Global Azure Bootcamp 2019 Bulgaria

1. April 27
GLOBAL AZURE BOOTCAMP IS POWERED BY:
Deploy secure, scalable, and highly
available web apps with Azure Front
Door Service

2. Thanks to our Sponsors:
Global Sponsor:
Platinum Sponsors:
Gold Sponsors:
Silver Sponsors:

3. Speaker Bio
• Stamo Petkov
• Information services Plc.
• Head of Microsoft Technologies
department
• Contact
o s.g.petkov@is-bg.net
o stamo.petkov@gmail.com
o https://github.com/stamo
o http://bg.linkedin.com/in/stamopetkov
o https://www.facebook.com/stamo.petkov
o @stamo_petkov

4. Agenda
• Azure Front Door Service
o Anycast
o Split TCP
o Health probes
o Caching
o Architecture
• Azure Front Door application protection
o Azure web application firewall (WAF)
• Demo
• Summary
• Q&A

5. Azure Front Door Service
Application Delivery Network

6. Azure Front Door Service
Office 365 Azure Skype Bing
Azure DevOps MSN OneDrive
Xbox Cortana Windows Teams
Build on the “battle-tested” platform used to power
reliable and fast global services at Microsoft
Front Door enables Bing to operate at scale with
competitive performance while also scaling agile
development across many independent
microservices.
“Azure DevOps has onboarded all of its
microservices to the Azure Front Door Service over
the past year. It provides us with significant benefits
in terms of both performance and reliability.”

7. Selecting the Front Door environment for traffic routing (Anycast)
• Routing to the Azure Front Door environments leverages Anycast for both DNS
(Domain Name System) and HTTP (Hypertext Transfer Protocol) traffic, so user
traffic will go to the closest environment in terms of network topology (fewest
hops)
• Front Door organizes its environments into primary and fallback "rings“
• The outer ring has environments that are closer to users
• The inner ring has environments that can handle the failover for the outer ring
environment in case an issue happens
• The outer ring is the preferred target for all traffic, but the inner ring is
necessary to handle traffic overflow from the outer ring

8. Global application delivery with Azure Front Door Service

9. Connecting to Front Door environment (Split TCP)
• Split TCP is a technique to reduce latencies and TCP problems by breaking a
connection that would incur a high round-trip time into smaller pieces
• One TCP connection with a large round-trip time (RTT) to application backend
is split into two TCP connections
• The short connection between the end user and the Front Door environment
gets established over three short round trips
• The long connection between the Front Door environment and the backend can
be pre-established and reused across multiple end-user calls
• The effect is multiplied when establishing a SSL/TLS (Transport Layer Security)
connection as there are more round trips to secure the connection

10. Connection establishment and response
Web Apps
Mobile Apps
API Apps Logic Apps
Functions

11. Make your apps faster, reduce backend load
Web Apps
Mobile Apps
API Apps Logic Apps
Functions

12. Identifying available backends in the backend pool
• In order to determine the health of each backend, each Front Door environment periodically
sends a synthetic HTTP/HTTPS request to each of your configured backends
• Front Door uses responses from these probes to determine the "best" backends to which it
should route real client requests
• A 200 OK status code indicates the backend is healthy. Everything else is considered a failure
• Azure Front Door Service uses the same three-step process across all algorithms to determine
health
o Exclude disabled backends
o Exclude backends that have health probes errors
o Out of the set of healthy backends in the backend pool, Front Door additionally measures and maintains the latency
(round-trip time) for each backend
• If health probes fail for every backend in a backend pool, then Front Door considers all
backends healthy and routes traffic in a round robin distribution across all of them

13. Caching with Azure Front Door Service
• Delivery of large files
o Front Door uses a technique called object chunking to deliver large files
o Front Door environment requests the file from the backend in chunks of 8 MB
o After the chunk arrives at the Front Door environment, it is cached and immediately served to the user. Front Door
then pre-fetches the next chunk in parallel
o Front Door caches any chunks as they're received and so the entire file doesn't need to be cached on the Front
Door cache
• File compression
o Front Door can dynamically compress content on the edge, resulting in a smaller and faster response to your clients
o Supports gzip and Brotli compression. If a request supports gzip and Brotli compression, Brotli compression takes
precedence
o When a request for an asset specifies compression and the request results in a cache miss, Front Door performs
compression of the asset directly on the POP server
o The resulting item is returned with a transfer-encoding: chunked

14. Caching with Azure Front Door Service
• Query string behavior
o Ignore query strings. This is the default mode
o Cache every unique URL
• Cache purge
o Front Door will cache assets until the asset's time-to-live (TTL) expires
o The best practice to make sure your users always obtain the latest copy of your assets is to version your assets for each update and
publish them as new URLs
o Sometimes you may wish to purge cached content from all edge nodes and force them all to retrieve new updated assets. You can
purge all, purge single url or purge wildcard url
• Cache expiration
o In order to determine how long an item will be stored in our cache Front Door is using
o Cache-Control: s-maxage=<seconds>
o Cache-Control: maxage=<seconds>
o Expires: <http-date>

15. Enterprise grade architecture in the Front Door
Firewall
Application
LoadBalancer
Proxy / Caching
DNS Load
Management
Redundant paths
Redundant paths
Active steeringActive monitoring and
steering
Fast fail
over
Fast fail
over
Map of the
Internet

16. Azure Front Door application
protection
Azure web application firewall (WAF)

17. Azure Front Door application protection
• Web applications are increasingly the targets of malicious attacks such as denial
of service floods, SQL injection attacks, and cross-site scripting attacks
• These malicious attacks may cause service outage and data loss, pose a significant
threat to web application owners
• Preventing such attacks in application code can be challenging and may require
rigorous maintenance, patching and monitoring at multiple layers of the
application topology
• A centralized web application firewall helps make security management much
simpler and gives better assurance to application administrators

18. Azure web application firewall for Azure Front Door
• WAF for Front Door is a global and centralized
solution
• Provides centralized protection for your web
applications that are globally delivered using
Azure Front Door
• Every incoming request for a WAF enabled web
application delivered by Front Door is inspected
at the network edge
• Prevents malicious attacks close to the attack
sources, before they enter virtual network and
offers global protection at scale without
sacrificing performance

19. Azure Front Door application protection
Network DDoS protection
IP blacklists and whitelists
Geo filtering
Flexible actions
Custom http(s) access rules
Rate limiting
Azure managed ruleset

20. Demo
See Azure Front Door service in action

21. Azure Front Door Service Summary
• SSL offload and application acceleration
at the edge close to end users
• Global HTTP load balancing with instant
failover
• Actionable insights about your users and
back ends
• Web Application Firewall (WAF) and
DDoS Protection
• Central control plane for traffic
orchestration

22. Questions & Answers

23. Thanks to our Sponsors:
Global Sponsor:
Platinum Sponsors:
Gold Sponsors:
Silver Sponsors: