Of course, I wanted to make things bit more interesting so I decided to add AWS shell to Windows terminal as drop down option.

Install Python, aws-shell and AWS CLI

Step one is to install Python for Windows. Latest version as of writing this article is Python 3.9.0. Note where Python installs as you will need this info later. By default it will be in C:\Users\YourUsername\AppData\Local\Programs\Python\Python39>.

Nest step is to open command line, go to installation folder and run the following command to install aws-shell

pip install aws-shell

After approximately one minute you will have installed aws-shell.

Install AWS CLI for Windows by downloading installer from this link.

Add AWS shell to Windows terminal

Open Windows terminal and from dropdown select Settings.

In the profiles section add following lines:

{
"name": "AWS Shell",
"commandline": "C:\\Users\\YourUsername\\AppData\\Local\\Programs\\Python\\Python39\\Scripts\\aws-shell.exe",
}

If you wish to beautify it a bit more, you can add icon to the drop down menu in Windows Terminal and maybe select different font.

{
"name": "AWS Shell",
"commandline": "C:\\Users\\YourUsername\\AppData\\Local\\Programs\\Python\\Python39\\Scripts\\aws-shell.exe",
"icon" : "C:\\Program Files\\Amazon\\AWSCLIV2\\aws-logo.ico",
"acrylicOpacity" : 0.80,
"fontFace": "Lucida Sans Typewriter"
}

Final result should look similar to this

In this post I will go through Grafana setup to monitor and visualize data from Unifi controller that is also running in Azure virtual machine on Ubuntu distribution.

Unifi-pooler

Unifi-pooler is small piece of software that is running on virtual machine where Unifi controller is located. It pulls data from the controller and saves it into the InfluxDB database. Grafana then connects to that database, collects data and visualizes it.

Create unifi-pooler account in Unifi

1. Go to Settings -> Admins
2. Add a read-only user (unifipoller) with a nice long password.
3. The new user needs access to each site. For each UniFi Site you want to poll, add admin via the ‘Invite existing admin’ option or in newer versions just select option to inherit to all sites.
4. Take note of the username and password, you need to put it into the unifi-poller config file.

Install InfluxDB and create database

First we need to install InfluxDB on Unifi controller

echo "deb https://repos.influxdata.com/ubuntu bionic stable" | sudo tee /etc/apt/sources.list.d/influxdb.list
sudo curl -sL https://repos.influxdata.com/influxdb.key | sudo apt-key add -
sudo apt -y update
sudo apt install -y influxdb
sudo systemctl start influxdb

Than we need to create new database

influx -host localhost -port 8086
CREATE DATABASE unifi
USE unifi
CREATE USER unifipoller WITH PASSWORD 'unifipoller' WITH ALL PRIVILEGES
GRANT ALL ON unifi TO unifipoller

Install unifi-pooler

curl -s https://golift.io/gpgkey | sudo apt-key add -
echo deb https://dl.bintray.com/golift/ubuntu bionic main | sudo tee /etc/apt/sources.list.d/golift.list
sudo apt update
sudo apt install unifi-poller

Edit config file

Use your favorite editor

sudo nano /etc/unifi-poller/up.conf

or if you a hard core command line guru

sudo vi /etc/unifi-poller/up.conf

You will want to change these settings

[unifi.defaults]
  url  = "https://your.unifi.controller.ip:8443"
  user = "unifipoller"
  pass = "unifipoller"
[influxdb]
  url  = "http://your.influxdb.ip:8086"

Don’t forget to enter correct username and password and open required ports if you have firewall.

Restart the service

sudo systemctl restart unifi-poller

Check the log for errors

tail -f -n100  /var/log/syslog /var/log/messages | grep unifi-poller

Add the data source to Grafana

As in part 1 when we configured Azure monitor as data source, now we need to ad InfluxDB as data source.

1. Open the side menu by clicking the Grafana icon in the top header.
2. In the side menu under the Dashboards link you should find a link named Data Sources.
3. Click the + Add data source button in the top header.
4. Select InfluxDB from the Type dropdown.
5. Select InfluxQL or Flux from the Query Language list.

Add Unifi dashboards to Grafana

At this point, data is being ingested in InfluxDB and all that is left is to add dashboards to the Grafana interface.

Grafana official repository contains several interesting Unifi dashboards for free. Installation is easy and straightforward as explained in part 1.

Since some of these dashboards contain additional plugins, I recommend you to install them beforehand on Grafana VM.

Clock plugin

grafana-cli plugins install grafana-clock-panel

Pie-chart plugin

grafana-cli plugins install grafana-piechart-panel

Restart Grafana server

service grafana-server restart

I had some issues with UniFi-Poller: Client Insights – InfluxDB dashboard because it uses Discrete plugin which installs fine but for some reason does not work in dashboard.

Ease of use and setup was very important to me, as well as large number of predefined dashboards. Grafana was next in line for trial, and I must say I am very happy how it is working out for me. Fact that there are pre-built images in Azure one also welcome bonus.

My use case for Grafana is two fold. I want to monitor some home networking and storage equipment such as Unifi switches, access points and gateways and Synology NAS. At the same time I want to access Azure Monitor and Azure Log Analytics data and visualize it in Grafana.

What is Grafana?

Grafana is open source visualization and analytics software. It allows you to query, visualize, alert on, and explore your metrics no matter where they are stored. In plain English, it provides you with tools to turn your time-series database (TSDB) data into beautiful graphs and visualizations.

https://grafana.com/docs/grafana/latest/getting-started/what-is-grafana/

I am using free of charge version which does have some limitations compared to payed one but those where minor for my use case.

Setup Grafana in Azure

I opted to use free official Grafana image from Azure marketplace as it was fastest and easiest way to deploy it. This image is intended to be used for testing and PoC scenarios.

After selecting Create option for Grafana marketplace item we need to fill in couple of attributes and that is it.

