Deploy secure, scalable, and highly available web apps with Azure Front Door Service
Download as PPTX, PDF0 likes657 views
The document summarizes a presentation about the Azure Front Door Service. The presentation discusses how the Front Door Service provides global load balancing and traffic management for web applications deployed to Azure. It enables deploying applications behind the Front Door to gain benefits like SSL offloading, caching, and failover across data centers. The presentation also covers how the Front Door Service integrates with features like the Azure Web Application Firewall for added security and protection against attacks. It concludes with a demo of the Front Door Service in action.
Ad
More Related Content
What's hot (20)
Similar to Deploy secure, scalable, and highly available web apps with Azure Front Door Service (20)
Ad
Recently uploaded (20)
Ad
Deploy secure, scalable, and highly available web apps with Azure Front Door Service
- 1. April 27 GLOBAL AZURE BOOTCAMP IS POWERED BY: Deploy secure, scalable, and highly available web apps with Azure Front Door Service
- 2. Thanks to our Sponsors: Global Sponsor: Platinum Sponsors: Gold Sponsors: Silver Sponsors:
- 3. Speaker Bio • Stamo Petkov • Information services Plc. • Head of Microsoft Technologies department • Contact o [email protected] o [email protected] o https://github.com/stamo o http://bg.linkedin.com/in/stamopetkov o https://www.facebook.com/stamo.petkov o @stamo_petkov
- 4. Agenda • Azure Front Door Service o Anycast o Split TCP o Health probes o Caching o Architecture • Azure Front Door application protection o Azure web application firewall (WAF) • Demo • Summary • Q&A
- 5. Azure Front Door Service Application Delivery Network
- 6. Azure Front Door Service Office 365 Azure Skype Bing Azure DevOps MSN OneDrive Xbox Cortana Windows Teams Build on the “battle-tested” platform used to power reliable and fast global services at Microsoft Front Door enables Bing to operate at scale with competitive performance while also scaling agile development across many independent microservices. “Azure DevOps has onboarded all of its microservices to the Azure Front Door Service over the past year. It provides us with significant benefits in terms of both performance and reliability.”
- 7. Selecting the Front Door environment for traffic routing (Anycast) • Routing to the Azure Front Door environments leverages Anycast for both DNS (Domain Name System) and HTTP (Hypertext Transfer Protocol) traffic, so user traffic will go to the closest environment in terms of network topology (fewest hops) • Front Door organizes its environments into primary and fallback "rings“ • The outer ring has environments that are closer to users • The inner ring has environments that can handle the failover for the outer ring environment in case an issue happens • The outer ring is the preferred target for all traffic, but the inner ring is necessary to handle traffic overflow from the outer ring
- 8. Global application delivery with Azure Front Door Service
- 9. Connecting to Front Door environment (Split TCP) • Split TCP is a technique to reduce latencies and TCP problems by breaking a connection that would incur a high round-trip time into smaller pieces • One TCP connection with a large round-trip time (RTT) to application backend is split into two TCP connections • The short connection between the end user and the Front Door environment gets established over three short round trips • The long connection between the Front Door environment and the backend can be pre-established and reused across multiple end-user calls • The effect is multiplied when establishing a SSL/TLS (Transport Layer Security) connection as there are more round trips to secure the connection
- 10. Connection establishment and response Web Apps Mobile Apps API Apps Logic Apps Functions
- 11. Make your apps faster, reduce backend load Web Apps Mobile Apps API Apps Logic Apps Functions
- 12. Identifying available backends in the backend pool • In order to determine the health of each backend, each Front Door environment periodically sends a synthetic HTTP/HTTPS request to each of your configured backends • Front Door uses responses from these probes to determine the "best" backends to which it should route real client requests • A 200 OK status code indicates the backend is healthy. Everything else is considered a failure • Azure Front Door Service uses the same three-step process across all algorithms to determine health o Exclude disabled backends o Exclude backends that have health probes errors o Out of the set of healthy backends in the backend pool, Front Door additionally measures and maintains the latency (round-trip time) for each backend • If health probes fail for every backend in a backend pool, then Front Door considers all backends healthy and routes traffic in a round robin distribution across all of them
- 13. Caching with Azure Front Door Service • Delivery of large files o Front Door uses a technique called object chunking to deliver large files o Front Door environment requests the file from the backend in chunks of 8 MB o After the chunk arrives at the Front Door environment, it is cached and immediately served to the user. Front Door then pre-fetches the next chunk in parallel o Front Door caches any chunks as they're received and so the entire file doesn't need to be cached on the Front Door cache • File compression o Front Door can dynamically compress content on the edge, resulting in a smaller and faster response to your clients o Supports gzip and Brotli compression. If a request supports gzip and Brotli compression, Brotli compression takes precedence o When a request for an asset specifies compression and the request results in a cache miss, Front Door performs compression of the asset directly on the POP server o The resulting item is returned with a transfer-encoding: chunked
- 14. Caching with Azure Front Door Service • Query string behavior o Ignore query strings. This is the default mode o Cache every unique URL • Cache purge o Front Door will cache assets until the asset's time-to-live (TTL) expires o The best practice to make sure your users always obtain the latest copy of your assets is to version your assets for each update and publish them as new URLs o Sometimes you may wish to purge cached content from all edge nodes and force them all to retrieve new updated assets. You can purge all, purge single url or purge wildcard url • Cache expiration o In order to determine how long an item will be stored in our cache Front Door is using o Cache-Control: s-maxage=<seconds> o Cache-Control: maxage=<seconds> o Expires: <http-date>
- 15. Enterprise grade architecture in the Front Door Firewall Application LoadBalancer Proxy / Caching DNS Load Management Redundant paths Redundant paths Active steeringActive monitoring and steering Fast fail over Fast fail over Map of the Internet
- 16. Azure Front Door application protection Azure web application firewall (WAF)
- 17. Azure Front Door application protection • Web applications are increasingly the targets of malicious attacks such as denial of service floods, SQL injection attacks, and cross-site scripting attacks • These malicious attacks may cause service outage and data loss, pose a significant threat to web application owners • Preventing such attacks in application code can be challenging and may require rigorous maintenance, patching and monitoring at multiple layers of the application topology • A centralized web application firewall helps make security management much simpler and gives better assurance to application administrators
- 18. Azure web application firewall for Azure Front Door • WAF for Front Door is a global and centralized solution • Provides centralized protection for your web applications that are globally delivered using Azure Front Door • Every incoming request for a WAF enabled web application delivered by Front Door is inspected at the network edge • Prevents malicious attacks close to the attack sources, before they enter virtual network and offers global protection at scale without sacrificing performance
- 19. Azure Front Door application protection Network DDoS protection IP blacklists and whitelists Geo filtering Flexible actions Custom http(s) access rules Rate limiting Azure managed ruleset
- 20. Demo See Azure Front Door service in action
- 21. Azure Front Door Service Summary • SSL offload and application acceleration at the edge close to end users • Global HTTP load balancing with instant failover • Actionable insights about your users and back ends • Web Application Firewall (WAF) and DDoS Protection • Central control plane for traffic orchestration
- 23. Thanks to our Sponsors: Global Sponsor: Platinum Sponsors: Gold Sponsors: Silver Sponsors: