Transforming containerized applications with Azure Container Storage—now in preview

Container is the new virtual machine (VM). Whether you are a CTO, enterprise architect, leading DevOps teams, or building applications, you have already embarked on the journey to containerize your applications or are raring to go—to maximize the benefits of scale, flexibility, and cost. With Kubernetes at the helm, containers have rapidly become a hotbed of innovation and a critical area of transformation for enterprises and startups alike. After the initial focus on stateless containers, running high scale stateful workloads on containers has now become the norm. To run business-critical, enterprise-grade applications on Kubernetes in the cloud, customers need highly scalable, cost-efficient, and performant storage—built-for and with intrinsic support for containers. Today, we are excited to announce the preview of Azure Container Storage, the industry’s first platform-managed container native storage service in the public cloud, providing end to end storage management and orchestration for stateful applications to run efficiently at scale on Azure.

Why Azure Container Storage?

With rapid adoption of Kubernetes, we see a surge of production workloads, both cloud-first as well as app modernization, that need container-native persistent storage for databases (such as MySQL), big data (such as ElasticSearch), messaging applications (such as Kafka), and continuous integration and continuous delivery (CI/CD) systems (such as Jenkins). To run these stateful applications, customers need operational simplicity to deploy and scale storage tightly coupled with the containerized applications. Customers today, however, need to choose between using VM centric cloud storage options, retrofitted to containers, or deploying and self-managing open-source container storage solutions in the cloud—leading to huge operational overhead, scaling bottlenecks, and high cost.

To provide customers with a seamless end-to-end experience, container native storage needs to enable:

◉ Seamless volume mobility across the cluster to maximize pod availability without bottlenecks on volume attaches and deletes.

◉ Rapid scaling of large number of volumes as application pods scale up or scale out as needed.

◉ Optimal price-performance for any volume sizes, especially small volumes that require higher input/output operations per second (IOPS).

◉ Simple and consistent volume management experience across backing storage types to match workload requirements, such as extremely low latency ephemeral disks versus persistent or scalable remote storage.

Azure Container Storage addresses these requirements by enabling customers to focus their attention on running workloads and applications rather than managing storage. Azure Container Storage is our first step towards providing a transformative storage experience. As a critical addition to Azure’s suite of container services, it will help organizations of all sizes to streamline their containerization efforts and improve their overall storage management capabilities.

Leveraging Azure Container Storage

Azure Container Storage is a purpose-built, software-defined storage solution that delivers a consistent control plane across multiple backing storage options to meet the needs of stateful container applications. This fully managed service provides a volume management layer for stateful container applications enabling storage orchestration, data management, Kubernetes-aware data protection, and rule-based performance scaling.

Aligning with open-source container native storage approaches, Azure Container Storage runs microservices-based storage controllers in Kubernetes, to abstract the storage management layer from pods and backing storage, enabling portability across Kubernetes nodes and ability to mount different storage options as shown in the figure.

Azure Container Storage components include:

◉ A Storage Pool, which is a collection of storage resources grouped and presented as a unified storage entity for your AKS cluster.

◉ A data services layer, responsible for replication, encryption, and other add-on functionality absent in the underlying storage provider.

◉ A protocol layer, which exposes provisioned volumes via NVMe-oF protocol to application pods.

With this approach Azure Container Storage offers several differentiated experiences to customers on Azure, including:

Lowering the total cost of ownership (TCO) by providing ability to scale IOPS on smaller volume sizes, to support containerized applications that have dynamic and fluctuating input/output (IO) requirements. This is enabled using shared provisioning of capacity and performance on a storage pool, which can be leveraged by multiple volumes. With shared provisioning, customers can now maximize performance across application containers while keeping TCO down. Instead of allocating capacity and IOPS per persistent volume (PV), which commonly leads to overprovisioning, customers can now create PVs and dynamically share resources from a Storage Pool.

Rapid scale-out of stateful pods, achieved using remote network protocols like NVME-oF and iSCSI to mount PV, enabling effortless scaling on AKS across Compute and Storage. This is specifically beneficial for container deployments that start small and iteratively add resources. Responsiveness is key to ensure that applications are not starved or disrupted, either during initialization or scaling in production. Additionally, application resiliency is key with pod respawns across the cluster requiring rapid PV movement. Leveraging remote network protocols allows us to tightly couple with the pod lifecycle to support highly resilient high scale stateful applications on AKS.