Make sure to fill correct values and remember any usernames and passwords.

Creating VM and deploying Grafana takes approximately 5 minutes. In my case I selected Standard DS2 v2 virtual machine which is probably overkill for me, but it is just PoC for now and I can reduce its size later on if needed.

Open http://<your hostname or IP address>:3000 and you will be presented with Grafana login screen. Initial username and password are Admin:Admin if you installed it from scratch. If you used Grafana image from Azure, username is Admin and password you set up in step one of creating VM from image.

Setup Azure monitor data source

There are multiple steps involved and you will have to have sufficient permissions in Azure portal and on Azure AD instance to complete these.

Setup Azure resources

1. Go to Azure Portal – Azure Active Directory and select App registrations
2. Select New registration and enter required data
   • Give it some meaningfull name
   • Leave Supported accounts as is
   • For Redirect URI you can enter anything (eg. https://localhost)
3. Hit Register
4. Go back to App registrations and select your app
5. Select Certificates and secrets
6. Create new secret
7. Select Subscriptions
8. Select your subscription
9. Select Access control (IAM)
10. Add – Add role assignment
    • Role – Reader
    • In the Select field search for application name you just regstered
11. Select Save

I step 7 we gave our newly registered Azure AD application read access to all resources in our subscription.

Setup Azure monitor data source in Grafana

1. Open your Grafana admin page and login
2. Select Gear wheel and select Data Sources
3. Select Azure Monitor data source
4. Fill in required field for Azure monitor
   • Information such as Tenant ID, Client ID can be located in Azure portal where you created your Azure AD application
5. Click Save and test

Azure Log Analytics API Details are optional but you can always add them later on.

Considering that your connection was successful, now we can finally add some dashboards to our Grafana.

Visualize Azure VM data in Grafana

Grafana community is very large and there are lots of interesting pre-configured dashboards to choose from. I just did a quick search on Azure topic and got about 30 dashboards.

In my case I was interested in Azure Virtual Machineby yesoreyeram.

Note the ID of this dashboard as we will need it in next steps.

1. Go to Grafana admin page
2. Select + sign on the left and select Import
3. Paste plugin ID and select Load
   • Fill in required fields

At the time of this posting, dashboard had a small error in visualization of CPU Usage gauge. To fix it follow these steps:

1. Hover over CPU usage gauge
2. In drop down menu select Edit
3. On the left select Visualizations if not already selected
4. Select Gauge
5. On top left select back arrow

After loading, this dashboard will give you options to choose some parameters such ads Subscription to view, resource group and VMs.

Here you can switch between different attributes. If you want to view same one with same selection of attributes every time you open dashboard, in the top right corner select Save icon and move Save current variables slider to On.

Now, you will have dashboard similar to this one.

In part 2 I will configure monitoring of Unifi devices and how to set up Unifi controller and Grafana to visualize data from all devices.

As we all know, migration to any public cloud provider is not click-click-next process. This workshop was interned to increase awareness of processes and tools involved in such project.

Workshop itself will not give you all the skills and expertise needed to perform migration by yourself if you are new to this but it will help you understand what it takes and what are the challenges.

You can view the recording (in Croatian) below.

There is always an option to engage with qualified partner such as Span, where we can help you in any of the described phases of migration project . Furthermore, Span recently obtained Microsoft Advanced specialization “Windows Server and SQL Server Migration to Microsoft Azure“, so we are more than capable to assist you in your cloud journey.

Feel free to contact me!

Now, I am one and a half year out of corporation, and I have been re-awarded MVP status, this time as Microsoft Azure MVP. It is definitely a recognition of my efforts for the past one and a half year in community and I am grateful for being chosen again.

I will of course continue to contribute and give back to community, always for free and with no strings attached.

Feel free to ping me back or contact me via social network or in real live during upcoming virtual or hopefully in person conferences.

Main reason for this is that I used to forget to renew cert and had to manually reconfigure ports when I used cron script to automatically renew Letsencrypt certificate.

Since I was doing this I also decided to move to new virtual machine. Process for this was very simple:

1. Install latest Ubuntu server
   1. Apply latest updates
2. Utilize this simple script to install latest Unifi controller
   1. During site setup, restored backup from old controller
3. Import Digicert wildcard certificate (explained later)
4. Changed IP address of new controller to the one of old controller

Import Digicert wildcard certificate

I will just outline this process in easy to follow steps:

1. Obtain certificate from your provider
2. Download your .cer file and root and any Intermediate .cer files
3. Transfer all files to your Ubuntu VM to a location where your .key file is
4. Run following command to bundle root and intermediate certificates

cat your_domain_name.crt DigiCertCA.crt intermediateCA >> bundle.crt

5. Run following commands to import certificates and restart Unifi service

openssl pkcs12 -export -in yourwildcardcert.crt -inkey yourcertkeyfile.key -certfile bundle.crt -out unifi.p12 -name unifi -password pass:aircontrolenterprise
keytool -importkeystore -srckeystore unifi.p12 -srcstoretype PKCS12 -srcstorepass aircontrolenterprise -destkeystore /usr/lib/unifi/data/keystore -storepass aircontrolenterprise
service unifi restart

And volila! Your Unifi controller is now running on https.

My good friend Robert and I with help from Microsoft people Marin Mamić, Drasko Ivanisevic and Tomislav Tipurić brought this group from the dead in 2008. Since then, we helped organize many more similar groups in Split, Rijeka and Varazdin together with other distinguished members of Microsoft community.

Unfortunately, some of these groups slowed down or disappeared due to various reasons but some other emerges, such as It Pro Edu group and Azure meetup.

Current It Pro UG Leads, Tomislav Lulić and Goran Žarinac asked me to do a session on Azure governance and management, which I gladly accepted. Session was very well accepted and there where about 50 attendees. We has nice discussion and I was happy to see some old familiar faces and some new visitors.

Take a look at the gallery and download presentation.

