AWS Managed VPN Connections

by Posted in 4. Others Tagged 2 Comments

Source: http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_VPN.html

AWS Managed VPN Connections

By default, instances that you launch into a virtual private cloud (VPC) can’t communicate with your own network. You can enable access to your network from your VPC by attaching a virtual private gateway to the VPC, creating a custom route table, updating your security group rules, and creating an AWS managed VPN connection.

Although the term VPN connection is a general term, in the Amazon VPC documentation, a VPN connection refers to the connection between your VPC and your own network. AWS supports Internet Protocol security (IPsec) VPN connections.

Your AWS managed VPN connection is either an AWS Classic VPN or an AWS VPN. For more information, see AWS Managed VPN Categories.

Important

We currently do not support IPv6 traffic through a VPN connection.

Topics

For information about how you’re charged for using a VPN connection with your VPC, see the Amazon VPC product page.

Components of Your VPN

A VPN connection consists of the following components. For more information about VPN limits, see Amazon VPC Limits.

Virtual Private Gateway

A virtual private gateway is the VPN concentrator on the Amazon side of the VPN connection. You create a virtual private gateway and attach it to the VPC from which you want to create the VPN connection.

When you create a virtual private gateway, you can specify the private Autonomous System Number (ASN) for the Amazon side of the gateway. If you don’t specify an ASN, the virtual private gateway is created with the default ASN (64512). You cannot change the ASN after you’ve created the virtual private gateway. To check the ASN for your virtual private gateway, view its details in the Virtual Private Gateways screen in the Amazon VPC console, or use the describe-vpn-gateways AWS CLI command.

Note

If you create your virtual private gateway before 2018-06-30, the default ASN is 17493 in the Asia Pacific (Singapore) region, 10124 in the Asia Pacific (Tokyo) region, 9059 in the EU (Ireland) region, and 7224 in all other regions.

Customer Gateway

A customer gateway is a physical device or software application on your side of the VPN connection.

To create a VPN connection, you must create a customer gateway resource in AWS, which provides information to AWS about your customer gateway device. The following table describes the information you’ll need to create a customer gateway resource.

Item Description
Internet-routable IP address (static) of the customer gateway’s external interface. The public IP address value must be static. If your customer gateway is behind a network address translation (NAT) device that’s enabled for NAT traversal (NAT-T), use the public IP address of your NAT device, and adjust your firewall rules to unblock UDP port 4500.
The type of routing—static or dynamic. For more information, see VPN Routing Options.
(Dynamic routing only) Border Gateway Protocol (BGP) Autonomous System Number (ASN) of the customer gateway. You can use an existing ASN assigned to your network. If you don’t have one, you can use a private ASN (in the 64512–65534 range).If you use the VPC wizard in the console to set up your VPC, we automatically use 65000 as the ASN.

To use Amazon VPC with a VPN connection, you or your network administrator must also configure the customer gateway device or application. When you create the VPN connection, we provide you with the required configuration information and your network administrator typically performs this configuration. For information about the customer gateway requirements and configuration, see the Your Customer Gateway in the Amazon VPC Network Administrator Guide.

The VPN tunnel comes up when traffic is generated from your side of the VPN connection. The virtual private gateway is not the initiator; your customer gateway must initiate the tunnels. If your VPN connection experiences a period of idle time (usually 10 seconds, depending on your configuration), the tunnel may go down. To prevent this, you can use a network monitoring tool to generate keepalive pings; for example, by using IP SLA.

For a list of customer gateways that we have tested with Amazon VPC, see Amazon Virtual Private Cloud FAQs.

AWS Managed VPN Categories

Your AWS managed VPN connection is either an AWS Classic VPN connection or an AWS VPN connection. Any new VPN connection that you create is an AWS VPN connection. The following features are supported on AWS VPN connections only:

  • NAT traversal
  • 4-byte ASN (in addition to 2-byte ASN)
  • CloudWatch metrics
  • Reusable IP addresses for your customer gateways
  • Additional encryption options; including AES 256-bit encryption, SHA-2 hashing, and additional Diffie-Hellman groups
  • Configurable tunnel options
  • Custom private ASN for the Amazon side of a BGP session

You can find out the category of your AWS managed VPN connection by using the Amazon VPC console or a command line tool.

To identify the VPN category using the console

  1. Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.
  2. In the navigation pane, choose VPN Connections.
  3. Select the VPN connection, and check the value for Category in the details pane. A value of VPN indicates an AWS VPN connection. A value of VPN-Classic indicates an AWS Classic VPN connection.

To identify the VPN category using a command line tool

  • You can use the describe-vpn-connections AWS CLI command. In the output that’s returned, take note of the Category value. A value of VPN indicates an AWS VPN connection. A value of VPN-Classic indicates an AWS Classic VPN connection.In the following example, the VPN connection is an AWS VPN connection. 
    aws ec2 describe-vpn-connections --vpn-connection-ids vpn-1a2b3c4d
    {
    "VpnConnections": [
        {
            "VpnConnectionId": "vpn-1a2b3c4d", 

            ...

            "State": "available", 
            "VpnGatewayId": "vgw-11aa22bb", 
            "CustomerGatewayId": "cgw-ab12cd34", 
            "Type": "ipsec.1",
            "Category": "VPN"
        }
    ]
}

Alternatively, use one of the following commands:

Migrating to AWS VPN

If your existing VPN connection is an AWS Classic VPN connection, you can migrate to an AWS VPN connection by creating a new virtual private gateway and VPN connection, detaching the old virtual private gateway from your VPC, and attaching the new virtual private gateway to your VPC.

If your existing virtual private gateway is associated with multiple VPN connections, you must recreate each VPN connection for the new virtual private gateway. If there are multiple AWS Direct Connect private virtual interfaces attached to your virtual private gateway, you must recreate each private virtual interface for the new virtual private gateway. For more information, see Creating a Virtual Interface in the AWS Direct Connect User Guide.

If your existing AWS managed VPN connection is an AWS VPN connection, you cannot migrate to an AWS Classic VPN connection.

Note

During this procedure, connectivity over the current VPC connection is interrupted when you disable route propagation and detach the old virtual private gateway from your VPC. Connectivity is restored when the new virtual private gateway is attached to your VPC and the new VPN connection is active. Ensure that you plan for the expected downtime.

To migrate to an AWS VPN connection

  1. Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.
  2. In the navigation pane, choose Virtual Private Gateways, Create Virtual Private Gateway and create a virtual private gateway.
  3. In the navigation pane, choose VPN Connections, Create VPN Connection. Specify the following information, and choose Yes, Create.
    • Virtual Private Gateway: Select the virtual private gateway that you created in the previous step.
    • Customer Gateway: Choose Existing, and select the existing customer gateway for your current AWS Classic VPN connection.
    • Specify the routing options as required.
  4. Select the new VPN connection and choose Download Configuration. Download the appropriate configuration file for your customer gateway device.
  5. Use the configuration file to configure VPN tunnels on your customer gateway device. For examples, see the Amazon VPC Network Administrator Guide. Do not enable the tunnels yet. Contact your vendor if you need guidance on keeping the newly configured tunnels disabled.
  6. (Optional) Create test VPC and attach the virtual private gateway to the test VPC. Change the encryption domain/source destination addresses as required, and test connectivity from a host in your local network to a test instance in the test VPC.
  7. If you are using route propagation for your route table, choose Route Tables in the navigation pane. Select the route table for your VPC, and choose Route Propagation, Edit. Clear the check box for the old virtual private gateway and choose Save.

