Azure DNS was first announced at the Microsoft Ignite conference in Chicago in May of 2015. I was there in the conference session when it was announced, because I confess – I love DNS. In this blog post I will provide some criteria that can help you determine whether Azure DNS is right for your external DNS zones. Warning: This is a 300 level article – if you do not have an intermediate understanding of DNS, I recommend first reading this article (here).

Since Azure DNS was announced almost 12 months ago, the only administration interface for Azure DNS was PowerShell. This limited the early adoption of Azure DNS to hyper enthusiasts (like myself) or people who look for any excuse to use PowerShell (you know who you are!). Microsoft announced today that Azure DNS can now be managed in the new Azure Portal, which is now sure to increase interest and adoption of this service.  So if you are managing your DNS today, why switch to Azure DNS?  Here are a few principles that I suggest for guiding this decision:

1. Are your external DNS zones hosted on an unsupported version of Windows Server? If so, then this would be an opportunity to migrate to a supported solution. I have witnessed many environments where external DNS is running on Windows 2003 and even Windows 2000. The scary thing is these are internet-facing services, and since these operating systems are no longer receiving security updates, this could be an open door for hackers or worms to infiltrate into the environment.
2. Are all of your external DNS servers in the same physical location? If so, then Azure DNS provides an opportunity to migrate to a more resilient solution since Azure DNS is automatically load balanced across multiple regions.
3. Have you heard of a routing technique called Anycast? Unless you have deployed your own external DNS infrastructure across the world, it will be hard to beat the performance that Azure DNS offers because of its implementation of “Anycast.” DNS queries automatically route to the closest name servers for the best possible performance. And this translates into better application performance since application latency won’t be waiting on DNS responses. For a nice PDF of how Anycast works (click here).
4. Does the idea or need to programmatically create DNS records in PowerShell downright excite you? Then Azure DNS is for you. Get your geek on with this nice walkthrough by Alexandre Brisebois. Just. Because. You. Can. https://alexandrebrisebois.wordpress.com/2015/06/11/moving-to-azure-dns/
5. Do you need very short TTL values? Some DNS providers like Network Solutions will not allow you to create a record with anything less than a 60 minute TTL. They do this because they do not charge you by query, so they would prefer to have less DNS traffic hitting their network. Microsoft, on the other hand, charges by individual query, so it benefits them to offer low TTL values, since every time the record expires from DNS cache, that results in another query and therefore more $$ to MSFT. Smart.

Pricing

Azure DNS is currently in preview and prices below reflect a 50% preview discount

https://azure.microsoft.com/en-us/pricing/details/dns/

Tips

• Use DNSStuff.com to create a baseline of your current DNS performance before considering switching to Azure DNS. Then run the same report after you switch to see if performance improved favorably.
• Configure TTL values of 3600 (60 minutes)  to keep the DNS queries low and therefore your price low. Lower TTL values will give you greater flexibility to quickly redirect traffic to another host, with the tradeoff of increased cost.

Limits

Contact Support if you need the limits below increased. These are the limits during preview, so they may change when Azure DNS reaches general availability.

https://azure.microsoft.com/en-us/documentation/articles/azure-subscription-service-limits/#dns-limits

Definitions

– A record set is two records with the same name. For example, two A records with the name ‘WWW’ pointing to two separate IP addresses is a single record set. You can have up to 20 ‘WWW’ records in a single record set.

– A record is a type of DNS entry such as ‘A’ ‘MX’ ‘CNAME’ ‘TXT’ ‘SRV’ and so on. You can have up to 1000 records per Azure DNS zone.

Getting started with Azure DNS

Disclaimer: DO not proceed on a production DNS zone –> this service is in Beta and the information below is for educational purposes only for LAB/Testing environments. Use at your own risk.

1. Create your new Zone in Azure DNS first.

2. Create DNS Records in your new zone

You can use the new GUI method when you have just a single record to update, but when you want to do bulk administration, . First, you have to have the right PowerShell modules installed and then logon to your Azure Tenant: https://azure.microsoft.com/en-us/documentation/articles/dns-getstarted-create-dnszone/

Then once you have powershell connected, a minimum of three lines of code are required to create a single record in your DNS zone. For example, to create an A record for WWW to point to 1.1.1.1, you would run these three commands:

$rs = New-AzureRmDnsRecordSet -Name “www” -RecordType “A” -ZoneName “contoso.com” -ResourceGroupName “Website” -Ttl 3600

Add-AzureRmDnsRecordConfig -RecordSet $rs -Ipv4Address 1.1.1.1

Set-AzureRmDnsRecordSet -RecordSet $rs
For more information on the PowerShell syntax, see: https://azure.microsoft.com/en-us/documentation/articles/dns-getstarted-create-recordset/

TIP:  If you were previously hosting your DNS zone on Godaddy, you can export your zone to a file for easy importing into Azure.

