The content below is taken from the original (Machine Learning, Recommendation Systems, and Data Analysis at Cloud Academy), to continue reading please visit the site. Remember to respect the Author & Copyright.

The content below is taken from the original (Migrating to the cloud: A practical, how-to guide), to continue reading please visit the site. Remember to respect the Author & Copyright.

The content below is taken from the original (Azure Web Apps Gallery available only in new Azure portal), to continue reading please visit the site. Remember to respect the Author & Copyright.

The content below is taken from the original (Hybrid cloud: How you can take advantage of the best of both worlds), to continue reading please visit the site. Remember to respect the Author & Copyright.

The content below is taken from the original (Four stops on your journey to the cloud: Experiment, migrate, transform, repeat), to continue reading please visit the site. Remember to respect the Author & Copyright.

The content below is taken from the original (3 options for applications that don’t fit the cloud), to continue reading please visit the site. Remember to respect the Author & Copyright.

The content below is taken from the original (Cisco suggests network administration is fun and games), to continue reading please visit the site. Remember to respect the Author & Copyright.

The content below is taken from the original (Portal router aims to deliver us from congested WiFi), to continue reading please visit the site. Remember to respect the Author & Copyright.

What happens when former Qualcomm engineers decide to build a router of their own? You get something like Portal, an innocuous looking device that aims to speed up WiFI networks using technology never before seen in consumer routers. It supports 802.11AC WiFi, but it works on all six channels of the 5GHz spectrum, whereas today’s routers only work on two channels. That’s a big deal — it means Portal is well-suited to delivering fast WiFi in places like dense apartment buildings.

It used to be that simply hopping onto a 5Ghz network was enough to avoid the overcrowding in the 2.4GHz spectrum. But with more people upgrading their routers, even speedy 5GHz spectrum is getting filled up today.

"The fundamental problem is that as WiFi becomes more popular and applications becomes more demanding, your problem is not going to be ‘how fast does my router go?’," said Terry Ngo, CEO and co-founder of Ignition Design Labs, the company behind Portal. Instead, the real issue will become, "How does it survive in an increasingly connected environment?"

Portal uses a combination of features to deal with that dilemma. For one, it packs in nine antennas inside of its sleek, curved case, as well as 10 "advanced" radios. Ngo points out that there’s no need for giant bug-like antennas we’re seeing on consumer routers today, like Netgear’s massive Nitehawk line. (Most of those long antennas are usually just empty plastic.) The Portal is also smart enough to hop between different 5Ghz channels (check out a diagram of channels above) if it detects things are getting crowded. Most routers today pick a channel when they boot up and never move off of it.

In a brief demonstration, Ngo and his crew showed off just how capable the Portal is. While standing around 50 feet away from the router, with a few walls between us, the Portal clocked in 25 Mbps download speeds and 5 Mbps uploads, with a latency of around 3ms. In comparison, a Netgear Nitehawk router saw download speeds of 2Mbps and upload speeds of 5Mbps from the same location, with 30ms of latency.

You’d still be able to stream 4K video streams from the Portal in that spot, whereas the Netgear might even give you trouble with an HD stream, depending on how congested the reception is. Portal was also able to stream three separate 4K videos at once, and, surprisingly, they didn’t even skip when the router changed wireless channels.

One of Portal’s features is particularly surprising: radar detection. That’s necessary to let it use a part of the 5GHz spectrum typically reserved for weather systems in the US. Most devices just avoid that spectrum entirely to avoid the ire of the FCC. By implementing continuous radar detection, Portal is able to turn off access to that spectrum for the few people who live near weather radars (usually, it’s only near airports and certain coastal areas). But even if you’re locked out from that bit of spectrum, Portal still gives you three more 5Ghz channels than other consumer routers.

Just like Google’s OnHub router, which is also trying to solve our WiFi woes, Portal also relies on the cloud to optimize your network. For example, Portal will be able to know in advance if certain locations won’t have access to the 5Ghz spectrum reserved for radar. It’ll also be able to keep track of how crowded WiFi channels get in your neighborhood, and it could optimize which channels are being used at different times of the day. There’s a bit of a privacy concern there, for sure, but using the cloud also lets Ignition Design Labs bring new wireless features to Portal without the need for expensive hardware.

Portal also includes five gigabit Ethernet ports, as well as two USB ports for streaming your content. That’s a notable difference from OnHub, which limited Ethernet ports in favor of a simpler design. Ignition Design Labs has also developed a mobile app for setting up and managing Portal, but you can also log onto its setup page just like a typical router.