Simplified consistent volume management interface backed by local and remote storage options enabling customers to allocate and use storage via the Kubernetes control plane. This means that customers can leverage ephemeral disks, Azure Disks as well as Azure Elastic SAN via a unified management interface to meet workload needs. For instance, ephemeral storage may be preferable for Cassandra to achieve the lowest latency, while Azure Disks is suitable for PostgreSQL or other database solutions. This unified experience provided by Azure Container Storage simplifies the management of persistent volumes, while delivering a comprehensive solution to address the broad range of performance requirements of various containerized workloads.

Fully integrated day-2 experiences, including data protection, cross-cluster recovery, and observability providing operational simplicity for customers who need to create customer scripts or stitch together disparate tools today. Customers can orchestrate Kubernetes-aware backup of the persistent volumes integrated with AKS generally available to streamline the end-to-end experiences for running stateful container workloads on Azure.

Source: microsoft.com

Continue reading

Optimize performance and strengthen security with Policy Analytics for Azure Firewall

Network security policies are a critical component of modern IT environments, especially with the increasing adoption of cloud workloads. As workloads move to the cloud, network security policies like Azure Firewall policies evolve and adapt to the changing demands of the infrastructure. These policies can be updated multiple times a week, making it challenging for IT security teams to optimize the Firewall rules.

As the number of network and application rules grow over time, they can become suboptimal, resulting in degraded firewall performance and security. For instance, high volume and frequently hit rules may be unintentionally deprioritized, leading to potential performance gaps. Similarly, after migrating an application to a different network, firewall rules referencing older networks may not be deleted, creating security risks.

Optimizing Azure Firewall policies is a challenging task for any IT team, particularly for large, geographically dispersed organizations. It can be a manual and complex process, involving multiple teams across the world. Any updates to these policies can be risky and potentially impact critical production workloads, causing serious downtime. At Microsoft, we strive to help enterprises to manage and secure their environments at scale.

Today, we are excited to announce the general availability of Policy Analytics for Azure Firewall to help IT teams manage the rules in the Azure Firewall policy over time. This feature provides critical insights and surfaces recommendations for optimizing Azure Firewall policies to strengthen security posture. Policy Analytics can detect suboptimal rules and suggest changes to improve performance and security. It can also detect and recommend the deletion of rules referencing older networks that are no longer in use.

Optimize Azure Firewall rules with Policy Analytics

Policy Analytics helps IT teams address these challenges by providing visibility into traffic flowing through the Azure Firewall. Key capabilities available in the Azure portal include:

Policy insight panel: Aggregates policy insights and highlights policy recommendations to optimize your Azure Firewall policies.

Firewall flow logs: Displays all traffic flowing through the Azure Firewall alongside hit rate and network and application rule match. This view helps identify top flows across all rules. You can filter flows matching specific sources, destinations, ports, and protocols.

Rule analytics: Displays traffic flows mapped to destination network address translation (DNAT), network, and application rules. This provides enhanced visibility of all the flows matching a rule over time. You can analyze rules across both parent and child policies.

Single-rule analysis: The single-rule analysis experience analyzes traffic flows matching the selected rule and recommends optimizations based on those observed traffic flows.

Deep dive into network rule hits

Let’s look into the network rule hits. Here we have selected to analyze the hits of our network rules. The time granularity on the right-hand side (highlighted in red) can be set from one day to 30 days. We can expand the rules to see the top 10 flows based on the hit count or drill down on the number of matching flows to see all the flows.

In the below example, we see rule “DefendTheFlag” had 1,500 unique flows in the last seven days, with a total of 152,167 hits. To get visibility into the top flows that generated the traffic, we can expand the rule and continue looking deeper to uncover additional insights. You can review the flows to decide if they must be continued to be allowed or blocked and update the rules appropriately.

Figure 1: Network rule hits.

Deep dive into single-rule analysis

Let’s investigate single-rule analysis. Here we select a rule of interest to analyze the matching flows and optimize thereof. Users can analyze Azure Firewall rules with a few easy clicks.

Figure 2: Start by selecting single-rule analysis.

With Policy Analytics for Azure Firewall, you can perform rule analysis by picking the rule of interest. You can pick a rule to optimize, for instance, you may want to analyze rules with a wide range of open ports or a large number of sources and destinations.

Figure 3: Select a rule and Run analysis.

Policy Analytics surfaces the recommendations based on the actual traffic flows. You can review and apply the recommendations, including deleting rules which don’t match any traffic or prioritizing them lower. Alternatively, you can lock down the rules to specific ports, IPs, fully qualified domain names (FQDNs), or URLs matching traffic.

Figure 4: Review the results and apply selected changes.

Pricing

Policy analytics is a priced feature, with new pricing in effect for general availability. The number of firewalls attached to the policy does not affect the pricing for Policy Analytics.