5. When you are happy with your Zone then you are ready to point the world at it. This is done through Delegation. Read: “Delegate your domain to Azure” here for more info:
https://azure.microsoft.com/en-us/documentation/articles/dns-domain-delegation/

For example, in Godaddy, this is done in the Manage DNS and Settings tab > Manage.

These name servers can be found in your new Azure DNS settings here:

Summary

Azure DNS is still in preview, so Microsoft’s official recommendation is to wait until it reaches the generally available milestone before migrating production zones onto it. However, if you think you would benefit from it, you can begin experimenting with it now to gain familiarity with it.

Often, hosting external DNS with your DNS registrar is free, but it may not always have the best performance. For example, when I queried the authoritative name servers for my DNS records, I received a 100ms TCP response. After switching to Azure DNS, queries against my DNS zone improved to 50ms! Therefore, Azure DNS might be worth the price when you consider the reduced latency in DNS lookups for your domain name, or the increase high availability compared to hosting it yourself.

Microsoft Operations Management Suite, which runs in Azure, can check the health of on-premises Active Directory, including replication health.

Why is it so important to check AD replication health? Well, if you are responsible for managing Active Directory then you know how easy it is for AD to become unhealthy, and you also know how problematic it can be to restore health. For example, a power outage that results in an Active Directory server going offline for longer than tombstone life of 180 days can cause ‘lingering objects’ to have to be removed.

So the best practice is to use monitoring tools to make sure AD remains healthy, so that you don’t have to spend long hours repairing AD.

Need help installing Microsoft OMS? We are here to help. Drop us a line at [email protected]

Instance Level IP addresses (ILPIP) are distinct from other types of IP addresses in Azure and have a very specific purpose and benefit. They are limited to 5 per Azure Subscription and intended to permit applications such as passive FTP to function, which requires a lot of open ports. They bypass the load balancer and firewall, allowing direct access to the VM. They do not take the place of the VIP assigned to the load balancer, but they can only be added alongside a VIP. At this time, an ILPIP cannot be added to VM’s that have multiple NICs (yet?).

Instance Level IP’s cannot be reserved and therefore are lost when the VM is shut down. They can dynamically register to a hostname that can be used in a CNAME record, so that if the IP changes, you are still fine as long as you point things to the CNAME record and not the IP address.  Another benefit is that the source IP address comes from the VM rather than from the IP of the load balancer.

Something to be aware of is that ILPIP’s do not use the Endpoints feature in Azure, and therefore all internet ports are open – requiring the use of a host-based firewall to be running on the VM to filter traffic.

You can assign ILPIP to an existing or new VM by piping set-AzurePublicIP as follows:

Get-AzureVM -ServiceName ftp01 -Name ftp01 | Set-AzurePublicIP -PublicIPName ftp01pip01 -IdleTimeoutInMinutes 4 -DomainNameLabel ftp01pip01 | Update-AzureVM

Then the CNAME record would point to the PublicIPFQDNs that is revealed when you run a get-AzureVM command. For example: ftppip01.ftp01.cloudapp.net

To request an ILPIP during VM creation you would use this command:

New-AzureService -ServiceName FTPService -Location "Central US"
$image = Get-AzureVMImage|?{$_.ImageName -like "*RightImage-Windows-2012R2-x64*"}
New-AzureVMConfig -Name FTPInstance -InstanceSize Small -ImageName $image.ImageName `
| Add-AzureProvisioningConfig -Windows -AdminUsername adminuser -Password MyP@ssw0rd!! `
| Set-AzurePublicIP -PublicIPName ftpip | New-AzureVM -ServiceName FTPService -Location "Central US"

References:

https://azure.microsoft.com/en-us/documentation/articles/virtual-networks-instance-level-public-ip/

http://blog.siliconvalve.com/2015/06/29/setting-instance-level-public-ips-on-azure-vms/

Mark Russinovich demonstrates containers in Windows Server 2016. There are enhancements to the windows 2016 server kernel that allows multiple instances of user mode processes.

https://azure.microsoft.com/en-us/blog/an-early-look-containers-windows-server-2016-hyper-v-and-azure-with-mark-russinovich/

After watching the 15 minute video, here is the quiz:  what is the difference between a Windows Server 2016 Container and a Windows Server 2016 HyperV Container?

Answer: Hyper-V Containers provide isolation whereas Server 2016 Containers do not isolate the container processes form the host.

Which is right for you? A HyperV container or a Windows Server container?  Mark answers that question at 9:45.

When does a Windows Server container make sense over a HyperV container? It seems that when you do not require isolation, you would use Windows Server Containers.