While new routers like the Eero and Luma are great WiFi solutions for large homes, where reception range is a bigger issue, the Portal makes more sense for people living in apartments and other dense areas. But Portal also has an extended range solution, if you need it: You can just connect two units together in a mesh network (the company claims it also does this more efficiently than Eero and Luma).

Portal is launching on Kickstarter today, with the hopes of raising $160,000 over the next 60 days. You can snag one for yourself starting at $139, but, as usual, expect the final retail price to be higher. While I’m not very confident about gadget Kickstarters these days, the fact that the Ignition Design Labs folks have many years of experience dealing with wireless hardware gives me hope for the Portal. We’ll be getting a unit to test out soon, so stay tuned for updates.

The content below is taken from the original (Designing a DMZ for Azure Virtual Machines), to continue reading please visit the site. Remember to respect the Author & Copyright.

This article will show you three designs, each building on the other, for a demilitarized zone (DMZ) or perimeter network for Internet facing n-tier applications based on Azure virtual machines and networking.

The DMZ

The concept of a DMZ or perimeter network is not new; it’s a classic design that uses a layered network security approach to minimize the attack footprint of an application.

In a simple design:

1. Web servers are placed in one VLAN, with just TCP 80 and TCP 443 accessible from the Internet.
2. Application servers are in another VLAN. Web servers can communicate with the application servers using just the application protocol. The Internet has no access to this VLAN.
3. Database servers are in a third VLAN. Application servers can communicate with the database servers using only the database communications protocol. Web servers and the Internet have no access to this VLAN.

You can modify this design in many ways, including:

• Adding additional application layer security.
• Including reverse proxies.
• Using logical implementations of multiple VLANs by using other methods of network isolation, such as network security groups (NSGs) in Azure.

The concept of a DMZ with n-tier applications (Image Credit: Aidan Finn)

So how do you recreate this concept in Azure for virtual machines? I’ll present you with three designs from Microsoft, each of which builds on the concepts of the previous ones.

Network Security Groups

The first and simplest way to build a DMZ in Azure is to use network security groups (NSGs). An NSG is a five-tuple rule that will allow or block TCP or UDP traffic between designated addresses on a virtual network.

You can deploy an n-tier solution into a single virtual network that is split into two or more subnets; each subnet plays the role of a VLAN, as shown above. NSG rules are then created to restrict network traffic. In the below diagram, NSGs will:

• Allow web traffic into the FrontEnd subnet.
• All application traffic to flow from the FrontEnd subnet to the BackEnd subnet.
• Block all other traffic.

A DMZ using Azure network security groups (Image Credit: Microsoft)

The benefit of this design is that it is very simple. The drawback of this design is that it assumes that your potential hackers are stuck in the 1990s; a modern attack tries to compromise the application layer. A port scan of the above from an external point will reveal that TCP 80/443 are open, so an attacker will try to attack those ports. A simple five-tuple rule will not block that traffic, so the hacker can either flood the target with a DDOS attack or compromise application vulnerabilities.

NSGs and a Firewall

Modern edge network devices can protect and enhance hosted applications with applications layer scanning and/or reverse proxy services. The Azure Marketplace allows you to deploy these kinds of devices from multiple vendors into your Azure virtual networks.

The following design below uses a virtual network appliance to protect an application from threats; this offers more than just simple protocol filtering because the appliance understands the allowed traffic and can identify encapsulated risks.

Using a firewall virtual appliance with NSGs to create a DMZ (Image Credit: Microsoft)

NSGS are deployed to enforce that all communications from the Internet must flow through the virtual appliance. NSGs will also control the protocols and ports that are allowed for internal communications between the subnets.

Ideally, we’d like to have all communications inside of the virtual network to flow through the virtual appliance, but the default routing rules of the network will prevent this from happening.

User Defined Routes, NSGs, and a Firewall

We can override the default routes of a virtual network using user-defined routes (UDRs). The following design uses one subnet in a single virtual network for each layer of the n-tier application. An additional subnet is created just for the virtual firewall appliance, which will secure the application.

UDRs are created to override the default routes between the subnets, forcing all traffic between subnets to route via the virtual firewall appliance. NSGs are created to enforce this routing and block traffic via the default routes.