Source: microsoft.com

Continue reading

Microsoft Azure security evolution: Embrace secure multitenancy, Confidential Compute, and Rust

In the first blog of our series on Azure Security, we delved into our defense-in-depth approach for tackling cloud vulnerabilities. The second blog highlighted our use of variant hunting to detect patterns of vulnerabilities across our services. In this installment, we will introduce our game-changing bets that will enable us to deliver industry-leading security architectures with built-in security for years to come, ensuring a secure cloud experience for our customers. We will discuss our focus on secure multitenancy and share our vision for harnessing the power of Confidential Compute and the Rust programming language to protect our customers’ data from cyber threats. By investing in groundbreaking security strategies, such as Secure Multitenancy, Confidential Compute, and the Rust programming language, Azure provides customers with robust, built-in security measures that not only protect their data but also enhance the overall cloud experience, giving customers the confidence to innovate and grow their businesses securely.

Secure multitenancy with robust compute, network, and credential isolation

We touched on the benefits we’ve seen from improvements in compute, network, and credential isolation. Now, we want to dive deeper into what this means. For compute isolation, we’re investing heavily in hardware-based virtualization (HBV), the foundation of running untrusted code in Azure. Traditional Virtual Machines are at the core of many Azure Services hosting customer workloads. Our current bounty of up to USD250,000 on Microsoft Hyper-V vulnerabilities demonstrates our strong defense and highlights the importance of this boundary.

Our innovations with HBV extends beyond traditional virtual machines (VMs). Azure Container Instances (ACI) serve as our platform for running container workloads, utilizing HBV to isolate container groups from each other. ACI container groups take advantage of the same HBV that powers Azure Virtual Machines, but they offer a platform tailored for modern container-based applications. Numerous new and existing services are moving to ACI as a simple, high-performance model for secure multitenancy. Building services atop secure foundations like ACI enables us to address many isolation problems centrally, allowing multiple services to benefit from fixes simultaneously. Furthermore, we’re excited to introduce HBV to Kubernetes workloads via industry-standard Kata Container support in Azure Kubernetes Service. Similar to ACI container groups, Kata Container pods utilize HBV for robust isolation of untrusted workloads. In the coming months, we’ll share more about our efforts to bring this approach to WebAssembly hosting, boasting single-millisecond overhead compared to hosting WebAssembly without HBV. For network isolation, we’re shifting services towards dedicated virtual networks per tenant and ensuring support for Private Links which enable our services to communicate directly with customer-managed virtual networks. Shared networks have proven error-prone, with mistakes in network Access Control Lists or subnets leading to inadequate network isolation between tenants. Dedicated virtual networks make it difficult to accidentally enable connectivity between tenants that should remain separate.

Credential isolation, on the other hand, involves using credentials scoped to the resources of a single tenant whenever possible. Employing credentials with minimal permissions ensures that even if vulnerabilities are discovered, credentials providing access to other tenants’ data aren’t readily available.

Through significant investments in HBV and a focus on compute, network, and credential isolation, Azure is providing customers with enhanced security and isolation for their workloads. By developing innovative solutions such as Azure Container Instances, and bringing HBV to Kubernetes and WebAssembly hosting, we are creating a robust and secure multitenancy environment that protects data and improves the overall cloud experience. As we continue to strengthen Azure’s security foundation, we are also exploring new opportunities to further enhance our defense-in-depth approach. In the next section, we will discuss the role of Confidential Compute in adding an extra layer of protection to our customers’ data and workloads.  

Confidential Compute: A new layer of defense

Since the dawn of cloud computing in Azure, we’ve recognized the crucial role of HBV in running customer workloads on VMs. However, VMs only protect the host machine from malicious activity within the VM. In many cases, a vulnerability in the VM interface could allow a bad actor to escape to the host, and from there they could fully access other customers’ VM. Confidential Compute presents a new layer of defense against these attacks by preventing bad actors with hosting environment access from accessing the content running in a VM. Our goal is to leverage Confidential VMs and Confidential Containers broadly across Azure Services, adding this extra layer of defense to VMs and containers utilized by our services. This has the potential to reduce the blast radius of a compromise at any level in Azure. While ambitious, one day using Confidential Compute should be as ubiquitous as other best practices have become such as encryption in transit or encryption at rest.

Rust as the path forward over C/C++

Decades of vulnerabilities have proven how difficult it is to prevent memory-corrupting bugs when using C/C++. While garbage-collected languages like C# or Java have proven more resilient to these issues, there are scenarios where they cannot be used. For such cases, we’re betting on Rust as the alternative to C/C++. Rust is a modern language designed to compete with the performance C/C++, but with memory safety and thread safety guarantees built into the language. While we are not able to rewrite everything in Rust overnight, we’ve already adopted Rust in some of the most critical components of Azure’s infrastructure. We expect our adoption of Rust to expand substantially over time.