    Note

    From this step onwards, connectivity is interrupted until the new virtual private gateway is attached and the new VPN connection is active.

  8. In the navigation pane, choose Virtual Private Gateways. Select the old virtual private gateway and choose Detach from VPC, Yes, Detach. Select the new virtual private gateway, and choose Attach to VPC. Specify the VPC for your VPN connection, and choose Yes, Attach.
  9. In the navigation pane, choose Route Tables. Select the route table for your VPC and do one of the following:
    • If you are using route propagation, choose Route Propagation, Edit. Select the new virtual private gateway that’s attached to the VPC and choose Save.
    • If you are using static routes, choose Routes, Edit. Modify the route to point to the new virtual private gateway, and choose Save.
  10. Enable the new tunnels on your customer gateway device and disable the old tunnels. To bring the tunnel up, you must initiate the connection from your local network.If applicable, check your route table to ensure that the routes are being propagated. The routes propagate to the route table when the status of the VPN tunnel is UP.

    Note

    If you need to revert to your previous configuration, detach the new virtual private gateway and follow steps 8 and 9 to re-attach the old virtual private gateway and update your routes.

  11. If you no longer need your AWS Classic VPN connection and do not want to continue incurring charges for it, remove the previous tunnel configurations from your customer gateway device, and delete the VPN connection. To do this, go to VPN Connections, select the VPN connection, and choose Delete.

    Important

    After you’ve deleted the AWS Classic VPN connection, you cannot revert or migrate your new AWS VPN connection back to an AWS Classic VPN connection.

VPN Configuration Examples

The following diagrams illustrate single and multiple VPN connections. The VPC has an attached virtual private gateway, and your network includes a customer gateway, which you must configure to enable the VPN connection. You set up the routing so that any traffic from the VPC bound for your network is routed to the virtual private gateway.

When you create multiple VPN connections to a single VPC, you can configure a second customer gateway to create a redundant connection to the same external location. You can also use it to create VPN connections to multiple geographic locations.

Single VPN Connection

<br /> VPN layout<br />

Multiple VPN connections

<br /> Multiple VPN layout<br />

VPN Routing Options

When you create a VPN connection, you must do the following:

  • Specify the type of routing that you plan to use (static or dynamic)
  • Update the route table for your subnet

Static and Dynamic Routing

The type of routing that you select can depend on the make and model of your VPN devices. If your VPN device supports Border Gateway Protocol (BGP), specify dynamic routing when you configure your VPN connection. If your device does not support BGP, specify static routing. For a list of static and dynamic routing devices that have been tested with Amazon VPC, see the Amazon Virtual Private Cloud FAQs.

When you use a BGP device, you don’t need to specify static routes to the VPN connection because the device uses BGP to advertise its routes to the virtual private gateway. If you use a device that doesn’t support BGP, you must select static routing and enter the routes (IP prefixes) for your network that should be communicated to the virtual private gateway.

We recommend that you use BGP-capable devices, when available, because the BGP protocol offers robust liveness detection checks that can assist failover to the second VPN tunnel if the first tunnel goes down. Devices that don’t support BGP may also perform health checks to assist failover to the second tunnel when needed.

Route Tables and VPN Route Priority

Route tables determine where network traffic is directed. In your route table, you must add a route for your network and specify the virtual private gateway as the target. This enables traffic destined for your network to route via the virtual private gateway and over one of the VPN tunnels. You can enable route propagation for your route table to automatically propagate your network routes to the table for you.

Only IP prefixes that are known to the virtual private gateway, whether through BGP advertisements or static route entry, can receive traffic from your VPC. The virtual private gateway does not route any other traffic destined outside of received BGP advertisements, static route entries, or its attached VPC CIDR.

When a virtual private gateway receives routing information, it uses path selection to determine how to route traffic to your network. Longest prefix match applies; otherwise, the following rules apply:

  • If any propagated routes from a VPN connection or AWS Direct Connect connection overlap with the local route for your VPC, the local route is most preferred even if the propagated routes are more specific.
  • If any propagated routes from a VPN connection or AWS Direct Connect connection have the same destination CIDR block as other existing static routes (longest prefix match cannot be applied), we prioritize the static routes whose targets are an Internet gateway, a virtual private gateway, a network interface, an instance ID, a VPC peering connection, a NAT gateway, or a VPC endpoint.

If you have overlapping routes within a VPN connection and longest prefix match cannot be applied, then we prioritize the routes as follows in the VPN connection, from most preferred to least preferred:

  • BGP propagated routes from an AWS Direct Connect connection
  • Manually added static routes for a VPN connection
  • BGP propagated routes from a VPN connection

In this example, your route table has a static route to an internet gateway (that you added manually), and a propagated route to a virtual private gateway. Both routes have a destination of 172.31.0.0/24. In this case, all traffic destined for 172.31.0.0/24 is routed to the internet gateway — it is a static route and therefore takes priority over the propagated route.

Destination Target
10.0.0.0/16 Local
172.31.0.0/24 vgw-1a2b3c4d (propagated)
172.31.0.0/24 igw-11aa22bb

Configuring the VPN Tunnels for Your VPN Connection

You use a VPN connection to connect your network to a VPC. Each VPN connection has two tunnels, with each tunnel using a unique virtual private gateway public IP address. It is important to configure both tunnels for redundancy. When one tunnel becomes unavailable (for example, down for maintenance), network traffic is automatically routed to the available tunnel for that specific VPN connection.

The following diagram shows the two tunnels of the VPN connection.

When you create a VPN connection, you download a configuration file specific to your customer gateway device that contains information for configuring the device, including information for configuring each tunnel. You can optionally specify some of the tunnel options yourself when you create the VPN connection. Otherwise, AWS provides default values.

The following table describes the tunnel options that you can configure.

Item Description AWS-provided default value
Inside tunnel CIDR The range of inside IP addresses for the VPN tunnel. You can specify a size /30 CIDR block from the 169.254.0.0/16range. The CIDR block must be unique across all VPN connections that use the same virtual private gateway.The following CIDR blocks are reserved and cannot be used:

  • 169.254.0.0/30
  • 169.254.1.0/30
  • 169.254.2.0/30
  • 169.254.3.0/30
  • 169.254.4.0/30
  • 169.254.5.0/30
  • 169.254.169.252/30
 A size /30 CIDR block from the 169.254.0.0/16range.
Pre-shared key (PSK) The pre-shared key (PSK) to establish the initial IKE Security Association between the virtual private gateway and customer gateway.The PSK must be between 8 and 64 characters in length and cannot start with zero (0). Allowed characters are alphanumeric characters, periods (.), and underscores (_). A 32-character alphanumeric string.

You cannot modify tunnel options after you create the VPN connection. To change the inside tunnel IP addresses or the PSKs for an existing connection, you must delete the VPN connection and create a new one. You cannot configure tunnel options for an AWS Classic VPN connection.

Using Redundant VPN Connections to Provide Failover

As described earlier, a VPN connection has two tunnels to help ensure connectivity in case one of the VPN connections becomes unavailable. To protect against a loss of connectivity in case your customer gateway becomes unavailable, you can set up a second VPN connection to your VPC and virtual private gateway by using a second customer gateway. By using redundant VPN connections and customer gateways, you can perform maintenance on one of your customer gateways while traffic continues to flow over the second customer gateway’s VPN connection. To establish redundant VPN connections and customer gateways on your network, you need to set up a second VPN connection. The customer gateway IP address for the second VPN connection must be publicly accessible.

The following diagram shows the two tunnels of each VPN connection and two customer gateways.

Dynamically routed VPN connections use the Border Gateway Protocol (BGP) to exchange routing information between your customer gateways and the virtual private gateways. Statically routed VPN connections require you to enter static routes for the network on your side of the customer gateway. BGP-advertised and statically entered route information allow gateways on both sides to determine which tunnels are available and reroute traffic if a failure occurs. We recommend that you configure your network to use the routing information provided by BGP (if available) to select an available path. The exact configuration depends on the architecture of your network.

 

Source: http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/SetUpVPNConnections.html

Setting Up an AWS VPN Connection

Use the following procedures to manually set up the VPN connection. Alternatively, you can let the VPC creation wizard take care of many of these steps for you. For more information about using the VPC creation wizard to set up the virtual private gateway, see Scenario 3: VPC with Public and Private Subnets and AWS Managed VPN Access or Scenario 4: VPC with a Private Subnet Only and AWS Managed VPN Access.

To set up a VPN connection, you need to complete the following steps:

These procedures assume that you have a VPC with one or more subnets.

Create a Customer Gateway

A customer gateway provides information to AWS about your customer gateway device or software application. For more information, see Customer Gateway.

To create a customer gateway using the console

  1. Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.
  2. In the navigation pane, choose Customer Gateways, and then Create Customer Gateway.
  3. Complete the following and then choose Create Customer Gateway:
    • (Optional) For Name, type a name for your customer gateway. Doing so creates a tag with a key of Name and the value that you specify.
    • For Routing, select the routing type.
    • For dynamic routing, for BGP ASN, type the Border Gateway Protocol (BGP) Autonomous System Number (ASN).
    • For IP Address, type the static, internet-routable IP address for your customer gateway device. If your customer gateway is behind a NAT device that’s enabled for NAT-T, use the public IP address of the NAT device.

To create a customer gateway using the command line or API

Create a Virtual Private Gateway

When you create a virtual private gateway, you can optionally specify the private Autonomous System Number (ASN) for the Amazon side of the gateway. The ASN must be different from the BGP ASN specified for the customer gateway.

After you create a virtual private gateway, you must attach it to your VPC.

To create a virtual private gateway and attach it to your VPC

  1. In the navigation pane, choose Virtual Private Gateways, Create Virtual Private Gateway.
  2. (Optional) Type a name for your virtual private gateway. Doing so creates a tag with a key of Name and the value that you specify.
  3. For ASN, leave the default selection to use the default Amazon ASN. Otherwise, choose Custom ASN and type a value. For a 16-bit ASN, the value must be in the 64512 to 65534 range. For a 32-bit ASN, the value must be in the 4200000000 to 4294967294 range.
  4. Choose Create Virtual Private Gateway.
  5. Select the virtual private gateway that you created, and then choose Actions, Attach to VPC.
  6. Select your VPC from the list and choose Yes, Attach.

To create a virtual private gateway using the command line or API

To attach a virtual private gateway to a VPC using the command line or API

Enable Route Propagation in Your Route Table

To enable instances in your VPC to reach your customer gateway, you must configure your route table to include the routes used by your VPN connection and point them to your virtual private gateway. You can enable route propagation for your route table to automatically propagate those routes to the table for you.

For static routing, the static IP prefixes that you specify for your VPN configuration are propagated to the route table when the status of the VPN connection is UP. Similarly, for dynamic routing, the BGP-advertised routes from your customer gateway are propagated to the route table when the status of the VPN connection is UP.

Note

If your connection is interrupted, any propagated routes in your route table are not automatically removed. You may have to disable route propagation to remove the propagated routes; for example, if you want traffic to fail over to a static route.

To enable route propagation using the console

  1. In the navigation pane, choose Route Tables, and then select the route table that’s associated with the subnet; by default, this is the main route table for the VPC.
  2. On the Route Propagation tab in the details pane, choose Edit, select the virtual private gateway that you created in the previous procedure, and then choose Save.

Note

For static routing, if you do not enable route propagation, you must manually enter the static routes used by your VPN connection. To do this, select your route table, choose Routes, Edit. For Destination, add the static route used by your VPN connection . For Target, select the virtual private gateway ID, and choose Save.

To disable route propagation using the console

  1. In the navigation pane, choose Route Tables, and then select the route table that’s associated with the subnet.
  2. Choose Route Propagation, Edit. Clear the Propagate check box for the virtual private gateway, and choose Save.

To enable route propagation using the command line or API

To disable route propagation using the command line or API

Update Your Security Group

To allow access to instances in your VPC from your network, you must update your security group rules to enable inbound SSH, RDP, and ICMP access.

To add rules to your security group to enable inbound SSH, RDP and ICMP access

  1. In the navigation pane, choose Security Groups, and then select the default security group for the VPC.
  2. On the Inbound tab in the details pane, add rules that allow inbound SSH, RDP, and ICMP access from your network, and then choose Save. For more information about adding inbound rules, see Adding, Removing, and Updating Rules.

For more information about working with security groups using the AWS CLI, see Security Groups for Your VPC.

Create a VPN Connection and Configure the Customer Gateway

After you create the VPN connection, download the configuration information and use it to configure the customer gateway device or software application.

To create a VPN connection and configure the customer gateway

  1. In the navigation pane, choose VPN Connections, Create VPN Connection.
  2. Complete the following information, and then choose Create VPN Connection:
    • (Optional) For Name tag, type a name for your VPN connection. Doing so creates a tag with a key of Name and the value that you specify.
    • Select the virtual private gateway that you created earlier.
    • Select the customer gateway that you created earlier.
    • Select one of the routing options based on whether your VPN router supports Border Gateway Protocol (BGP):
      • If your VPN router supports BGP, choose Dynamic (requires BGP).
      • If your VPN router does not support BGP, choose Static. For Static IP Prefixes, specify each IP prefix for the private network of your VPN connection.
    • Under Tunnel Options, you can optionally specify the following information for each tunnel:
      • A size /30 CIDR block from the 169.254.0.0/16 range for the inside tunnel IP addresses.
      • The IKE pre-shared key (PSK).

      For more information about these options, see Configuring the VPN Tunnels for Your VPN Connection.

    It may take a few minutes to create the VPN connection. When it’s ready, select the connection and choose Download Configuration.

  3. In the Download Configuration dialog box, select the vendor, platform, and software that corresponds to your customer gateway device or software, and then choose Yes, Download.
  4. Give the configuration file to your network administrator, along with this guide:Amazon VPC Network Administrator Guide. After the network administrator configures the customer gateway, the VPN connection is operational.

To create a VPN connection using the command line or API

Editing Static Routes for a VPN Connection

For static routing, you can add, modify, or remove the static routes for your VPN configuration.

To add, modify, or remove a static route

  1. Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.
  2. In the navigation pane, choose VPN Connections.
  3. Choose Static Routes, Edit.
  4. Modify your existing static IP prefixes, or choose Remove to delete them. Choose Add Another Rule to add a new IP prefix to your configuration. When you are done, choose Save.

Note

If you have not enabled route propagation for your route table, you must manually update the routes in your route table to reflect the updated static IP prefixes in your VPN connection. For more information, see Enable Route Propagation in Your Route Table.

To add a static route using the command line or API

To delete a static route using the command line or API

Replacing Compromised Credentials

If you believe that the tunnel credentials for your VPN connection have been compromised, you can change the IKE pre-shared key. To do so, delete the VPN connection, create a new one using the same virtual private gateway, and configure the new keys on your customer gateway. You can specify your own pre-shared keys when you create the VPN connection. You also need to confirm that the tunnel’s inside and outside addresses match, because these might change when you recreate the VPN connection. While you perform the procedure, communication with your instances in the VPC stops, but the instances continue to run uninterrupted. After the network administrator implements the new configuration information, your VPN connection uses the new credentials, and the network connection to your instances in the VPC resumes.

Important

This procedure requires assistance from your network administrator group.

To change the IKE pre-shared key

  1. Delete the VPN connection. For more information, see Deleting a VPN Connection. You don’t need to delete the VPC or the virtual private gateway.
  2. Create a new VPN connection and specify your own pre-shared keys for the tunnels or let AWS generate new pre-shared keys for you. For more information, see Create a VPN Connection and Configure the Customer Gateway.
  3. Download the new configuration file.

 

Source: http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Scenario4.html

Scenario 4: VPC with a Private Subnet Only and AWS Managed VPN Access

The configuration for this scenario includes a virtual private cloud (VPC) with a single private subnet, and a virtual private gateway to enable communication with your own network over an IPsec VPN tunnel. There is no Internet gateway to enable communication over the Internet. We recommend this scenario if you want to extend your network into the cloud using Amazon’s infrastructure without exposing your network to the Internet.

This topic assumes that you’ll use the VPC wizard in the Amazon VPC console to create the VPC and the VPN connection.

This scenario can also be optionally configured for IPv6—you can use the VPC wizard to create a VPC and subnet with associated IPv6 CIDR blocks. Instances launched into the subnet can receive IPv6 addresses. Currently, we do not support IPv6 communication over a VPN connection; however, instances in the VPC can communicate with each other via IPv6. For more information about IPv4 and IPv6 addressing, see IP Addressing in Your VPC.

Topics

Overview

The following diagram shows the key components of the configuration for this scenario.

<br /> Diagram for scenario 4: VPC with only a virtual private gateway<br />

Important

For this scenario, the Amazon VPC Network Administrator Guide describes what your network administrator needs to do to configure the Amazon VPC customer gateway on your side of the VPN connection.

The configuration for this scenario includes the following:

  • A virtual private cloud (VPC) with a size /16 CIDR (example: 10.0.0.0/16). This provides 65,536 private IP addresses.
  • A VPN-only subnet with a size /24 CIDR (example: 10.0.0.0/24). This provides 256 private IP addresses.
  • A VPN connection between your VPC and your network. The VPN connection consists of a virtual private gateway located on the Amazon side of the VPN connection and a customer gateway located on your side of the VPN connection.
  • Instances with private IP addresses in the subnet range (examples: 10.0.0.5, 10.0.0.6, and 10.0.0.7), which enables the instances to communicate with each other and other instances in the VPC.
  • A custom route table associated with the subnet. The route table contains a route that enables instances in the subnet to communicate with other instances in the VPC, and a route that enables instances in the subnet to communicate directly with your network.

For more information about subnets, see VPCs and Subnets and IP Addressing in Your VPC. For more information about your VPN connection, see AWS Managed VPN Connections. For more information about configuring a customer gateway, see the Amazon VPC Network Administrator Guide.

Overview for IPv6

You can optionally enable IPv6 for this scenario. In addition to the components listed above, the configuration includes the following:

  • A size /56 IPv6 CIDR block associated with the VPC (example: 2001:db8:1234:1a00::/56). AWS automatically assigns the CIDR; you cannot choose the range yourself.
  • A size /64 IPv6 CIDR block associated with the VPN-only subnet (example: 2001:db8:1234:1a00::/64). You can choose the range for your subnet from the range allocated to the VPC. You cannot choose the size of the IPv6 CIDR.
  • IPv6 addresses assigned to the instances from the subnet range (example: 2001:db8:1234:1a00::1a).
  • A route table entry in the custom route table that enable instances in the private subnet to use IPv6 to communicate with each other.
<br /> IPv6-enabled VPC with a VPN-only subnet<br />

Routing

Your VPC has an implied router (shown in the configuration diagram for this scenario). In this scenario, the VPC wizard creates a route table that routes all traffic destined for an address outside the VPC to the VPN connection, and associates the route table with the subnet.

The following describes the route table for this scenario. The first entry is the default entry for local routing in the VPC; this entry enables the instances in this VPC to communicate with each other. The second entry routes all other subnet traffic to the virtual private gateway (for example, vgw-1a2b3c4d).

Destination Target
10.0.0.0/16 local
0.0.0.0/0 vgw-id

The VPN connection is configured either as a statically-routed VPN connection or as a dynamically routed VPN connection (using BGP). If you select static routing, you’ll be prompted to manually enter the IP prefix for your network when you create the VPN connection. If you select dynamic routing, the IP prefix is advertised automatically to your VPC through BGP.

The instances in your VPC can’t reach the Internet directly; any Internet-bound traffic must first traverse the virtual private gateway to your network, where the traffic is then subject to your firewall and corporate security policies. If the instances send any AWS-bound traffic (for example, requests to Amazon S3 or Amazon EC2), the requests must go over the virtual private gateway to your network and then to the Internet before reaching AWS. Currently, we do not support IPv6 for VPN connections.

