Example 1: Secure and Sensible Cloud Virtual Desktop Solution

Many of my clients are facing a decision on what to do with their desktop infrastructure. Why?

Broadcom’s acquisition of VMware has placed an expensive and complex burden on people who have been running on VMware solutions, such as Horizon, for many years. Others are finding Citrix too expensive and are tired of managing a complicated in-house infrastructure.

Azure Virtual Desktop is the best candidate for replacing these solutions for many organizations.

My clients report a significant improvement in performance, compared to their former solution, and it’s much easier to manage.

The key is to deploy the solution carefully and with intent, meaning that you understand the client’s requirements and build with best of breed features. To do this well requires a design that is optimized for performance, cost, and is security-focused.

Action

• Built Azure foundation using Landing Zone Accelerator. Many of my clients do not have a production-ready environment, so this is always the first thing I do to allow for a secure and easy to manage design following Microsoft’s best recommendations for cloud adoption.

• I wanted to best utilize the host pool for cost, performance, and consistency, using:

  • FSLogix on zone-redundant Azure Files storage.

  • Scaling plans to allow the environment to grow and shrink based on business usage.

  • Azure Insights to give the client comprehensive visibility into performance, capacity, and end-to-end connectivity.

• I am serious about security, so a robust firewall solution is always part of the design. In this case, the client was already using Palo Alto devices on premises, so I implemented Palo Alto NVAs (network virtual appliances) to meet their firewall and network-inspection requirements. This was used in combination with distributed firewalls and routing (Azure network security groups and user defined routes). Azure private endpoints were implemented in keeping with best practice for securing client data.

Result

End users had better performance than their VMware Horizon solution and had consistent desktop experience.

Dynamic scaling led to major cost savings as only required compute resources were used according to end user activity.

The client (working initially with me) was able to quickly analyze connectivity performance end-to-end. This was vital as end-users were cutover to the AVD solution, giving them the best experience while optimizing the cost savings for the solution.

Designing and building the best foundation for this solution has has paved the way for clients like this one to continue to modernize their business as part of their cloud adoption journey.

Example 2: Zero-Trust Network Design

For most organizations, ‘lift and shift’ involves more than a simple migration. This client had strong networking expertise and strict perimeter networking practices that were to be preserved as part of their migration of a 3-tier application to the public cloud.

Action

• I worked closely with NetSecOps to understand their network security requirements and help them see how their cloud adoption can be secure.

• I met them where they were, designing a hybrid architecture that they could support and grow. A more cloud-native design was added to their roadmap for true end-state architecture for the near future.

• I worked with their infrastructure and operations teams to deploy the networks, NVAs (network virtual appliances), RODCs (read-only domain controllers), web, app, and DB VMs.

• I worked with NetSec teams to create secure connectivity within the cloud (east-west) and external connectivity (north-south), maintaining the requirements for least privilege access and deep packet inspection.

• Addressed their remote access concerns by replacing a jump box system with Bastion services over secure TLS.

• Created services to synchronize FTP and email functionality with dependencies in the existing data center.

• Worked with the application team to refactor the middle tier as legacy configuration needed to be updated.

Result

Application was successfully moved to the cloud. Training sessions followed and all teams can support the full stack in it’s new platform. They are also well-positioned to continue to modernize and improve the application to address the speed of their business.

Example 3: Disaster Recovery Solution

For the above client, a DR solution needed to be included in the design. I led that design, implementation and testing of the solution.

Action

• I worked closely with Cloud Ops team to help them build a solution that would meet their immediate goals for DR.

• Due to their strict networking requirements along with IaaS-based applications, pre-staged networks for perimeter security and VMs were created. A warm instance of a SQL replica would be made master in a fail-over situation. All other VMs where spun up at the time time of the event, using Azure Site Recovery (ASR).

Result

DR tests where successfully carried out and within the required RTO/RPOs.

Example 4: Post-Acute Hiring Application - Legacy-to-AWS

I was tasked to bring that in-house from their tech platform which was built on outdated HW running free applications in a data closet.

Action

• I engaged with developers and product team that came on board with the application.

• I assessed the application workload through performance analysis and discovery.

• I built a project around the scope and method of the move, given the deadline I had to work with.

• The deadline was built on the risk of remaining on existing fragile infrastructure.

• I worked with developers to rebuild/refactor the application for AWS.

• Moved workloads into AWS

  • From MS SQL server to AWS RDS

  • Replaced limited-function free software LBs to AWS ALBs

  • Designed and configured security groups.

  • Designed and configured network topology and communication flow.

  • Handed it off to developers and worked with Ops/Sec for maintaining app health and regular review/optimization of environment.

Result

The risk of having everything on an expired tech stack with no redundancy was mitigated and the application is running in AWS using real SLAs for uptime, availability, and security.