Our unwavering commitment

Our commitment to secure multitenancy, Confidential Compute, and Rust represents a major investment that we’ll be making in the coming years. Fortunately, Microsoft’s security culture is among the strongest in the industry, empowering us to deliver on these ambitious bets. By prioritizing security as an integral component of our services, we are helping our customers to build and maintain secure, reliable, and scalable applications in the cloud, while ensuring their trust in our platform remains steadfast.

Source: microsoft.com

Continue reading

Announcing the general availability of Azure CNI Overlay in Azure Kubernetes Service

Today, we are thrilled to announce the general availability of Azure CNI Overlay. This is a big step forward in addressing networking performance and the scaling needs of our customers.

As cloud-native workloads continue to grow, customers are constantly pushing the scale and performance boundaries of our existing networking solutions in Azure Kubernetes Service (AKS). For Instance, the traditional Azure Container Networking Interface (CNI) approaches require planning IP addresses in advance, which could lead to IP address exhaustion as demand grows. In response to this demand, we have developed a new networking solution called “Azure CNI Overlay”.

In this blog post, we will discuss why we needed to create a new solution, the scale it achieves, and how its performance compares to the existing solutions in AKS.

Solving for performance and scale

In AKS, customers have several network plugin options to choose from when creating a cluster. However, each of these options have their own challenges when it comes to large-scale clusters.

The “kubenet” plugin, an existing overlay network solution, is built on Azure route tables and the bridge plugin. Since kubenet (or host IPAM) leverages route tables for cross node communication it was designed for, no more than 400 nodes or 200 nodes in dual stack clusters.

The Azure CNI VNET provides IPs from the virtual network (VNET) address space. This may be difficult to implement as it requires a large, unique, and consecutive Classless Inter-Domain Routing (CIDR) space and customers may not have the available IPs to assign to a cluster.

Bring your Own Container Network Interface (BYOCNI) brings a lot of flexibility to AKS. Customers can use encapsulation—like Virtual Extensible Local Area Network (VXLAN)—to create an overlay network as well. However, the additional encapsulation increases latency and instability as the cluster size increases.

To address these challenges, and to support customers who want to run large clusters with many nodes and pods with no limitations on performance, scale, and IP exhaustion, we have introduced a new solution: Azure CNI Overlay.

Azure CNI Overlay

Azure CNI Overlay assigns IP addresses from the user-defined overlay address space instead of using IP addresses from the VNET. It uses the routing of these private address spaces as a native virtual network feature. This means that cluster nodes do not need to perform any extra encapsulation to make the overlay container network work. This also allows this overlay addressing space to be reused for different AKS clusters even when connected via the same VNET.

When a node joins the AKS cluster, we assign a /24 IP address block (256 IPs) from the Pod CIDR to it. Azure CNI assigns IPs to Pods on that node from the block, and under the hood, VNET maintains a mapping of the Pod CIDR block to the node. This way, when Pod traffic leaves the node, VNET platform knows where to send the traffic. This allows the Pod overlay network to achieve the same performance as native VNET traffic and paves the way to support millions of pods and across thousands of nodes.

Datapath performance comparison

This section sneaks into some of the datapath performance comparisons we have been running against Azure CNI Overlay.

Note: We used the Kubernetes benchmarking tools available at kubernetes/perf-tests for this exercise. Comparison can vary based on multiple factors such as underlining hardware and Node proximity within a datacenter among others. Actual results might vary.

Azure CNI Overlay vs. VXLAN-based Overlay

As mentioned before, the only options for large clusters with many Nodes and many Pods are Azure CNI Overlay and BYO CNI. Here we compare Azure CNI Overlay with VXLAN-based overlay implementation using BYO CNI.

TCP Throughput – Higher is Better (19% gain in TCP Throughput)

Azure CNI Overlay showed a significant performance improvement over VXLAN-based overlay implementation. We found that the overhead of encapsulating CNIs was a significant factor in performance degradation, especially as the cluster grows. In contrast, Azure CNI Overlay’s native Layer 3 implementation of overlay routing eliminated the double-encapsulation resource utilization and showed consistent performance across various cluster sizes. In summary, Azure CNI Overlay is a most viable solution for running production grade workloads in Kubernetes.

Azure CNI Overlay vs. Host Network

This section will cover how pod networking performs against node networking and see how native L3 routing of pod networking helps Azure CNI Overlay implementation.

Azure CNI Overlay and Host Network have similar throughput and CPU usage results, and this reinforces that the Azure CNI Overlay implementation for Pod routing across nodes using the native VNET feature is as efficient as native VNET traffic.

TCP Throughput – Higher is Better (Similar to HostNetwork)

Azure CNI Overlay powered by Cilium: eBPF dataplane

Up to this point, we’ve only taken a look at Azure CNI Overlay benefits alone. However, through a partnership with Isovalent, the next generation of Azure CNI is powered by Cilium. Some of the benefits of this approach include better resource utilization by Cilium’s extended Berkeley Packet Filter (eBPF) dataplane, more efficient intra cluster load balancing, Network Policy enforcement by leveraging eBPF over iptables, and more.

In Azure CNI Overlay Powered by Cilium, Azure CNI Overlay sets up the IP-address management (IPAM) and Pod routing, and Cilium provisions the Service routing and Network Policy programming. In other words, Azure CNI Overlay Powered by Cilium allows us to have the same overlay networking performance gains that we’ve seen thus far in this blog post plus more efficient Service routing and Network Policy implementation.

It’s great to see that Azure CNI Overlay powered by Cilium is able to provide even better performance than Azure CNI Overlay without Cilium. The higher pod to service throughput achieved with the Cilium eBPF dataplane is a promising improvement. The added benefits of increased observability and more efficient network policy implementation are also important for those looking to optimize their AKS clusters.

TCP Throughput – Higher is better

To wrap up, Azure CNI Overlay is now generally available in Azure Kubernetes Service (AKS) and offers significant improvements over other networking options in AKS, with performance comparable to Host Network configurations and support for linearly scaling the cluster. And pairing Azure CNI Overlay with Cilium brings even more performance benefits to your clusters. We are excited to invite you to try Azure CNI Overlay and experience the benefits in your AKS environment.

Source: microsoft.com

Continue reading

Secure your cloud environment with Cloud Next-Generation Firewall by Palo Alto Networks, an Azure Native ISV Service—now in preview

To support our customers in accelerating their digital transformation journey and protecting their cloud environment against threats, Microsoft is committed to giving customers the best possible options for securing their applications. To accelerate that commitment, we are excited to announce the preview of Cloud Next-Generation Firewall (NGFW) for Azure.

Cloud NGFW for Azure is Palo Alto Networks NGFW delivered as a managed service on Microsoft Azure. It enables you to easily utilize Palo Alto Networks best-in-class network security capabilities on Azure, and you can manage it using either Palo Alto Networks Panorama policy management solution or directly from the Azure portal. Cloud NGFW for Azure combines the scalability and reliability of Microsoft Azure with Palo Alto Networks deep expertise in network security.

“At Microsoft, we are dedicated to ensuring that Microsoft Azure is the most trusted and secure cloud platform. With the preview release of the Palo Alto Networks Cloud NGFW for Azure, we are pleased to expand our ecosystem of native ISV solutions and provide customers and developers with more options to meet their security needs. This collaboration between Palo Alto Networks and Microsoft combines the scalability and reliability of Azure with Palo Alto Networks expertise to help safeguard our customers against the latest threats.”—Julia Liuson President, Microsoft Developer Division at Microsoft.

“More and more of our customers are running their business critical applications in Azure and are looking to us to help keep those workloads secure. With Cloud NGFW for Azure we are excited to combine Palo Alto Networks best-in-class security with the scalability and reliability of Azure to provide our mutual customers the ability to run their applications with confidence. As a managed Azure Native ISV service, we are proud to deliver the ease of use customers expect from a cloud native experience.”—Lee Klarich, Chief Product Officer, Palo Alto Networks.

Palo Alto Networks Next-Generation Firewall is available on Azure

Palo Alto Networks is a leader in cloud security and provides next-generation cybersecurity to thousands of customers globally, across all sectors. With the integration of Cloud NGFW for Azure into the Azure ecosystem we are delivering an integrated experience and empowering a growing ecosystem of developers and customers to help protect their organizations on Azure.

Cloud NGFW for Azure is offered through Azure Marketplace and offers many of the same capabilities as Palo Alto Networks hardware firewalls and virtualized next-generation firewalls as a managed service, making it easily scalable for cloud environments.