Routing for IPv6

If you associate an IPv6 CIDR block with your VPC and subnets, your route table includes separate routes for IPv6 traffic. The following describes the custom route table for this scenario. The second entry is the default route that’s automatically added for local routing in the VPC over IPv6.

Destination Target
10.0.0.0/16 local
2001:db8:1234:1a00::/56 local
0.0.0.0/0 vgw-id

Security

AWS provides two features that you can use to increase security in your VPC: security groups and network ACLs. Security groups control inbound and outbound traffic for your instances, and network ACLs control inbound and outbound traffic for your subnets. In most cases, security groups can meet your needs; however, you can also use network ACLs if you want an additional layer of security for your VPC. For more information, see Security.

For scenario 4, you’ll use the default security group for your VPC but not a network ACL. If you’d like to use a network ACL, see Recommended Rules for Scenario 4.

Your VPC comes with a default security group whose initial settings deny all inbound traffic, allow all outbound traffic, and allow all traffic between the instances assigned to the security group. For this scenario, we recommend that you add inbound rules to the default security group to allow SSH traffic (Linux) and Remote Desktop traffic (Windows) from your network.

Important

The default security group automatically allows assigned instances to communicate with each other, so you don’t have to add a rule to allow this. If you use a different security group, you must add a rule to allow this.

The following table describes the inbound rules that you should add to the default security group for your VPC.

Default Security Group: Recommended Rules

Inbound
Source Protocol Port Range Comments
Private IPv4 address range of your network TCP 22 (Linux instances) Allow inbound SSH traffic from your network.
Private IPv4 address range of your network TCP 3389 (Windows instances) Allow inbound RDP traffic from your network.

Security for IPv6

If you associate an IPv6 CIDR block with your VPC and subnets, you must add separate rules to your security group to control inbound and outbound IPv6 traffic for your instances. In this scenario, the database servers cannot be reached over the VPN connection using IPv6; therefore, no additional security group rules are required.

Implementing Scenario 4

To implement scenario 4, get information about your customer gateway, and create the VPC using the VPC wizard, The VPC wizard creates a VPN connection for you with a customer gateway and virtual private gateway.

To prepare your customer gateway

  1. Determine the device you’ll use as your customer gateway. For information about the devices that we’ve tested, see Amazon Virtual Private Cloud FAQs. For more information about the requirements for your customer gateway, see the Amazon VPC Network Administrator Guide.
  2. Obtain the Internet-routable IP address for the customer gateway’s external interface. The address must be static and may be behind a device performing network address translation (NAT).
  3. If you want to create a statically-routed VPN connection, get the list of internal IP ranges (in CIDR notation) that should be advertised across the VPN connection to the virtual private gateway. For more information, see VPN Routing Options.

Use the VPC wizard to create your VPC and a VPN connection.

To create a VPC using the VPC wizard

  1. Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.
  2. On the dashboard, choose Start VPC Wizard.
  3. Select the fourth option, VPC with a Private Subnet Only and Hardware VPN Access, and then choose Select.
  4. On the first page of the wizard, confirm the details for your VPC and private subnet. Naming your VPC and subnet helps you identify them later in the console.
  5. (Optional, IPv6-only) For IPv6 CIDR block, choose Amazon-provided IPv6 CIDR block. For Private subnet’s IPv6 CIDR, choose Specify a custom IPv6 CIDR. Specify the hexadecimal pair value for the IPv6 subnet or leave the default value (00).
  6. Choose Next.
  7. On the Configure your VPN page, do the following, and then choose Create VPC:
    • In Customer Gateway IP, specify the public IP address of your VPN router.
    • Optionally specify a name for your customer gateway and VPN connection.
    • In Routing Type, select one of the routing options as follows:
      • If your VPN router supports Border Gateway Protocol (BGP), select Dynamic (requires BGP).
      • If your VPN router does not support BGP, choose Static. In IP Prefix, add each IP range for your network in CIDR notation.

      For more information, see VPN Routing Options.

  8. When the wizard is done, choose VPN Connections in the navigation pane. Select the VPN connection that the wizard created, and choose Download Configuration. In the dialog box, select the vendor for the customer gateway, the platform, and the software version, and then choose Yes, Download.
  9. Save the text file containing the VPN configuration and give it to the network administrator along with this guide: Amazon VPC Network Administrator Guide. The VPN won’t work until the network administrator configures the customer gateway.

For this scenario, you need to update the default security group with new inbound rules that allow SSH and Remote Desktop (RDP) access from your network. If you don’t want instances to initiate outbound communication, you can also remove the default outbound rule.

To update the rules for the default security group

  1. Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.
  2. Choose Security Groups in the navigation pane, and then select the default security group for the VPC. The details pane displays the details for the security group, plus tabs for working with its inbound and outbound rules.
  3. On the Inbound Rules tab, choose Edit and add rules for inbound traffic as follows:
    1. Select SSH from the Type list, and enter your network’s private IP address range in the Source field; for example, 172.0.0.0/8.
    2. Choose Add another rule, then select RDP from the Type list, and enter your network’s private IP address range in the Source field.
    3. Choose Save.
  4. (Optional) On the Outbound Rules tab, choose Edit, locate the default rule that enables all outbound traffic, choose Remove, and then choose Save.

After your network administrator configures your customer gateway, you can launch instances into your VPC. If you’re already familiar with launching instances outside a VPC, then you already know most of what you need to know to launch an instance into a VPC.

To launch an instance

  1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.
  2. Choose Launch Instance on the dashboard.
  3. Follow the directions in the wizard. Choose an AMI, choose an instance type, and then choose Next: Configure Instance Details.

    Note

    If you intend to use your instance for IPv6 communication, you must choose a supported instance type; for example, T2. For more information, see Amazon EC2 Instance Types.

  4. On the Configure Instance Details page, select the VPC that you created earlier from the Network list, and then select the subnet. Choose Next: Add Storage.
  5. On the next two pages of the wizard, you can configure storage for your instance, and add tags. On the Configure Security Group page, select the Select an existing security group option, and select the default security group. Choose Review and Launch.
  6. Review the settings that you’ve chosen. Make any changes that you need, and then choose Launch to choose a keypair and launch your instance.

In scenario 4, you need a DNS server that enables your VPN-only subnet to communicate with servers in your network. You must create a new set of DHCP options that includes your DNS server and then configure the VPC to use that set of options.

Note

Your VPC automatically has a set of DHCP options with domain-name-servers=AmazonProvidedDNS. This is a DNS server that Amazon provides to enable any public subnets in your VPC to communicate with the Internet over an Internet gateway. Scenario 4 doesn’t have any public subnets, so you don’t need this set of DHCP options.