Krizevci Microsoft community is organizing Azure Global event this year so if you are interested in delivering It Pro or developer session, make sure to visit call for speakers page and engage!

For more info on the event if you are interested as attendee, please visit official Meetup landing page!

Elasticsearch can be installed in Azure manually, via Kubernetes or easiest way is to deploy it as ARM template form Azure marketplace.

There are several configuration screens that needs to be filled in, for the purpose of this implementation and per customer needs we implemented internal solution only without certificates.

Deployment consisted of 3 data/master nodes in a cluster, each with 3, 128 GB premium SSD disks configured as RAID 0, and machines configured as back end pool in internal load balancer. Additional virtual machine was deployed to use as Kibana server.

Since UiPath Orchestrator is deployed as App service, it had to be integrated vitth existing vNet so it can access Elasticsearch nodes residing in different subnet of the same vNet.

I have tested template deployment several times and every time although deployment passed OK, services where not running as expected. Customers environment is security restricted in some way and I suspected that it may be issue. I confirmed it by deploying the same template in fresh Azure environment where everything worked as expected.

Since these restrictions caused template to not deploy correctly, I took these steps to resolve the issue.

Reinstall Kibana

sudo apt-get remove --purge kibana
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
sudo apt-get install apt-transport-https
echo "deb https://artifacts.elastic.co/packages/7.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-7.x.list
sudo apt-get update && sudo apt-get install kibana

Modify kibana.yml file

File is located in /etc/kibana directory. File contains much more settings, but these are needed for Kibana to connect to Elasticsearch service.

# Kibana is served by a back end server. This setting specifies the port to use.
server.port: 5601

# Specifies the address to which the Kibana server will bind. IP addresses and host names are both valid values.
# The default is 'localhost', which usually means remote machines will not be able to connect.
# To allow connections from remote users, set this parameter to a non-loopback address.
server.host: "IP Address Of Kibana Server"

# The URLs of the Elasticsearch instances to use for all your queries.
elasticsearch.hosts: ["http://IP Address of Internal Load Balancer:9200"]

# If your Elasticsearch is protected with basic authentication, these settings provide
# the username and password that the Kibana server uses to perform maintenance on the Kibana
# index at startup. Your Kibana users still need to authenticate with Elasticsearch, which
# is proxied through the Kibana server.
elasticsearch.username: "Elasticsearch user"
elasticsearch.password: "Elasticsearch password"

These next steps have to be done on every Elasticsearch node.

Elasticsearch user

Create Elasticsearch user and add him to superuser group.

./elasticsearch-users useradd UserName -p Password -r superuser

Modify elasticsearch.yml file

Instead of node names in config file, put their IP addresses. Yes, this could be resolved by adding GlobalNames DNS zone in DNS server, but it is easier this way and less work.

cluster.name: "yourclustername"
node.name: "your node name"
path.logs: /var/log/elasticsearch
path.data: /datadisks/disk1/elasticsearch/data
discovery.seed_hosts: ["IP address node 1","IP address node 2","IP address node 3"]
cluster.initial_master_nodes: ["IP address node 1","IP address node 2","IP address node 3"]
node.master: true
node.data: true
network.host: [_site_, _local_]
node.max_local_storage_nodes: 1
node.attr.fault_domain: 1
node.attr.update_domain: 1
cluster.routing.allocation.awareness.attributes: fault_domain,update_domain
xpack.license.self_generated.type: trial
xpack.security.enabled: true
bootstrap.memory_lock: true

Restart services

service elasticsearch restart
service kibana restart

Modify web.config file of UiPath App service in Azure

Go to your App service, select Advanced Tools under Development Tools, select Go.

In Kudu console select Debug cosnsole, CMD

Go to /site/wwwroot and scrool to Web.config. Select small pencil on the left side

Modify lines 35 and 38 to include URI to your internal load balancer and username and password for Elasticsearch deployment.

Restart App service just in case.

You should be able to access Kibana via http://YOUR-KIBANA-IP:5601

Most of this is documented in UiPath documentation but I ran into some difficulties.

On the Authentication page of your application registration in Azure you must tick ID tokens checkbox.

After that wee need to configure and add some additional fields in web.config file (located in Configuration pane) of UiPath application in Azure

These settings define that we want to integrate Azure AD with UIPath authentication process and also define that we will map upn (http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn) of Azure AD user to username (ByUserName) of local UiPath user created in the application.

So now, when we create new user in UiPath and set his username to be his upn, it should successfully authenticate and login to UiPath.

Unfortunately, this does not work as intended. It seems that UiPath is looking at email field of user instead in his username. So be sure to add email to UiPath user that is same as upn of his Azure AD account.

Unfortunately for Croatian Microsoft users, event fails right after large local conference, Windays, so this year I will probably skip organization of this event.

I had an opportunity recently to install, update and configure UiPath RPA Orchestrator in Azure environment. Customer had a choice between setting it up in Azure VM or to deploy it as Appservice (PaaS) ARM template. Upon discussing all options, customer decided to go with PaaS option.

There is marketplace ARM template that we choose to deploy, but for this customer we had to modify it a bit within VS Code to comply with naming conventions that we developed. At time of deployment, this template installs 19.4.4 version and latest one is 19.10.15.

Install process is pretty much strait forward. Small instance can handle up to 100 robots and this variable is related to SQL DB (Standard S1 in this case) size which can be later on changed.

Number of instances can be modified up to a 10 and can later on also be scaled if needed. Select your Azure subscription and empty resource group or create new one.

Next option is to set up HAA if you are using more than one instance of UiPath Orchestrator.

Setup SQL parameters

Review your setup and buy the resources.

At this point you can also download template (red arrow) and cancel deployment. Manually modify downloaded template and deploy it via PowerShell when ready. More information on manual deployment via PowerShell can be found on this link.