We are excited to work with Palo Alto Networks to provide powerful capabilities to Azure customers, including:

• Security: Palo Alto Networks provides a rich set of security features thanks to its unique machine learning (ML) powered NGFW. Cloud NGFW for Azure uses AI and ML behind the scenes to detect and stop known, unknown, and zero-day threats, enabling customers to stay ahead of sophisticated adversaries. This advanced technology has allowed Palo Alto Networks to block nearly 5 billion events each day, demonstrating the effectiveness of this solution in providing robust security to customers.
• Ease of Use: Cloud NGFW for Azure is designed to be incredibly easy to use, thanks to its Azure-native ISV Service architecture. This enables customers to procure and deploy the solution directly from the Azure portal in just a few minutes, providing instant protection against cyber threats. The solution is also very easy to operate as Palo Alto Networks takes care of scaling, resilience, and software updates. Furthermore, Cloud NGFW for Azure integrates seamlessly with Azure Virtual wide area network (WAN) deployments, enabling customers to protect traffic across their entire network. This integration provides customers with the agility and flexibility they need to manage their cloud security while focusing on their core business objectives.
• Consistent Management from On-Prem to Cloud: Cloud NGFW for Azure is integrated with their Panorama policy management solution. This combination offers a host of benefits to our mutual customers. Firstly, it enables seamless security policy extension from on-prem to Azure, simplifying operations and reducing administrative workload and total cost of ownership. More importantly, this integration enforces the same high standards of security in the cloud, ensuring that customers’ cloud environments are secure and protected against cyber threats. Additionally, integration provides centralized visibility, providing valuable insights into the threats on their network from on-prem environments to the cloud. This enables customers to manage their security policies through their existing Panorama console, streamlining management, allowing their cloud teams to focus on application migration and new application development. 

Do more with less

We have invested in a deeply integrated experience with Palo Alto Networks on Azure including some of the key capabilities listed below to help you do more with less.

Seamless end user experience

We collaborated closely with Palo Alto Networks to develop Cloud NGFW for Azure, and tested it with our joint customers. Cloud NGFW for Azure provides a seamless and simplified end user experience for Cloud NGFW for Azure by integrating the deployment, management, billing, and support of the Palo Alto Networks solution on Azure, available via Azure Marketplace.

Cloud NGFW for Azure also provides integrated billing with Azure subscription invoicing, deep integrations with Azure services for role-based access control (RBAC) and identity management, and a unified support model. This service gives the user consistency in performance and security across their portfolio of on-prem and Azure cloud apps by using the same security solution and configurations everywhere. 

Deploy in minutes

Palo Alto Networks Cloud NGFW is deeply integrated into the Azure ecosystem. Through this deep integration, users can provision a new Palo Alto Networks Next-Generation Firewall in a matter of minutes, so they can quickly secure their Azure applications.

Run where you want

Palo Alto Networks Cloud NGFW for Azure can be deployed into both Virtual Networks and Virtual WAN hubs, and integrated with Azure Key Vault so even encrypted communications can be inspected for security. Cloud NGFW for Azure can be deployed into your Virtual Network automatically using a custom solution via service injection, and user-defined routing can be applied to route traffic to-and-from Cloud NGFW for Azure for inspection.

Customers who want a fully managed network-as-a-service with powerful routing can also choose to deploy the solution in a Virtual WA. Virtual WAN abstracts and simplifies the complexity of routing within a large hybrid network that spans on-premises and Azure at-scale. Configuring routing in Virtual WAN to send traffic to Cloud NGFW for Azure as a bump-in-the-wire solution requires just a single click with the Virtual WAN’s intelligent routing engine handling the rest of the routing.

Getting started with Cloud NGFW for Azure

Discovery and procuring: Azure customers can find the Palo Alto Networks service listed on Azure Marketplace, review the different purchasing plans offered, and procure it directly with single billing enabled:

Provisioning the Palo Alto Networks resources: Within several clicks, you can deploy Palo Alto Networks service in your desired subscription and datacenter regions with your preferred plan.

Source: microsoft.com

Continue reading

Azure Virtual WAN introduces its first SaaS offering

Today we are excited to announce the preview of Palo Alto Networks Cloud Next Generation Firewall (NGFW) for Azure, available as a software as a service (SaaS) offering in Azure Virtual WAN. Azure Virtual WAN (vWAN), networking as a service brings networking, security, and routing functionalities together to simplify networking in Azure. With ease of use and simplicity built in, vWAN is a one-stop shop to connect, protect, route traffic, and monitor your wide area network.

Virtual WAN’s deep integration with the Palo Alto Networks managed firewall service allows you to enjoy the simplicity of a SaaS security offering without the hassles of managing provisioning, scaling, resiliency, software updates, or routing. A SaaS model enables a customer to deploy a solution by simply supplying necessary parameters and abstracting themselves from the management of network virtual appliances.

In this blog, we will focus on the Virtual WAN use case, followed by a brief overview of the behind-the-scenes secret sauce that makes it happen, and then understanding key Palo Alto Networks differentiating features.