An Azure DMZ made from user-defined routes, a virtual appliance firewall and NSGs (Image Credit: Microsoft)

The result is a DMZ where the virtual appliance controls all traffic to/from the Internet and between the subnets.

Tip: Try to use a next generation firewall and compliment this with defense with additional security products that will work with the Azure Security Center so that you have a single view of all trends and risks.

The post Designing a DMZ for Azure Virtual Machines appeared first on Petri.

The content below is taken from the original (DARPA is building acoustic GPS for submarines and UUVs), to continue reading please visit the site. Remember to respect the Author & Copyright.

For all the benefits that the Global Positioning System provides to landlubbers and surface ships, GPS signals can’t penetrate seawater and therefore can’t be used by oceangoing vehicles like submarines or UUVs. That’s why DARPA is creating an acoustic navigation system, dubbed POSYDON (Positioning System for Deep Ocean Navigation), and has awarded the Draper group with its development contract.

The space-based GPS system relies on a constellation of satellites that remain in a fixed position relative to the surface of the Earth. The GPS receiver in your phone or car’s navigation system triangulates the signals it receives from those satellites to determine your position. The POSYDON system will perform the same basic function, just with sound instead. The plan is to set up a small number of long-range acoustic sources that a submarine or UUV could use to similarly triangulate its position without having to surface.

The system should be ready for sea trials by 2018. It will initially be utilized exclusively for military and government operations but, like conventional GPS before it, will eventually be opened up to civilians as well.

The content below is taken from the original (Cujo is a firewall for the connected smart home network), to continue reading please visit the site. Remember to respect the Author & Copyright.

The content below is taken from the original (What is Hybrid Infrastructure? Glad you asked…), to continue reading please visit the site. Remember to respect the Author & Copyright.

The content below is taken from the original (What’s New in Windows Server 2016 Technical Preview 5: Hyper-V Features), to continue reading please visit the site. Remember to respect the Author & Copyright.

This article will discuss new Hyper-V features and their impact in the Windows Server 2016 (WS2016) Technical Preview 5 (TP5), which is available to download now.

Windows Server 2016 Technical Preview 5 New Features

Microsoft recently released the latest public preview of Windows Server 2016 and Hyper-V Server 2016 (the free version). There are lots of new Hyper-V features to evaluate, learn, and use.

If I had to give you a theme to this release, it would be cloud. Much of what is in the 2016 release is geared toward building private, hosted, or public cloud, with a lot of the management being offered either by Azure or Microsoft Azure Stack. When evaluating WS2016, you’ll need to consider:

• Nano Server, with administration via Remote Server Management Tools
• Hyper-V
• Failover Clustering
• Storage
• Networking, particularly the Network Controller
• Microsoft Azure Stack
• Containers

In this post, I’m going to focus on the improvements to Hyper-V.

Connected Standby

This is a feature for Windows 10 users and the few presenters that run Windows Server Hyper-V on their laptop or hybrid device. You might even say that this new feature was dedicated to Paul Thurrott when the feature was announced at TechEd Europe 2014, mainly because Paul was one of the more vocal sufferers of the lack of compatibility between Hyper-V and the heralded Windows 8/hardware feature. Hyper-V had issues with Connected Standby, and these issues have been solved in Windows 10 and Windows Server 2016.

Discrete Device Assignment (DDA)

Discrete Device Assignment is a relatively new feature in the list of improvements. DDA allows you to give a virtual machine direct and exclusive access to some PCI devices in the host. The concept is that a virtual machine can talk directly to a graphics card. My suspicion is that the primary customer for this feature are those who are using Microsoft Azure with an N-Series virtual machine. But anyone looking for something better than RemoteFX or compute intensive workloads should be interested in this feature, too.

Host Resource Protection

This is a security feature to protect a host and other virtual machines from resource abuse by another virtual machine. Imagine that a virtual machine goes awry or is compromised; in the latter case, the attacker will want to attack the hypervisor, either looking for a vulnerability or to launch a DOS attack. Hyper-V can be configured to starve the virtual machine of resources when unusual behaviour starts, thus limiting the damage and giving you a chance to intervene.

Add-Add/Remove of Virtual Memory and Network Adapters

Is that applause and cheering that I hear? This heavily demanded feature is coming to Hyper-V; you can add and remove memory and virtual NICs to and from running virtual machines running Windows 10 or WS2016.