After initial deployment of the template (takes about 10 minutes to finish), several Azure resources are created

Website is up and running, and we can confirm that by connecting to provided Azure Appservice URL

Customer used default username and password to login and insert required licence. Later on, customer contacted UiPath support to obtain tenant admin and create required tenant resurces.

UiPath upgrade

Since at the time of deployment Azure ARM template contained 19.4.4. version, we did manual upgrade to newest version.

To complete this successfully, we needed to do some prerequisites in Azure:

1. Register application in Azure AD
2. Add applications service principal to Contributor role of resource group where app is deployed
3. Create Client secret in Azure AD App registration

Detailed upgrade steps can be found in UiPath documentation.

This is sample script that we used and modified for our needs:

.\Publish-Orchestrator.ps1 `
-action Update `
-unattended `
-package "E:\Work\Orch\Setup\UiPath.Orchestrator.Web.zip" `
-stopApplicationBeforePublish `
-azureSubscriptionId "8e34be72-1937-4aa0-b70e-81bab19gbf0a" `
-azureAccountTenantId "f8350d2a-n153-4d17-8927-902c51f72797" `
-azureAccountApplicationId "$AzureApplicationId" `
-azureAccountPassword "$AzurePassword" `
-resourceGroupName "DocTest-Orch-RG" `
-appServiceName "DocTests123" `
-verbose

Explanation of all script parameters can be found in documentation.

Upgrade process took about 5 minutes to complete.

Post-configuration

Additionally we have configured following settings:

• Configure custom URL for application
• Add HTTPS certificate
• Restricted IP address blocks for external access
• Azure AD identity integration

Custom URL and certificate

I would recommend to add custom URL to the app and register it with application. Later on this custom domain name can be used as URI in Azure AD application registration. Certificate for HTTPS can be added on the same page and configured additional on TLS/SSL settings pane. For this case I opted for free App Service Managed Certificates that was created and issued via Azure portal.

IP restrictions

Customer requires that application is available from the Internet so for initial deployment we decided to restrict access to specific IP ranges from outside. Later on we will probably add some WAF and other security solutions to the application Internet access.

Azure AD integration

More on this in my next blog post.

Visit my session and lets discuss what is and what can be improved. Share your experiences from the field and hopefully learn something new. Jump over to official website and book your spot https://sinergija.live/en/lectures/33/azure-i-arhitektura-visoke-dostupnosti .

One week later you can find me on Microsoft Community conference in Sarajevo. This is one of my favorite conferences where everything is in relaxed mode. I will be redelivering same session as in Belgrade, probably adjusted with attendees input from Sinergija.

Register now because conference is free and number of seats is limited.

Last but not least, in December I have an honor to be co-organizer and technical reviewer for one of the best tech conferences in the region. Advanced technology Days steps boldly into 15th year of existence and it shows no wear or tear.

Register now and enjoy two days of pure tech fun!

Hope to see you on some of there conferences, feel free to stop by and talk.

Discover, assess and migrate servers

First tool is used to discover, asses an migrate servers, be it in VMware or Hyper-V environments. All one needs to do is select assessment and migration tools and deployment into subscription will begin.

After adding tools, we need to connect VMware or Hyper-V servers to assessment tools, be it Microsoft or 3rd party vendor tools and start the assessment process. We can change some assessment properties and run the process on discovered servers.

After the assessments is done, you get report on selected servers. More details are available if you click on Azure readiness or Cost details report pies.

When you are happy with assessment results, you can proceed with your selected migration tool and start migrating machines to Azure.

Azure migrate databases

Azure Database Migration Service enables seamless migrations from multiple database sources to Azure Data platforms with minimal downtime. The service uses the Data Migration Assistant to generate assessment reports that provide recommendations to guide you through the changes required prior to performing a migration. When you’re ready to begin the migration process, the Azure Database Migration Service performs all of the required steps.

https://docs.microsoft.com/en-us/azure/dms/

Select your assessment and migration tools, download DMA tool to start your assessment. Detailed steps on assessment can be found here.

Assess and migrate web apps to Azure

This tool is oriented into assessing web applications on public or private endpoints and giving you an option on migrating those applications to Azure App Service. It can assess .Net or PHP applications but it also supports Java, Ruby and other frameworks.

Migrate on-premises data to Azure

In case you need to migrate raw data to Azure from your on-premises data center, you can utilize Azure Data Box. After selecting source country and destination Azure region, you have an option to select type of data box or opt to send your own disks. All data is always encrypted and secured from any 3rd party access. More info on data box can be found here.

Architecture of the solution is decipted in this image

I did just that and it more or less worked perfectly. I had one simple issue and that is when I tries to create Azure Bastion host in Azure Marketplace. I got an error stating that my subscription is not registered for bastion resource type,

The subscription is not registered for the resource type ‘bastionHosts’. Please check that the resource type exists and re-register for this provider in order to have access to this resource type.

but it clearly shown as registered.

PS Azure:\> Get-AzureRmProviderFeature -ProviderNamespace Microsoft.Network

FeatureName       ProviderName      RegistrationState
-----------       ------------      -----------------
AllowBastionHost  Microsoft.Network Registered
AllowCortexAccess Microsoft.Network Registered

Azure:/
PS Azure:\>

Since this is in preview state, it will be fixed. Also it is possible that my Azure subscription was just acting up. So what I did, I created a Azure Bastion host directly from target vNet and it worked as charm!

After successful HTTPS connection to your host, you get a screen like this

Pricing information can be found here.

We will cover most important Azure topics, ranging from IaaS, PaaS, SaaS, security, migration and so on. This is a great opportunity to learn more and find out exciting new stuff that is coming your way.

Event is totally FREE and all you have to do is register yourself! Soon more info and detailed agenda will be available at Azure Bootcamp Zagreb official page www.azurebootcamp.eu.

This event is hosted by Tomislav from Nephos and Marin from Span. We would like to express our thanks to www.zicer.hr for providing meeting space and Microsoft for getting us some gadgets and catering!