The use case

Customers of Azure Virtual WAN can now use Palo Alto Networks Cloud NGFW for Azure to secure their traffic through their Virtual WAN deployments. 

The different traffic flows that are supported by a customer’s vWAN deployment are illustrated below. Flows are numbered in the table below with the following assumptions:

◉ ‘B’ stands for a Branch which is a customer’s on-premises network connected to Azure through ExpressRoute circuits, Branch/Site-to-site VPN, or Remote user/Point-to-site connections.

◉ ‘V’ stands for VNet—Azure Virtual networks hosting customer services and connected to a Virtual WAN hub. It may also be referred to as spoke VNet.

◉ ‘I’ stands for internet, which means the customer traffic that originates from or terminates in the internet and traverses through Azure Virtual WAN.

◉ ‘H’ stands for Azure Virtual hub.

◉ Traffic flows across a single hub are traffic flows originating and terminating on endpoints connected to the same virtual hub. These may also be referred to as Intra-hub flows.

◉ Inter-hub flows are traffic flows that traverse across 2 virtual hubs to get to the destination.

Figure 1: Supported use case and traffic flows in Azure Virtual WAN with Palo Alto Networks Cloud NGFW.

User experience

Customers can add Palo Alto Networks Cloud NGFW to an Azure Virtual WAN Hub in the Azure portal. After a hub is created, click on the hub name and navigate to Third-party Providers -> SaaS solutions –> Create SaaS and choose the Palo Alto Networks Cloud NGFW option.

Figure 2: Discover Palo Alto Networks Cloud NGFW.

After clicking “Create”, you’ll be taken to a wizard experience where you can configure and customize your Cloud NGFW SaaS deployment. You can customize key networking and security attributes of your SaaS such as selecting public Ips, DNS proxy settings, security policies, and security settings.

Figure 3: Create and set up security settings in Palo Alto Networks Cloud NGFW.

After the Cloud NGFW has been successfully provisioned, you can manage your SaaS Firewall by navigating to your Virtual Hub -> Third-party providers -> SaaS solutions -> Manage SaaS. Explore here for more information on available options.

How does this all work within Virtual WAN

As mentioned in the prior section, Virtual WAN supports multiple flows. To illustrate the behind-the-scenes workings in Virtual WAN, we will use East-West (V2V) traffic flows.

Figure 4: Traffic flows within Virtual WAN for East-West (V2V) traffic to-fro Palo Alto Networks Cloud NGFW.

As you can see, the complexities of traffic engineering, and infrastructure management are completely removed and the user gets to just focus on securing the right security policies for their network traffic.

Key highlights of the Palo Alto Networks Cloud NGFW for Azure integration with Virtual WAN

Palo Alto Networks Cloud NGFW for Azure integrates with Azure Virtual WAN deployments, enabling customers to protect traffic across their entire network. While there are several cool and turn-key features built into the integration, a few that are worth calling out are below:

◉ Machine learning powered NGFW: Cloud NGFW for Azure uses AI and machine learning to detect and stop known, unknown, and zero-day threats, enabling customers to stay ahead of sophisticated adversaries.

◉ Consistent Security and Management from On-Premises to Azure: Cloud NGFW for Azure is integrated with Panorama, Palo Alto Networks policy management solution. The integration of Panorama with Cloud NGFW for Azure offers a host of benefits to customers. Firstly, it enables seamless security policy extension from on-prem to Azure, simplifying operations and reducing administrative workload and total cost of ownership. More importantly, this integration enforces the same high standards of security in the cloud, ensuring that customers’ cloud environments are secure and protected against cyber threats. Additionally, the integration provides centralized visibility, providing valuable insights into the threats on their network enabling customers to manage their security policies through their existing Panorama console, streamlining management, allowing their cloud teams to focus on application migration and new application development.

◉ Ease of use: Palo Alto Networks Cloud NGFW is designed to be incredibly easy to use. Similar to Virtual WAN product principles for simplicity and ease of use, this Palo Alto Networks integrated solution allows customers to procure and deploy the solution directly from the Azure portal in just a few minutes, providing instant protection against cyber threats. The solution is also painless to operate as Palo Alto Networks takes care of scaling, resilience, and software updates. This integration gives customers the agility and flexibility they need to manage their cloud security while focusing on their core business objectives.

Source: microsoft.com

Continue reading

Preparing for future health emergencies with Azure HPC

A once-in-a-century global health emergency accelerates worldwide healthcare innovation and novel medical breakthroughs, all supported by powerful high-performance computing (HPC) capabilities.