To update the DHCP options

  1. Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.
  2. In the navigation pane, choose DHCP Options Sets.
  3. Choose Create DHCP Options Set.
  4. In the Create DHCP Options Set dialog box, in the Domain name servers box, enter the address of your DNS server, and then choose Yes, Create. In this example, your DNS server is 192.0.2.1.
  5. In the navigation pane, choose Your VPCs.
  6. Select the VPC, and then choose Edit in the Summary tab.
  7. Select the ID of the new set of options from the DHCP options set list and then choose Save.
  8. (Optional) The VPC now uses this new set of DHCP options and therefore uses your DNS server. If you want, you can delete the original set of options that the VPC used.

You can now use SSH or RDP to connect to your instance in the VPC. For information about how to connect to a Linux instance, see Connect to Your Linux Instance in the Amazon EC2 User Guide for Linux Instances. For information about how to connect to a Windows instance, see Connect to Your Windows Instance in the Amazon EC2 User Guide for Windows Instances.

AWS Command Interface Setup

by Posted in 4. Others 2 Comments

Installing the AWS Command Line Interface

The primary distribution method for the AWS CLI on Linux, Windows, and macOS is pip, a package manager for Python that provides an easy way to install, upgrade, and remove Python packages and their dependencies.

Current AWS CLI Version

The AWS CLI is updated frequently with support for new services and commands. To see if you have the latest version, see the releases page on GitHub.

Requirements

  • Python 2 version 2.6.5+ or Python 3 version 3.3+
  • Windows, Linux, macOS, or Unix

Note

Older versions of Python may not work with all AWS services. If you seeInsecurePlatformWarning or deprecation notices when you install or use the AWS CLI, update to a recent version.

If you already have pip and a supported version of Python, you can install the AWS CLI with the following command:

$ pip install awscli --upgrade --user

The --upgrade option tells pip to upgrade any requirements that are already installed. The --user option tells pip to install the program to a subdirectory of your user directory to avoid modifying libraries used by your operating system.

If you encounter issues when you attempt to install the AWS CLI with pip, you can install the AWS CLI in a virtual environment to isolate the tool and its dependencies, or use a different version of Python than you normally do.

Standalone Installers

For offline or automated installations on Linux, macOS, or Unix, try the bundled installer. The bundled installer includes the AWS CLI, its dependencies, and a shell script that performs the installation for you.

On Windows, you can also use the MSI installer. Both of these methods simplify the initial installation, with the tradeoff of being more difficult to upgrade when a new version of the AWS CLI is released.

After you install the AWS CLI, you may need to add the path to the executable file to your PATH variable. For platform specific instructions, see the following topics:

Verify that the AWS CLI installed correctly by running aws --version.

$ aws --version
aws-cli/1.11.84 Python/3.6.2 Linux/4.4.0-59-generic botocore/1.5.47

The AWS CLI is updated regularly to add support for new services and commands. To update to the latest version of the AWS CLI, run the installation command again.

$ pip install awscli --upgrade --user

If you need to uninstall the AWS CLI, use pip uninstall.

$ pip uninstall awscli

If you don’t have Python and pip, use the procedure for your operating system:

Sections

Configuring the AWS CLI

This section explains how to configure settings that the AWS Command Line Interface uses when interacting with AWS, such as your security credentials and the default region.

Note

The AWS CLI signs requests on your behalf, and includes a date in the signature. Ensure that your computer’s date and time are set correctly; if not, the date in the signature may not match the date of the request, and AWS rejects the request.

Sections

Quick Configuration

For general use, the aws configure command is the fastest way to set up your AWS CLI installation.

$ aws configure
AWS Access Key ID [None]: AKIAIOSFODNN7EXAMPLE
AWS Secret Access Key [None]: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
Default region name [None]: us-west-2
Default output format [None]: json

The AWS CLI will prompt you for four pieces of information. AWS Access Key ID and AWS Secret Access Key are your account credentials.

To get the access key ID and secret access key for an IAM user

Access keys consist of an access key ID and secret access key, which are used to sign programmatic requests that you make to AWS. If you don’t have access keys, you can create them from the AWS Management Console. We recommend that you use IAM access keys instead of AWS account root user access keys. IAM lets you securely control access to AWS services and resources in your AWS account.

The only time that you can view or download the secret access keys is when you create the keys. You cannot recover them later. However, you can create new access keys at any time. You must also have permissions to perform the required IAM actions. For more information, see Delegating Permissions to Administer IAM Users, Groups, and Credentials in the IAM User Guide.

  1. Open the IAM console.
  2. In the navigation pane of the console, choose Users.
  3. Choose your IAM user name (not the check box).
  4. Choose the Security credentials tab and then choose Create access key.
  5. To see the new access key, choose Show. Your credentials will look something like this:
    • Access key ID: AKIAIOSFODNN7EXAMPLE
    • Secret access key: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
  6. To download the key pair, choose Download .csv file. Store the keys in a secure location.Keep the keys confidential in order to protect your account, and never email them. Do not share them outside your organization, even if an inquiry appears to come from AWS or Amazon.com. No one who legitimately represents Amazon will ever ask you for your secret key.

Related topics

Default region is the name of the region you want to make calls against by default. This is usually the region closest to you, but it can be any region. For example, type us-west-2 to use US West (Oregon).

Note

You must specify an AWS region when using the AWS CLI. For a list of services and available regions, see Regions and Endpoints. The region designators used by the AWS CLI are the same names that you see in AWS Management Console URLs and service endpoints.

Default output format can be either json, text, or table. If you don’t specify an output format, json is used.

If you have multiple profiles, you can configure additional, named profiles by using the --profile option.

$ aws configure --profile user2
AWS Access Key ID [None]: AKIAI44QH8DHBEXAMPLE
AWS Secret Access Key [None]: je7MtGbClwBF/2Zp9Utk/h3yCo8nvbEXAMPLEKEY
Default region name [None]: us-east-1
Default output format [None]: text

To update any of your settings, simply run aws configure again and enter new values as appropriate. The next sections contain more information on the files that aws configure creates, additional settings, and named profiles.

Configuration Settings and Precedence

The AWS CLI uses a provider chain to look for AWS credentials in a number of different places, including system or user environment variables and local AWS configuration files.

The AWS CLI looks for credentials and configuration settings in the following order:

  1. Command line options – region, output format and profile can be specified as command options to override default settings.
  2. Environment variables – AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_SESSION_TOKEN.
  3. The AWS credentials file – located at ~/.aws/credentials on Linux, macOS, or Unix, or at C:UsersUSERNAME .awscredentials on Windows. This file can contain multiple named profiles in addition to a default profile.
  4. The CLI configuration file – typically located at ~/.aws/config on Linux, macOS, or Unix, or at C:UsersUSERNAME .awsconfig on Windows. This file can contain a default profile, named profiles, and CLI specific configuration parameters for each.
  5. Container credentials – provided by Amazon EC2 Container Service on container instances when you assign a role to your task.
  6. Instance profile credentials – these credentials can be used on EC2 instances with an assigned instance role, and are delivered through the Amazon EC2 metadata service.