See you there!

We can say that this was one of the predecessors of O365 service, and of course, as soon as Microsoft realized that this free feature may divert users from buying O365, they discontinued it. Pure business decision.

To be fair, if you are buying some of O365 personal/home subscriptions, you still have the option to add custom domain. Some very annoying limitations are that you can have only one domain attached, it must be managed by godaddy.com service and it has a limit of 5 email account.

After some time of contemplating and calculating, I decided to move my personal email domain from outlook.com to O365. Live Domains admin page is not available any more so I can not do it by myself and I was aware that I will have to contact Microsoft support to do this. After trying to add domain to O365 tenant this is a message you get:

At this point I created support ticket from my new O365 tenant and soon enough one of the support technicians contacted me. Nee I say that this one had no clue what Live Domains was and kept pointing me to login to that tenant and remove my domain. After 4 or 5 emails, I managed to skip first level support and move to next technician, who was smart enough to connect me to O365 Data protection team immediately .

The procedure with them was straight forward and consisted of few simple steps:

1. I had to prove that I owned the domain and had to add TXT record to domains DNS that support provided me
2. I had to prove that I own O365 tenant to which I was trying to add domain

After this was confirmed, technician force removed my domain from msarealms.onmicrosoft.com tenant and I was able to add it to my O365 tenant. Bare in mind that this transfer may take up to 48 hours to propagate, so in that period you will not be able to receive or send emails from your domain. In my case, it took less than 6 hours for everything to start working.

Couple of things to have in mind before you start:

1. MS support is not aware of Live Domains (in my case)
2. No one can list you all email account on your outlook.com connected domain (tried to find this out while I was MS employee and later via support)
3. Your custom domain name is only an alias in outlook.com so make sure you know your primary alias for outlook.com
4. You will need your name.surname@outlook.com alias to login to OneDrive, Azure portal, outlook.com or wherever you used your custom domain alias to login by using a Microsoft Account (LiveID) feature. Look here or create new one https://account.microsoft.com.
5. Backup all your email from outlook.com and restore it to 0365 once it is set up
6. My case took 2 weeks to resolve, but that is mostly because I was busy and did not have time to talk to support. I believe that this can be resolved in 2 days max.

To put cherry on top of all that, I have 3 more domain connected to Microsoft Live Domains.

This mini project came out from me trying to install and setup Pi-Hole on a Synology in a Docker container. Since my Synology setup is bit complicated I opted for public cloud setup and decided not to mess with my home networking.

Public cloud setup has some advantages and disadvantages over local installation. Main disadvantages are that you are exposing inbound port 53 to the Internet and sometimes latency to cloud service providers can be high. First issue can be tackled in multiple ways, by configuring VPN for public cloud VM, which adds to the cost ,or by utilizing firewall rules to allow only certain clients to access port 53 on your Pi-Hole. Later one can be tricky if you have dynamic IP addresses.

One of the main advantages is that Pi-Hole server in public cloud can be used for multiple clients and scaled as needed.

Lets see what I did and how I solves some of the issues along way.

Installation

In Azure portal I used already prepared Ubuntu image, selected standard disks, fixed IP address and Standard A1 v2 (1 vcpus, 2 GB memory) compute size. Initially I exposed only port 22 so I can administer the machine.

I then followed standard Pi-Hole installation procedure located on Pi-Hole document page.

I opted for Quad9 DNS provider although you can choose any other available or add custom. I did not modify any IP addresses of the VM since they are managed by Azure.

Password can be changed later on in command line with following command:

$ pihole -a -p
Enter New Password (Blank for no password):
Confirm Password:
[✓] New password set

After setup is complete you will be able to connect to your Pi-Hole admin page via http://ip-address/admin.

Post setup configuration

Task number one is to setup your clients to use Pie-Hole as DNS server. In my case, my home routers DHCP service is configuring all clients with 3 DNS servers, primary is Pie-Hole, secondary is 1.1.1.1 and tertiary is 8.8.8.8

Main issue in public cloud setup is port 53 which is opened for everyone. This is not good practice so you should employ some kind of protection. VPN adds cost so logical answer is firewall. Luckily, Ubuntu has iptables firewall which is easy to use and setup.

My issue was that I have dynamic IP address allocated from my ISP provides, so I had to devise a way to auto update firewall rules when my IP address changes. Ports that are needed are 22, 80 and 53. I decided to open port 22 for all so I do not have to worry on being blocked from accessing admin interface.

I created a small bash script and added it to cron so it runs every 5 minutes. Script looks like this:

ip="$(ufw status | egrep 53 | awk '{ print $3 }' | head -1)"
ipnew="$(dig +short YourDyndnsName | grep -Eo '[0-9\.]{7,15}' | head -1)"
if [$ip != $ipnew]
then
for NUM in $(ufw status numbered | grep -e 53 -e 80 | awk -F"[][]" '{print $2}' | tr --delete [:blank:] | sort -rn); do
    yes | ufw delete $NUM
done
ufw allow from "$ipnew" to any port 80
ufw allow from "$ipnew" to any port 53
else
exit
fi

First line gets current dynamic IP address stored in iptables rules list. Second one gets current IP address of my router which is connected to DynDns service. If those are different, script removes old IP address for ports 53 and 80 and then adds new rules with new IP address.

As mentioned, this runs as cron task every 5 minutes:

# m h  dom mon dow   command
*/5 * * * * /usr/local/sbin/ufwdynamichostupdate  2>&1 > /dev/null

Since script runs every 5 minutes, it is possible that at some point for some short time, clients will not be able to access Pi-Hole DNS. In that case, they will fall back to secondary DNS that is also provided by my home router.