COVID-19 has forever changed how nations function in the globally interconnected economy. To this day, it continues to affect and shape how countries respond to health emergencies. COVID-19 has demonstrated just how interconnected our society is and how risks, threats, and contagions can have global implications for many aspects of our daily lives.

COVID-19 was the largest global health emergency in over a century, with nearly 762 million cases reported as of the end of March 2023, according to the World Health Organization. The National Centre for Biotechnology Information points out the frequency and breath of new variants that continues to emerge at regular intervals. In response to this intricate health crisis, the global healthcare community quickly mobilized to better understand the virus, learn its behavior, and work toward preventative treatment measures to minimize the damage to lives across the world. Globally, nations mobilized resources for frontline workers, offered social protection to those most severely affected, and provided vaccine access for the billions who need it.

Recent technological innovations have provided the medical community with access to capabilities, such as HPC, that equipped healthcare professionals to better study, understand, and respond to COVID-19. Globally, healthcare innovators could access unprecedented computing power to design, test, and develop new treatments, faster, better, and more iteratively, than ever before.

Today, Azure HPC enables researchers to unleash the next generation of healthcare breakthroughs. For example, the computational capabilities offered by the Azure HPC HB-series virtual machines, powered by AMD EPYCTM CPU cores, allowed researchers to accelerate insights and advances into genomics, precision medicine, and clinical trials, with near-infinite high-performance bioinformatics infrastructure capabilities.

Since the beginning of COVID-19, companies have been leveraging Azure HPC to develop new treatments, run simulations, and testing at scale—all in preparation for the next health emergency. Azure HPC is helping companies unleash new treatments and health cure capabilities that are ushering in the next generation of treatments and healthcare capabilities, across the entire industry.

High-performance computing making a difference

A leading immunotherapy company partnered with Microsoft to leverage the capabilities of Azure HPC’s high-performance computing, in order to perform detailed computational analyses of the spike protein structure of SARS-CoV-2. Due to the critical nature of the spike protein structure and the role it plays in allowing the invasion of human cells, targeting it for study, analyses, and insights, is a crucial step in the development of treatments to combat the virus.

The company’s engineers and scientists collaborated with Microsoft, and quickly deployed HPC clusters on Azure, containing over 1250 core graphic processing units (GPUs). These GPUs are specifically designed for machine learning and similarly intense computational applications. The Azure HPC clusters augmented the company’s existing GPU clusters—which was already optimized for molecular modelling of proteins, antibodies, and antivirals—bringing a truly high-powered scaled engagement approach to fruition.

By collaborating with Microsoft in this way and making use of the massive, networked computing capabilities and advanced algorithms enabled by Azure HPC, the company was able to generate working models in days rather than the months it would have taken by following traditional approaches.

The incredible amount of computing power will help bolster drug discovery and therapeutic developments. By joining forces and bringing together the incredible power of Azure HPC and cutting edge immunotherapies, it helped contribute to the development of models that allowed researchers to better understand the virus, find novel binding sites to fight the virus, and ultimately guide the development of future treatments and vaccines for the virus.

Powering pharmaceutical research and innovation

The healthcare industry is making remarkable strides in the development of cutting-edge treatments and innovations that are geared towards solving some of the world's greatest healthcare challenges.

For example, researchers are leveraging HPC to transform their research and development effort as well as accelerating the development of new life-saving treatments.

Using a technique producing amorphous solid dispersions (ASD), drug researchers break up active pharmaceutical ingredients and blend them with organic polymers to improve the dissolution rate, bioavailability, and solubility of drug delivery systems. Although a wonder of modern medicine, it is a highly complicated, often lab-based process that can take months.

Swiss-based Molecular Modelling Laboratory (MML), a leader in ASD screening, wanted to pivot its drug research and development to small organic and biomolecular polymers. This approach determines ASD stability prior to formulation, reveals new ASD combinations, enhances drug safety, and helps reduce drug development costs as well as delivery times.

MML chose to leverage Azure HPC resources on more than 18,000 Azure HBv2 virtual machines and to optimize high-throughput drug screening and active pharmaceutical ingredient solubility limit detection, with the aim to alleviate common development hurdles.

The adoption of Azure HPC has helped MML shift from a small start-up to an established business working with some of the top pharmaceutical companies in the world—all in a very short time.

For the global healthcare community, the computational power and scalability of Azure HPC presents an unprecedented opportunity to accelerate pharmaceutical, medical, as well as health innovation. Azure HPC will continue playing a leading role in supporting the healthcare industry to respond optimally to any future global health emergency that may arise.

Source: microsoft.com

Continue reading