest-resource vm-app-01 --dest-port 443
```
**38. IP Flow Verify**
```bash
az network watcher test-ip-flow -g RG-Prod-CentralIndia --vm vm-web-01 \
--direction Inbound --protocol TCP --local 10.1.1.4:80 --remote 10.1.1.100:80
```
**39. Packet Capture** — small captures only (storage costs apply for the capture file, keep captures under a few MB and delete after review).
**40. NSG Flow Logs** — enable on `nsg-web-cin`, point to a cheap LRS storage account, **disable after testing** (Flow Logs storage adds up over time).
**41. Diagnostics** — enable diagnostic settings on VPN Gateway/NSG only while actively demoing; turn off afterward to avoid Log Analytics ingestion costs.
---
# PHASE 7 — Cross Region (DR)
**42. Global Peering** — already done in Phase 2, step 11.
**43. Cross-region Storage** — for true GRS you'd enable geo-redundancy on the storage account, but this roughly doubles storage cost; for a student lab, simulate DR by simply creating a second Private Endpoint from `vnet-dr-sin` to the same storage account (needs a Private DNS link from DR VNet too) rather than paying for GRS.
**44. Backup** — use Azure Backup's free-tier-eligible protected instance count (first instance/month often has minimal cost) on one test VM only.
**45. Failover Testing** — manually stop the "primary" web VM, verify traffic/DNS resolution still works from the DR VNet path, document with screenshots, then clean up.
---
# End-of-Lab Cleanup Checklist (run every single time you finish a session)
```bash
az vm deallocate -g RG-Prod-CentralIndia -n vm-web-01
az vm deallocate -g RG-Prod-CentralIndia -n vm-web-02
az network vnet-gateway delete -g RG-Hub-CentralIndia -n vpngw-hub-cin
az network lb delete -g RG-Prod-CentralIndia -n ilb-web-cin
```
Keep Resource Groups, VNets, NSGs, Storage Account, Private Endpoints, DNS zones — these are near-zero cost and preserve your work between sessions. Only Gateways, running VMs, and Load Balancers should be torn down between sessions.
0 Comments