When developing FreeNAS we run it as a VM. Our virtualization platform of choice is VMware, and it’s the platform in which the FreeNAS developers have the most experience. FreeNAS includes VMware tools as well. Our second choice for a virtualization platform is Citrix XenServer. FreeNAS has no tools built in for XenServer, but you get a solid virtualization experience nonetheless. Other hypervisors such as bhyve, KVM, and Hyper-V also work, but the development team does not use them on a daily basis.

https://www.freenas.org/blog/yes-you-can-virtualize-freenas/

So lets try to do it in Azure. There are several steps involved and they are very logical and straight forward. All steps are covered with screenshots so you can try it yourself.

Setting up FreeNAS on local Hyper-V host as virtual machine.

First I created empty 20 GB fixed size VHD file that will be used for FreeNAS virtual machine in my Hyper-V host.

New-VHD -Path d:\FreeNAS-OS-Disk.vhd -Fixed -SizeBytes 20GB

After that, I simply created new Gen1 virtual machine with 2 CPUs and 8 GB of RAM. It for this purpose does not need network connection. Before starting VM, I downloaded and mounted FreeNAS ISO image as boot device.

After starting virtual machine and booting into installation (option 1 in menu), couple of minutes later and few simple menu screens, FreeNAS was installed. At this point I turned off VM to start with next steps.

Move FreeNAS VHD to Azure storage account

I had two options here and as title suggests, I selected option two. Option one was Azure Site Recovery, which I had already setup for some earlier PoC and testing but for some reason it gave me some errors when I tried to replicate FreeNAS VM from local Hyper-V to Azure.

Tool of choice for option 2 is of course Azure Storage Explorer. In Azure I created new storage account and one container in blob storage part for VHD. Upload took less than a minute.

After uploading VHD to Azure Blob storage, we need to convert this VHD to managed disk to be used in new VM in Azure. Go to Disks service and select Add option to add new disk.

Most important part here is to choose VHD that you just uploaded as Source blob for new managed disk. In my case I choose Standard VHD and selected Linux as OS type in a disk.

Create new VM in Azure that boots from FreeNAS VHD

Select newly created managed disk and select option Create VM. Mine is grayed out since I have already done that.

Make sure you select Azure VM with at least 8 GB of RAM and 2 CPU cores. After creation, VM will boot up.

Post VM creation configuration

Go to your virtual machine and select Boot diagnostics option, you should see something similar to this:

Make sure to open required ports to your Azure VM (22 and 80 or 443).

If everything went as expected, when connecting to VMs public IP you should see login screen. Enter your credentials that you created during initial configuration and login to your FreeNAS on Azure appliance.

FreeNAS uses FreeBSD as core operating system, and it is available and supported in Azure. This setup can be used in testing environments and for PoC purposes. FreeNAS development team has some caveats when virtualizing FreeNAS in any way due to possible issues with ZFS.

If best practices and recommendations for running FreeNAS under virtualization are followed, FreeNAS and virtualization can be smooth sailing. However, failure to adhere to the recommendations and best practices below can result in catastrophic loss of your ZFS pool (and/or data) without warning.

https://www.freenas.org/blog/yes-you-can-virtualize-freenas/

Selected method of migration at this point was Azure Site Recovery service, since there where multiple steps to be taken and Azure Migrate as of time of writing this post still does not support migrating from Hyper-V (it is in private preview).

SAP virtual machines are currently residing on production Hyper-V host and are placed in separated test and dev VLAN. Since we can not install anything on production Hyper-V hosts, we have devised following solution:

1. Turn of all VMs and commit all changes
2. Copy VHDX files over network to test Hyper-V server
3. Recreate VMs on test Hyper-V server and use copied VHDX files
4. Setup ASR in Azure and install required agent on test Hyper-V
5. Migrate SAP VMs to my test and dev subscription

I have setup new Azure Site Recovery vault and added test Hyper-V server to it.

During Azure Site Recovery replication setup I will create storage account for SAP virtual machines and virtual network that will be used to fail over machines to once replicated.

Replication policy will be created and associated with site in Azure. After that, I configured replication of a SAP VM and started initial replication.

Replication status can be monitored from Azure dashboard or from Hyper-V replication settings for selected virtual machine.

I recommend you to do a test failover after migration. When VM boots, add public IP address and try to connect to it via RDP. If your environment requires more secure RDP connection, you can deploy VPN gateway in test VNET and connect to VM through VPN rather than through public IP.

When you are satisfied with results, go to your Recovery Services Vault, select your replicated VM and click on “Cleanup test failover” so you can do “Planned Failover” when ready.

Just about when I successfully installed Azure Stack on Azure VM, internal IT manager called me and informed me that we have one Gen8 HP server that became available and could now be utilized for Azure Stack on “bare metal” installation. I was delighted. make sure your hardware meets these simple prerequisites . I highly recommend you to run this Power Shell script that will additionally check that your hardware is adequate for Azure Stack SDK.

Preparation

Server has two OS disk setup as mirror and additional five 900 GB disk that I had to setup as separate volumes. Also, I had at my disposal 2x 12 core Intel CPUs and 256 GB of RAM. Plenty of room to play with Azure Stack.

I immediately started with server preparation via iLO interface (which is simply fabulous tool) and came to my first obstacle. Disk controller lacked cache memory and was hence limited in creating of maximum two volumes per server. I asked my team lead to purchase cache memory (cca. 30€ per module) so I can proceed with installation. Two weeks later module was installed and setup was continued.

Before booting into cloudbuilder.vhdx and starting actual installation, make sure you have prepared Azure AD and know Azure AD global administrator username and password (I simply created new Azure AD in my existing Azure subscription). Also, select and test one NTP server IP address since this may lead to instant installation failure.

Instalation

Download and extract required files.

Start the installation process with following Power Shell commandlet

PS C:\AzureStack_Insaller> .\asdk-installer.ps1

Start the installer again

PS C:\AzureStack_Insaller> .\asdk-installer.ps1

After these settings you will need to define network card that is to be used with Azure Stack, IP addressing scheme (static or DHCP ), valid time server and VLAN ID if you use it. These settings will be applied to BGPNAT01 virtual machine in your azure stack environment. 

