With the new release of the Windows Azure platform there are a lot of new features available. In my previous post I introduced a little bit about one of them, the remote desktop access to azure virtual machine. Now I would like to talk about another cool stuff – Windows Azure Connect.

 

What’s Windows Azure Connect

I would like to quote the definition of the Windows Azure Connect in MSDN

With Windows Azure Connect, you can use a simple user interface to configure IP-sec protected connections between computers or virtual machines (VMs) in your organization’s network, and roles running in Windows Azure. IP-sec protects communications over Internet Protocol (IP) networks through the use of cryptographic security services.

There’s an image available at the MSDN as well that I would like to forward here

As we can see, using the Windows Azure Connect the Worker Role 1 and Web Role 1 are connected with the development machines and database servers which some of them are inside the organization some are not.

With the Windows Azure Connect, the roles deployed on the cloud could consume the resource which located inside our Intranet or anywhere in the world. That means the roles can connect to the local database, access the local shared resource such as share files, folders and printers, etc.

 

Difference between Windows Azure Connect and AppFabric

It seems that the Windows Azure Connect are duplicated with the Windows Azure AppFabric. Both of them are aiming to solve the problem on how to communication between the resource in the cloud and inside the local network. The table below lists the differences in my understanding.

Category	Windows Azure Connect	Windows Azure AppFabric
Purpose	An IP-sec connection between the local machines and azure roles.	An application service running on the cloud.
Connectivity	IP-sec, Domain-joint	Net Tcp, Http, Https
Components	Windows Azure Connect Driver	Service Bus, Access Control, Caching
Usage	Azure roles connect to local database server Azure roles use local shared files,  folders and printers, etc. Azure roles join the local AD.	Expose the local service to Internet. Move the authorization process to the cloud. Integrate with existing identities such as Live ID, Google ID, etc. with existing local services. Utilize the distributed cache.

 

And also some scenarios on which of them should be used.

Scenario	Connect	AppFabric
I have a service deployed in the Intranet and I want the people can use it from the Internet.		Y
I have a website deployed on Azure and need to use a database which deployed inside the company. And I don’t want to expose the database to the Internet.	Y
I have a service deployed in the Intranet and is using AD authorization. I have a website deployed on Azure which needs to use this service.	Y
I have a service deployed in the Intranet and some people on the Internet can use it but need to be authorized and authenticated.		Y
I have a service in Intranet, and a website deployed on Azure. This service can be used from Internet and that website should be able to use it as well by AD authorization for more functionalities.	Y	Y

 

How to Enable Windows Azure Connect

OK we talked a lot information about the Windows Azure Connect and differences with the Windows Azure AppFabric. Now let’s see how to enable and use the Windows Azure Connect. First of all, since this feature is in CTP stage we should apply before use it. On the Windows Azure Portal we can see our CTP features status under Home, Beta Program page.

You can send the apply to join the Beta Programs to Microsoft in this page. After a few days the Microsoft will send an email to you (the email of your Live ID) when it’s available.

In my case we can see that the Windows Azure Connect had been activated by Microsoft and then we can click the Connect button on top, or we can click the Virtual Network item from the left navigation bar.

 

The first thing we need, if it’s our first time to enter the Connect page, is to enable the Windows Azure Connect.

After that we can see our Windows Azure Connect information in this page.

 

Add a Local Machine to Azure Connect

As we explained below the Windows Azure Connect can make an IP-sec connection between the local machines and azure role instances. So that we firstly add a local machine into our Azure Connect. To do this we will click the Install Local Endpoint button on top and then the portal will give us an URL. Copy this URL to the machine we want to add and it will download the software to us.

This software will be installed in the local machines which we want to join the Connect. After installed there will be a tray-icon appeared to indicate this machine had been joint our Connect.

The local application will be refreshed to the Windows Azure Platform every 5 minutes but we can click the Refresh button to let it retrieve the latest status at once. Currently my local machine is ready for connect and we can see my machine in the Windows Azure Portal if we switched back to the portal and selected back Activated Endpoints node.

 

Add a Windows Azure Role to Azure Connect

Let’s create a very simple azure project with a basic ASP.NET web role inside. To make it available on Windows Azure Connect we will open the azure project property of this role from the solution explorer in the Visual Studio, and select the Virtual Network tab, check the Activate Windows Azure Connect.

The next step is to get the activation token from the Windows Azure Portal. In the same page there is a button named Get Activation Token. Click this button then the portal will display the token to me.

We copied this token and pasted to the box in the Visual Studio tab.

Then we deployed this application to azure. After completed the deployment we can see the role instance was listed in the Windows Azure Portal - Virtual Connect section.

 

Establish the Connect Group

The final task is to create a connect group which contains the machines and role instances need to be connected each other. This can be done in the portal very easy.

The machines and instances will NOT be connected until we created the group for them. The machines and instances can be used in one or more groups.

In the Virtual Connect section click the Groups and Roles node from the left side navigation bar and clicked the Create Group button on top. This will bring up a dialog to us. What we need to do is to specify a group name, description; and then we need to select the local computers and azure role instances into this group.

After the Azure Fabric updated the group setting we can see the groups and the endpoints in the page.

And if we switch back to the local machine we can see that the tray-icon have been changed and the status turned connected.

The Windows Azure Connect will update the group information every 5 minutes. If you find the status was still in Disconnected please right-click the tray-icon and select the Refresh menu to retrieve the latest group policy to make it connected.

 

Test the Azure Connect between the Local Machine and the Azure Role Instance

Now our local machine and azure role instance had been connected. This means each of them can communication to others in IP level. For example we can open the SQL Server port so that our azure role can connect to it by using the machine name or the IP address.

The Windows Azure Connect uses IPv6 to connect between the local machines and role instances. You can get the IP address from the Windows Azure Portal Virtual Network section when select an endpoint.

I don’t want to take a full example for how to use the Connect but would like to have two very simple tests. The first one would be PING.

 

When a local machine and role instance are connected through the Windows Azure Connect we can PING any of them if we opened the ICMP protocol in the Filewall setting. To do this we need to run a command line before test. Open the command window on the local machine and the role instance, execute the command as following

netsh advfirewall firewall add rule name="ICMPv6" dir=in action=allow enable=yes protocol=icmpv6

Thanks to Jason Chen, Patriek van Dorp, Anton Staykov and Steve Marx, they helped me to enable  the ICMPv6 setting. For the full discussion we made please visit here.

You can use the Remote Desktop Access feature to logon the azure role instance. Please refer my previous blog post to get to know how to use the Remote Desktop Access in Windows Azure.

Then we can PING the machine or the role instance by specifying its name. Below is the screen I PING my local machine from my azure instance.

We can use the IPv6 address to PING each other as well. Like the image following I PING to my role instance from my local machine thought the IPv6 address.

 

Another example I would like to demonstrate here is folder sharing. I shared a folder in my local machine and then if we logged on the role instance we can see the folder content from the file explorer window.

 

Summary

In this blog post I introduced about another new feature – Windows Azure Connect. With this feature our local resources and role instances (virtual machines) can be connected to each other. In this way we can make our azure application using our local stuff such as database servers, printers, etc. without expose them to Internet.

 

Hope this helps,

Shaun