Tips on using Microsoft Azure

by Posted in 4. Others Leave a comment

Tips 1. How to find password of wordpress logon

  • The default user account of wordpress in Azure is ‘user’.
  • The application password is randomly generated during the first boot. This password can be viewed as follows:

In the “Support + Troubleshooting” menu, select the “Boot diagnostics” option.Application credentials

Review the system log until you find the application password.

Application credentials

IMPORTANT: This password is only shown the first time you start the image. Please save your password in a safe place. We also recommend changing it in your application to a different value.

Tips 1. How to Setup Nested Virtualization in Azure

Deploy Azure VM

To setup Nested Virtualization inside an Azure Virtual Machine, you first need to create a new Virtual Machines using one of the new instance sizes like Ev3 or Dv3 and Windows Server 2016.I also recommend to install all the latest Windows Server patches to the system.

Optional: Optimize Azure VM Storage

This step is optional, but if you want to better performance and more storage for your Nested Virtual Machines to run on, this makes sense.

Azure VM Data Disks

In my case I attached 2 additional data disks to the Azure VM. Of course you can choose more or different sizes. Now you can see 2 new data disk inside your Azure Virtual Machine. Do not format them, because we gonna create a new storage spaces pool and a simple virtual disk, so we get the performance form both disks at the same time. In the past this was called disk striping.

Azure VM Storage Spaces

With that you can create a new Storage Spaces Storage Pool and a new Virtual Disk inside the VM using the storage layout “Simple” which basically configures it as striping.

Azure VM Storage Spaces PowerShell

I also formatted the disk and set the drive letter to V:, this will be the volume where I will place my nested virtual machines.

Install Hyper-V inside the Azure VM

Install Hyper-V on Windows Server using PowerShell

The next step would be to install the Hyper-V role in your Azure Virtual Machine. You can use PowerShell to do this since this is a regular Windows Server 2016.This command will install Hyper-V and restart the virtual machine.

Azure VM Hyper-V

After the installation you have Hyper-V installed and enabled inside your Azure Virtual Machine, now you need to configure the networking for the Hyper-V virtual machines. For this we will use NAT networking.

Configure Networking for the Nested Environment

Hyper-V NAT Network inside Azure VM

To allow the nested virtual machine to access the internet, we need to setup Hyper-V networking in the right why. For this we use the Hyper-V internal VM Switch and NAT networking. I described this here: Set up a Hyper-V Virtual Switch using a NAT Network

Create a new Hyper-V Virtual Switch

First create a internal Hyper-V VM Switch

Configure the NAT Gateway IP Address

The Internal Hyper-V VM Switch creates a virtual network adapter on the host (Azure Virtual Machine), this network adapter will be used for the NAT Gateway. Configure the NAT gateway IP Address using New-NetIPAddress cmdlet.

Configure the NAT rule

After that you have finally created your NAT network and you can now use that network to connect your virtual machines and use IP Address from 172.21.21.2-172.21.21.254.

Now you can use these IP Addresses to assign this to the nested virtual machines. You can also setup a DHCP server in one of the nested VMs to assign IP addresses automatically to new VMs.

Optional: Create NAT forwards inside Nested Virtual Machines

To forward specific ports from the Host to the guest VMs you can use the following commands.

This example creates a mapping between port 80 of the host to port 80 of a Virtual Machine with an IP address of 172.21.21.2.

This example creates a mapping between port 82 of the Virtual Machine host to port 80 of a Virtual Machine with an IP address of 172.21.21.3.

Optional: Configure default Virtual Machine path

Since I have created an extra volume for my nested virtual machines, I configure this as the default path for Virtual Machines and Virtual Hard Disks.

Create Nested Virtual Machines inside the Azure VM

Azure Nested Virtualization

Now you can basically start to create Virtual Machines inside the Azure VM. You can for example use an existing VHD/VHDX or create a new VM using an ISO file as you would do on a hardware Hyper-V host.

Some crazy stuff to do

There is a lot more you could do, not all of it makes sense for everyone, but it could help in some cases.

  • Running Azure Stack Development Kit – Yes Microsoft released the Azure Stack Development Kit, you could use a large enough Azure virtual machine and run it in there.
  • Configure Hyper-V Replica and replicate Hyper-V VMs to your Azure VM running Hyper-V.
  • Nested a Nested Virtual Machine in a Azure VM – You could enable nesting on a VM running inside the Azure VM so you could do a VM inside a VM inside a VM. Just follow my blog post to created a nested Virtual Machine: Nested Virtualization in Windows Server 2016 and Windows 10

In my opinion Nested Virtualization is mostly help full if you run Hyper-V Containers, but it also works great, if you want to run some Virtual Machines inside a Azure VM, for example to run a lab or test something.

info source: https://www.thomasmaurer.ch/2017/07/how-to-setup-nested-virtualization-in-microsoft-azure/

Procedure to migration Exchange Server Email to Office365

by Posted in 4. Others 2 Comments

The main steps you perform for a cutover migration are shown in the following illustration.

Process for performing a cutover email migration to Office 365

  1. The administrator communicates upcoming changes to users and verifies domain ownership with the domain registrar.
  2. The administrator prepares the servers for a cutover migration and creates empty mail-enabled security groups in Office 365.
  3. The administrator connects Office 365 to the on-premises email system (this is called creating a migration endpoint).
  4. The administrator migrates the mailboxes and then verifies the migration.
  5. Grant Office 365 licences to your users.
  6. The administrator configures the domain to begin routing email directly to Office 365.
  7. The administrator verifies that routing has changed, and then deletes the cutover migration batch.
  8. The administrator completes post-migration tasks in Office 365 (assigns licenses to users and creates an Autodiscover Domain Name System (DNS) record), and optionally decommissions the on-premises Exchange servers.

  9. The administrator sends a welcome letter to users to tell them about Office 365 and to describe how to sign in to their new mailboxes.

Preparation for Microsoft Azure Solution Exam 70-532

by Posted in 4. Others Leave a comment

Exam Target Audience

One of the recent hot IT topic is cloud technology. Microsoft and Amaze are two most active providers for cloud service. Microsoft’s Azure solution is very popular now. Learning Azure and obtain its cert will be very useful. The 70-532 Developing Microsoft Azure Solutions exam is targeted towards a Developer candidate. Candidates who are experienced in designing, programming, implementing, automating, and monitoring Microsoft Azure solutions. Candidates are also proficient with development tools, techniques, and approaches used to build scalable and resilient solutions.If you’re an experienced .NET developer, then you’ll likely have an easier time preparing for this exam. As a result, the exam will assume you are proficient with development tools, techniques and have experience developing scalable and resilient solutions.

Skills Measured

Here’s a high level break down of the exam objectives:

  • Design and implement websites (15-20%)
  • Create and manage virtual machines (20-25%)
  • Design and implement cloud services (20-25%)
  • Design and implement a storage strategy (20-25%)
  • Manage application and network services (15-20%)

Note: The percentage next to each is the approximate break out of how much of the exam focuses on each objective area. As you can see it’s pretty evenly distributed across the 5 areas.