Note: 

Make sure you select working IP address for NTP server and that you have either static IP address prepared or DHCP enabled in network. Failure to do so will result in failure of Azure Stack deployment. It is possible to rerun Azure Stack deployment after a failure just by running installation script again. Of course, make sure you rectify any errors before that. Since Azure Stack requires only one network card to be enabled on host, I disabled the wrong one so I had to restart the process. Also, first time around my selected time server was not responding so installation failed again. 

Deployment will take about 6 hours depending on hardware that you are using. At the end, if everything goes as planned, you should see screen similar to this one.

Post installation configuration

Most important post installation steps can be found on this Microsoft page. Make sure ti run Azure test Power Shell command to verify successful installation. 

PS C:\>Enter-PSSession -ComputerName AzS-ERCS01 -ConfigurationName PrivilegedEndpoint
[AzS-ERCS01]: PS> Test-AzureStack

Output should look like this

You should now be able to connect to your Azure Stack portal and login with administrative credentials, https://adminportal.local.azurestack.external.

Register your Azure Stack with Azure

Install required tools and uninstall all non required or conflicting tools from Azure Stack host environment. Follow instructions on this page to do so.

Then register Azure Stack by running this script:

# Add the Azure cloud subscription environment name. 
# Supported environment names are AzureCloud, AzureChinaCloud or AzureUSGovernment depending which Azure subscription you are using.
Add-AzureRmAccount -EnvironmentName "AzureCloud"

# Register the Azure Stack resource provider in your Azure subscription
Register-AzureRmResourceProvider -ProviderNamespace Microsoft.AzureStack

#Import the registration module that was downloaded with the GitHub tools
Import-Module C:\AzureStack-Tools-master\Registration\RegisterWithAzure.psm1

#Register Azure Stack
$AzureContext = Get-AzureRmContext
$CloudAdminCred = Get-Credential -UserName AZURESTACK\CloudAdmin -Message "Enter the credentials to access the privileged endpoint."
$RegistrationName = "<unique-registration-name>"
$UsageReporting = $true # Set to $false if using the Capacity Billing model
Set-AzsRegistration `
-PrivilegedEndpointCredential $CloudAdminCred `
-PrivilegedEndpoint AzS-ERCS01 `
-BillingModel Development `
-RegistrationName $RegistrationName `
-UsageReportingEnabled:$UsageReporting

It will take up to 10 minutes to complete the registration process. At the end you should see result like this

Verify that you can access Azure Marketplace by opening 
 https://adminportal.local.azurestack.external, select “Marketplace management” and then select “Add from Azure”. Now you should see some marketplace items like bellow

Final thoughts

Configuration and installation of Azure Stack SDK is pretty much straight forward if you plan in advance. Most errors are related to IP addressing scheme, network card setup and local or AD credentials. 

In some future posts I will describe how to add additional resource providers such as MySQL, MS SQL and Application service providers.

At the end of this article please note that there is specific way how to turn off Azure Stack environment in case you want to do some maintenance on host itself.

PS C:\>$cred = Get-Credential
PS C:\>Enter-PSSession -ComputerName azs-ercs01 -ConfigurationName PrivilegedEndpoint -Credential $cred
PS C:\>Stop-AzureStack

This is going to take about 30 minutes since there are 15 VMs running in background. When Power Shell command completes Azure Stack shutdown of virtual machines it will shutdown Azure Stack host server.

To start it up again, just start Azure Stack host  and wait about 30 minutes for everything to boot up in it.

Please skip first couple of minutes (cca. 5) since it is a recording of me setting up my laptop and microphone. At the end I had to remove mic because it was to loud and interfered with sessions next door. I was not able to cut out this part because some technical difficulties with my recording software.

Recording is in Croatian language. 

Down bellow you can download presentation PDF.

So I decided to follow this great blog from Ned and utilize his Azure ARM template and scripts (bit modified for my needs) to deploy Azure Stack in Azure VM. Preparation is key for success so be sure to read instructions carefully and follow steps all the way through.

I am awaiting hardware to arrive, but since I am bit impatient, I decided to go with Azure. One of the most important things is that this is not free and it will cost you significantly.

This is test/demo environment, so it is recommended to de-allocate host VM in Azure when not needed.

Since this is not normal VM and you have Azure Stack running in it, de-allocating it from Azure portal before shutting down Azure Stack,  is not recommended way to do it. You need some additional steps, so from the host, execute the following commands:

$cred = Get-Credential
Enter-PSSession -ComputerName azs-ercs01 -ConfigurationName PrivilegedEndpoint -Credential $cred
Stop-AzureStack

This is going to take about 30 minutes since there are 15 VMs running in background. When PowerShell command completes Azure Stack shutdown of virtual machines it will shutdown host VM.

You must de-allocate host VM from Azure portal to stop compute charges.

To start it up again, just start Azure host VM and wait about 30 minutes for everything to boot up in it.

Please be aware that Microsoft does not support this scenario and in troubleshooting you are on your own.

Next step is to connect your Azure Stack to Azure marketplace. Follow Neds blog and you should be fine.

Happy Stacking!

Of course, that was just lame attempt to not go to sleep , but it got me thinking that it would definitely be cool feature to have in Unifi controller. My controller is running in Ubuntu virtual machine in Azure, so this was a case of creating two scripts that would use Cron to run and turn off and on all LED light on all APs.

My controller is set up to control LED status of all devices and devices are set up to obey controllers settings.

After some time on tinkering and searching I came up with viable solution that works, until UBQT exposes it in GUI of the controller. You can vote for this feature here.