Hyper-V Manager

The old tool is looking long in the tooth, but improvements are coming. You can launch Hyper-V manager with alternate credentials, supporting the secure dual-identity approach that some companies enforce. You can also manage older versions of Hyper-V from WS2016 (WS2012, WS2012 R2, Windows 8.1, and Windows 8). The management protocol has been updated to use WS-MAN (TCP 80) with remote hosts. A benefit is that you can connect to a remote host with CredSSP and perform a live migration without enabled messy Active Directory constrained delegation.

Integration Services via Windows Update

Another cheering moment here; the Hyper-V integration components in the guest OS will be updated via Windows Update; Linux uses different methods. Note that the VMGUEST.ISO is no longer required, so it is not included in the installation.

Linux Secure Boot

You can protect Linux guests from root kits by enabling secure boot on Generation 2 virtual machines. You must use a compliant version of Linux and enable the use of the Microsoft UEFI Certificate Authority.

Nested Virtualization

Here’s a very big cheering moment because we finally get a feature we’ve been asking for since Windows Server 2008. Those with constrained hardware can finally run Hyper-V virtual machines inside of Hyper-V virtual machines — there are blog posts on how to get vSphere running inside of Hyper-V!

You can even run Hyper-V virtual machines inside of Hyper-V virtual machines, insider of Hyper-V virtual machines, inside of Hyper-V virtual machines, and on and on. This is great for training classes and presenters (failover clustering and Live Migration on a single physical machine), but the real winner here is Windows Server Containers, which gets the more secure Hyper-V Container.

The architecture of nested Hyper-V (Image Credit: Microsoft)

I can’t wait until the day that I can run Hyper-V inside of an Azure virtual machine! The performance of nested Hyper-V should be pretty good, thanks to Microsoft’s micro-kernalized architecture, as opposed to the alternative monolithic approach.

Networking

This is a huge area that deserves its own article, so watch out for a post that’s coming soon.

Production Checkpoints

Checkpoints, what some of you still call Hyper-V snapshots, were improved to the point where Microsoft can say “yes, use them with production workloads.” A production checkpoint uses the backup infrastructure of Hyper-V to create a checkpoint of a running virtual machine. When you restore the checkpoint, it’s as if the virtual machine is being restored from a backup. You can use legacy standard checkpoints, but production checkpoints are on by default. This improvement is a recognition that:

• People were using checkpoints in production, even though it wasn’t recommended.
• The nature of systems management has changed, and self-service administrators are going to use checkpoints.

Shielded Virtual Machines

This is actually a huge topic; Microsoft’s core hypervisor team did a lot of work to:

• Harden the hypervisor.
• Create a new model and architecture (Host Guardian Server) for creating trusted virtual machines with limited or no access for hypervisor administrators.
• Enabling tenant-managed BitLocker with a virtual TPM chip.

Yes, you can replicate these virtual machines to hosts that are similarly secured in the secondary location using Hyper-V Replica.

Virtual Machine Configuration

The old XML files of the past that were used to describe virtual machine metadata are gone. WS2016 will use binary files that you cannot edit:

• .VMCX: The virtual machine configuration file.
• .VMRS: The virtual machine runtime state data file.

The benefits of this change are:

• Improved performance on larger and denser hosts.
• Reduced risk of data corruption caused by storage failure.

This change has proven to be controversial. I don’t get why; it was completely unsupported and unsafe to directly edit the XML files in the past.

Virtual Machine Configuration Version

Most of us did not know that virtual machines have always had versions, based on the Hyper-V version that they were created and running on. You will be able to update the version of a virtual machine in WS2016, which will be useful thanks to some of the improvements in failover clustering.

PowerShell Direct

I’m not a day-to-day administrator, but I use PowerShell a lot when doing presentations and demos of Hyper-V. I’ve done lots of PowerShell remoting, which can get quite complicated. The same scenario exists for a virtualization admin; they have lots of machines they want to work with, but they want PowerShell admin inside of the machines to be easier.

PowerShell Direct allows you to do work inside of a virtual machine, from the host, without any network or firewall access to the guest OS. For example, if a virtual machine loses an IP configuration, you can reconfigure the network stack using PowerShell Direct to get the machine back to an operational status.

The post What’s New in Windows Server 2016 Technical Preview 5: Hyper-V Features appeared first on Petri.

The content below is taken from the original (ICANN knifes Africa’s internet: New top-level domains terminated), to continue reading please visit the site. Remember to respect the Author & Copyright.