1. ExpressRoute for Office 365 Training
11/15/ :23 PM
ExpressRoute for Office 365 Training
Planning for network security and high availability requirements – Session 8
Speaker Name
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

2. Security and availability
Minimal pre-deployment risk / High post-deployment risk
Dedicated circuit security barrier
As availability cost increases, so does security
A single dedicated circuit high availability

3. Documentation ExpressRoute for Office 365 Office 365 endpoints
Office 365 endpoints
Routing with ExpressRoute and Office 365 (Includes what’s inbound)

4. Security

5. Security Plan
The depth and type of network/security controls may have impact on the performance and scalability of the Office 365 user experience
Outbound (on-premises -> Microsoft) & inbound (Microsoft -> on-premises) flows may have different requirements
Office 365 endpoint are the same whether traffic is routed through ExpressRoute for Office 365 or via the Internet.
Every egress to ExpressRoute for Office 365 must be secured.

6. Routing Domains and Isolation
Microsoft Cloud
Internet
Customer’s premises
Microsoft Peering
ExpressRoute Circuit
Internet edge
Azure Extranet / Public Peering
Extranet
Azure Private Peering !=
Core Network

7. Routing Domains and Isolation
Microsoft Cloud
Internet
Customer’s premises
Microsoft Peering
ExpressRoute Circuit
Internet edge
Azure Extranet / Public Peering
Extranet
Azure Private Peering
Core Network

8. Security Models Network/Security Perimeter Model
Co-located at a cloud exchange
New or existing security/perimeter infrastructure in the colo.
Use colo for routing/interconnect purposes + back haul connections into the on- premises security/perimeter infrastructure.
Point-to- Point Ethernet
Terminate ExpressRoute in the existing on-premises security/perimeter.
Install new security/perimeter specific to the ExpressRoute termination.
Any-to-Any IPVPN
Leverage existing security/perimeter at all IPVPN egress used for ExpressRoute for Office 365 connectivity.
Hairpin the IPVPN used for ExpressRoute for Office 365 to specific on-premises locations designated to serve as the security/perimeter.

9. Security Plan
ExpressRoute security fits neatly between customer internal and external security policies
Avoid strict IP routing as a security measure, use Microsoft ASN or port based restrictions instead
Outbound (on-premises -> Microsoft) & inbound (Microsoft -> on-premises) flows may have different requirements
Every ExpressRoute egress location requires security

10. Availability and Performance

11. Availability and Performance Overview
Availability and performance are defined by the perception of the person using the service.
Any of the physical and virtual systems between the person’s client and the service can cause poor availability and performance.
Shortcuts in your end-to-end design will result in poor availability and performance.
High Availability & Great Performance = No Shortcuts

12. Availability and Performance

13. Availability and Performance

14. Availability and Performance

15. Availability and Performance

16. Availability and Performance

17. Availability and Performance

18. Availability and Performance

19. Availability and Performance

20. Availability and Performance

21. Availability and Performance

22. Availability and Performance

23. Availability and Performance

24. Availability and Performance

25. Designing your availability plan
11/15/ :23 PM
Designing your availability plan
We strongly recommend that you plan and design high availability and resiliency into your end-to-end connectivity scenarios for Office 365.
A design should include;
no single points of failure.
minimizing the number of people affected and duration of that impact for most anticipated failure modes.
optimizing for simple, repeatable, and automatic recovery process from most anticipated failure modes.
supporting the full demands of your network traffic and functionality through redundant paths, without substantial degradation.
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

26. Summary
Availability and security align to a combination of people and ExpressRoute egress locations.
Shortcuts in your end-to-end availability and security design will result in poor availability and security vulnerabilities.
Designs should align to and influence existing customer policies
Minimize the number of people affected by a security or disaster event
Optimize for simple operations and automated recoveries

27. © 2016 Microsoft Corporation. All rights reserved
© 2016 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.