Script to turn OFF LED lights:

#!/bin/sh

username=Admin username
password=Admin password
baseurl=https://localhost:8443
site=default
cookie=/tmp/unifi_cookie

curl_cmd="curl --tlsv1 --silent --cookie ${cookie} --cookie-jar ${cookie} --insecure "
${curl_cmd} --data "{'username':'$username', 'password':'$password'}" $baseurl/api/login

${curl_cmd} --data "{ 'led_enabled': false}" $baseurl/api/s/$site/set/setting/mgmt

Script to turn ON LED lights:

#!/bin/sh

username=Admin username
password=Admin password
baseurl=https://localhost:8443
site=default
cookie=/tmp/unifi_cookie

curl_cmd="curl --tlsv1 --silent --cookie ${cookie} --cookie-jar ${cookie} --insecure "
${curl_cmd} --data "{'username':'$username', 'password':'$password'}" $baseurl/api/login

${curl_cmd} --data "{ 'led_enabled': true}" $baseurl/api/s/$site/set/setting/mgmt

Notice the only difference is in line 12, true or false. If you want this to run on your first created site, value for variable site should default. If you want it to run on different site in controller, use site name for value.

I have created two files on Ubuntu and saved them as .sh so they can be executed. Nano is my preferred editor although I have been seen using vi editor in extreme situations :).

Do not forget to use  chmod command so the file can be executed.

chmod +x filename.sh

After that, by simple editing Crontab with

Crontab -e

and adding these lines in it

0 21 * * * /PathToYourFiles/unifi_led_disabled.sh >/dev/null 2>&1
0 8 * * * /PathToYourFiles/unifi_led_enabled.sh >/dev/null 2>&1

I have scheduled LED lights to go off every day at 21:00 and to turn on every day at 08:00.

If you are not familiar with Cron syntax I can recommend you this easy to use online Cron generator. For some of these action you will need root privileges. Script can also be set at user level instead of root which is the recommended way.

Scripts could definitely be modified to turn on or off selected APs and not all of them, but I do not have that many so this works for me. Feel free to comment and add your input.

If you are attendee, please register as seats are limited and interest is huge. This year I am taking pat as organizer (member of session election committee) and hopefully as speaker also.

Location of the conference is at Plaza Event Center (ex. Hypo congress center.) 

Home network

My home network is product of pure anger during one of everyday tasks, such as copying files from NAS to laptop via WiFi. As everybody else, I had some crappy router that my ISP provided to me. Every time I tried to copy large files over WiFi, everything else on network dies. So I decided to separate all functions of network and circumvent ISP router for local traffic altogether. 

I decided to go with Ubiquity and its Unifi range of equipment. I purchased the following:

• Unifi Switch 8 – 60W
• Unifi USG 3
• Unifi AP AC Pro
• Unifi AP AC LR

ISP router is now configured in bridge mode and USG is dialing PPOE connection over FTTH with 200/100 speed. 

Storage and multimedia

After setting up network part and tweaking it to my needs I initially purchased Synology DS216play NAS, which after some time proved to be bad choice since it was under performing so I upgraded to DS918+ (setup as RAID 5 with four 4 TB disks). Main purpose for this device was to backup data on it, stream multimedia in local network and stream multimedia to remote locations. Multimedia players that would connect to NAS where ranging from Android TV and its Kodi application, native Synology DS Video app, Plex player and various versions of Chromecast device. Also, NAS was serving as Surveillance station for multiple Hikvision cameras.

Some devices are connected over Ethernet, some over WiFi and some over external Internet connection. Synology NAS is published securely to Internet so I can access it any time. It utilizes SSL cert, username and password and 2FA code. 

Sync and backup

On the software side I am using Office 365 Home for syncing my wife phone and my own, directly to OneDrive. O365 gives me 1 TB of storage for 5 users and Office licences for multiple devices.

For backup purposes, I am using AllwaySync software on my computers to do one way sync of data to Synology NAS.

Sync and backup workflow works like this:

1. Both Android phones are setup so they sync all photos from local storage to OneDrive
2. On each PC I have AllwaySync software that syncs one way to NAS on scheduled basis and manually
3. Synology NAS pulls OneDrive data locally as items arrive in OneDrive
4. Synology creates backup every day in Azure Cool Storage. Besides OneDrive and PC backup data I also backup some additional folders from NAS
5. From time to time I manually backup Synology data to external USB (this is to be automated by attaching disk directly to NAS and setting up schedule for backup)

Price and conclusion

Besides one time NAS and disks cost, there is additional cost which is monthly or yearly reoccurring. Azure Cool Storage in West Europe, LRS,  cost is $17 per month for cca. 500 GB of data. I am using 30 days retention. O365 Home subscription costs cca. $100 per year.

Besides these devices, I have also connected Playstation 4, Sony BD player, Netatmo smart thermostat, Air Condition and Roomba.

Main idea of this setup was to easily have backups of multiple devices (mainly images).  Also, regarding multimedia, I wanted to manage everything with one remote and to be able to stream my multimedia files anywhere (bedroom, hotel rooms, apartments and so on). One important need was ability to circumvent ISP router for local network and network to be managed (in this case via Unifi controller that is running in Azure as Linux VM). At some point, controller will be moved to Azure Container Instance.

Feel free to comment below or contact me if you need more detailed setup instructions for any of these components. 

Windays 18 Azure Virtual Networking

MS Network 8 Azure Backup As A Service

My session will be about different Azure scenarios that you can use and how to use them in a proper way. If you are interested, please join me in Križevci, on 22.9.2018. at 14:45.

As always, during the reorganization, some employees are left behind, so I was looking for new opportunities in Croatia and elsewhere. Luckily, I managed to find new position within best Microsoft partner in region, Span, and now I hold a position of Senior Solutions Architect, covering cloud and infrastructure products and solutions and taking part is some very exciting projects. 

I will revive this blog, but it will go in different direction this time. I will try to focus on architecting solutions based on Azure public cloud and related on-prem technologies in supported hybrid scenarios. From time to time I will also do videos and I will post my conference sessions.