The full exam objectives are listed on the official page for the 70-532 Developing Microsoft Azure Solutions exam.

Free Video Courses / Training

There are many video training courses available for the 70-532 Developing Microsoft Azure Solutions exam. The courses top on my list are over at the Microsoft Virtual Academy (MVA), but there are many more. Here’s a list of video courses I used while studying for this exam with the approximate length of the training courses.

Another video training option that’s not Free, but there is a Free Trial available is Opsgility on-demand Azure training.

Books

There are a number of books on Microsoft Azure. The one geared towards studying for the exam is the “Exam Ref 70-532 Developing Microsoft Azure Solutions” from Microsoft Press. This book is an excellent study resource to accompany all the other materials, as it’s condensed to cover the exam objectives list.

Note: Do NOT rely to heavily on any single study resources, even books.

Here a list of some Free eBooks available for download:

Documentation

The documentation for Azure is an excellent study resource too! It’s been built out pretty heavily and even accepts contributions from the community via GitHub. I really encourage you to browse around the documentation and read, read, read in addition to all of your other study efforts.

Practice Tests

The typical practice test vendors do not currently offer any practice exams for the 70-532 Developing Microsoft Azure Solutions exam. Due to this fact, I actually developed some of my own practice test questions to help me prepare for the exam, and I put them up free for anyone to use!

Take the practice tests: Developing Microsoft Azure Solutions (70-532) Practice Test

While the list of questions I put together is not an exhaustive list, this offers yet another tool you can use to help prepare for the exam. Please don’t complain about the quality or the extensiveness of the questions. It takes a lot of time to write test questions! Also, I put these up on GitHub so feel free to browse the source code, fork it or whatever.

Play Time

It’s fine to get “book smart”, but there certainly is no substitute for just getting in there, playing around and practicing. Something Microsoft offers to encourage this is a Free Trial with $200 to spend on all Azure Services. So go dig in and experiment with how this stuff all works, and get some real world experience that will help you pass the exam. This is not just useful if you’re new to Azure. It’s also very useful if you’ve already been developing on Azure but just haven’t done much with certain features yet. Additionally, if you have an MSDN Subscription, then you already have some free monthly credits to use Azure available to you too.

Exam Study Tips

Here’s a few tips of techniques I use when studying and preparing for certification exams:

  • Make sure to go through each exam objective category and study until you’re comfortable with that topic.
  • Use at minimum 3 study resources on each topic. The variety and repetition will help you retain everything.
  • Play with stuff. “Book smarts” are good, but practical hands-on experience is better.
  • Make flash cards and/or practice test questions to help memorizing the stuff that can be memorized.
  • Don’t be afraid to fail an exam. You will learn what areas you need to focus on better and can always take it again.
  • Give yourself a deadline. Once you’re in a comfortable study pace, estimate when you’ll be ready for the exam and schedule it.
  • Get your family on board to support you spending a significant amount of time outside of work to study.
  • Choose the online proctored exam option when scheduling the exam. This way you can take the exam in a less stressful environment that is the comfort of your own home.

By using the above info, hope I can pass the exam and earn your Azure certification !

info source: http://pietschsoft.com/post/2015/06/06/How-I-passed-the-70-532-Developing-Microsoft-Azure-Solutions-certification-exam

Diary of IT Man – Got a MCSA Windows Server 2016 Certification

by Posted in 4. Others 1 Comment

Cheers that I got a MCSA Windows Server 2016 certification which I passed the exam in one take yesterday. I just needed to take one Microsoft exam # 70-743 to upgrade my MCITP window server 2008 to MCSA. If anyone want to get info to pass the 70-743, feel free to contact me. Moreover, I have a spare Microsoft exam coupon which will be expired in end of Sept 2017; I can sell it to you in great discount, feel free to contact me.

Although I knew this cert did not have any benefit to my career path, it was just the responsibility of IT guy to update his knowledge as well as academic qualification. IT field updates very fast, and it is very hard for to trace the technology. Let’s keep on learning…

Agile的Scrum項目管理

by Posted in 4. Others Leave a comment

十年前開始流行的的Project Management Professional (PMP) 和 PRINCE2 項目管理認證，現時有新的競爭者叫 Certified Scrum Master (CSM)認證，現已開始越來越多人留意了。

Scrum是一種新的項目管理的架構，通常為Agile (敏捷)方式的開發工具，而且通常用於軟件開發項目上。Agile/Scrum能夠處理複雜問題，將它們分拆，及優先考慮到單獨的任務中，然後將這些任務委託給最適合解決每個任務的專門團隊成員，所以它被認為較有效率。

以下是兩編bloger文章，很好地介紹Agile/Scrum的應用，值得參考：
Scrum 是什麼（1）：雙重回饋機制 –> http://teddy-chen-tw.blogspot.hk/2011/12/scrum-1.html
Scrum 是什麼（2）：Scrum 的內涵 –> http://teddy-chen-tw.blogspot.hk/2011/12/scrum-2.html

Agenda of FDA Inspection

by Posted in 4. Others Leave a comment

FDA-logoRecently, FDA conducted audit to my company. FDA is known as Food and Drug Administration whereas US has FDA organization and China also has CFDA organization. Its official web site is https://www.fda.gov.

I would like to post their 3 days inspection agenda for your reference. To pass FDA audit is essential for export medical product; let’s well prepare for it.

Day 1
·         Introduction
·         Opening meeting.
·         Introduction/Presentation
·         Plant Overview (Warehouse, Manufacturing and Quality control areas).
·         Tour on facilities.
Lunch
·         Quality Manual.
·         Company Organization Chart.
·         Document Control / Records.
·         Change Control of Documents
·         Human Resources (job description, hiring, training).
·         Quality System Management Review.
Day 2
·         Daily wrap up.
·         Environment Control (Clean rooms, ESD and other applicable).
·         Design Control / History File.
·         Risk Management.
·         Device Master Record (DMR).
·         Change Control of Projects.
Lunch
·         CAPA.
·         Complaint Handling.
·         Field Actions / Recall.
·         Incoming Inspections.
·         Purchasing / Incoming Goods/Warehouse Activities.
Day 3
·         Daily wrap up.
·         Device History Record (DHR).
·         Internal Audits.
·         Validation Activities.
·         Non Conforming Product.
Lunch
·         Quality control (in process and final inspections).
·         Packaging / labeling.
·         Handling / Distribution/ Shipping.
·         Final Release.
·         Identification and Traceability.
Day 4
·         Daily wrap up.
·         Calibration / Maintenance program.
·         Field service/Technical assistance.
·         Decontamination / Returned Products.
Lunch
·         Housekeeping (Cleaning, pest control, building maintenance).
·         Statistical Techniques.
·         Pending Points.
·         Inspector’s findings Discussion.
·         Closing meeting.