Both of the above options are relevant for on-premises data centers. A 3^rd option to evaluate is Azure Container Services, which is what cloud first companies will select first.

Earlier this month (Sep ‘15) Microsoft announced a new diagnostic capability for VMs running in IaaS – the ability to see serial and console output from a running Virtual Machine. We take this capability for granted when we host our own data center, but having this capability for VM’s running in the public cloud is useful when troubleshooting boot failures.

This capability is available for new and existing version 2.0 virtual machines (aka Azure Resource Manager (ARM) created in the preview portal.

Then toggle the monitoring option

Note, screenshots and output can take up to 10 minutes to appear in your storage account.

As far as Azure IaaS goes, this is the biggest improvement to the platform since the ExpressRoute offering.

The announcement is here, and I highly recommend reading it:
http://azure.microsoft.com/blog/2015/03/26/azure-backup-announcing-support-for-backup-of-azure-iaas-vms/

The highlights:

• With Azure Backup, you can now get application consistent backup of Windows VMs without having to shut down the VM.
• “In order to backup IaaS VMs, the customer needs to deploy absolutely nothing”*
  Note: This is accurate insofar as you have the Azure VM Agent installed (see Prerequisites below)
• Azure Backup truly achieves “set-and-forget” for VM backups.
• Azure Backup does additional processing to determine the incremental changes between the last recovery point and the current VM state. By transferring and storing only the incremental changes, Azure Backup is highly storage efficient.

Azure VM Agent Prerequisite

• A very important prerequisite is that the Azure VM Agent must be installed. This is performed when the VM is first created, but if you uncheck the box to install the agent, then you will not be able to back it up with the new VM level backup feature.
  
• If you do not have the Azure VM Agent installed, you will get an error message during the registration job step:
  ”Failed to install the Azure Recovery Services extension on the selected item. VM Agent is a pre-requisite for Azure Recovery Services Extension. Please install the Azure VM agent and restart the registration operation.”
• You can manually download and install the VM Agent if it is not installed on the VM, see this article for more information:
  https://msdn.microsoft.com/en-us/library/dn832621.aspx
• The VM agent itself can be downloaded directly from (here) and is very small and takes seconds to install.
• After manually installing the agent, it is necessary to set the ProvisionGuestAgent value to true using Powershell or a REST call. If you do not set this value after manually installing the VM Agent, the addition of the VM Agent is not detected properly.)
• See my blog post for manually installing the VM agent for step by step instructions:
  http://tctblgs.azurewebsites.net/manually-install-the-azure-vm-agent/

Seeing it in Action!

Assuming you have already setup your recovery vault, and your VM’s have the VM Agent installed, then there are three easy steps to start backing up VM’s in Azure IaaS

After clicking on ‘Discover Virtual Machines’ you then click on the Discover button at the bottom of the screen.

After discovery completes, you then click on the Register button.

This brings you to a screen to select the VM’s that you want to protect.

Clicking on the checkmark will spawn a register job that can be viewed on the Jobs tab. In my case, this job took 4 minutes to run.

Now that we have a VM registered, the next step to perform is step number 3, “Protect Registered Azure Virtual Machines.

Select the item you want to protect

You can then select an existing policy or create a new policy

When the backup has taken place, you can view it under protected items.

You can force a new backup or you can click on Restore to bring the VM back to life as a new VM standing next to the old one (it does not overwrite the existing VM).

Restoring a backup

A backup is only “good” if you can verify it by performing a restore. Until then, you should not trust your backups. I have learned this the hard way in the trenches =)

It is interesting that when you restore a VM, it does not overwrite the existing VM, but it instead deploys it alongside the current VM.

You can check the Jobs tab to see how long the restore will take. In my case, the restore took 23 minutes.

When the restore job completes, you can view the job notes:

To view the restored VM, I had to sign out and back into the Azure Management portal, but then I saw the restored VM amongst my other VM’s:

This raises a practical operational question where you need to be sure to shut off the old one before the new one starts up otherwise in a batch environment you wouldn’t want two VM’s running the same batch (you get the idea, you need to know what your VM’s are doing and coordinate properly).

Therefore, it would be good to have an option during the restore process for Azure to automatically shut down the original VM on your behalf to tighten-up the handoff, as you want to avoid having two machines with the same computer name and SID running on the network.

For example, in my restored VM, I can see it still has the original computer name (as I would expect) and so even though the name of the VM in Azure shows as ‘MyRestoredVM’ the actual computer name maintains the original name. (This is okay behavior, but just remember we need to shut off the original VM now too). I posted this feedback on the Azure Feedback portal, please click (here) to vote if you agree and would like the Azure Product team to include this feature in a future release.