4 ms·

Off topic, but as a network guy by heart I've always been fairly happy with how AWS implements the network side of things, especially in comparison to something

Off topic, but as a network guy by heart I've always been fairly happy with how AWS implements the network side of things, especially in comparison to something like Azure. AWS you have the same basic concepts of a network, and the terminology aligns enough that you can make sense of it fairly quick if you're in the network realm. Azure however takes all of that 'network' stuff and turns it into this abstraction where you have to carefully follow one of their guides to realize it's out of date, or the UI doesn't show the appropriate information etc. Also you have Azure network portions that block ICMP because of 'security'. This is all anecdotal from my experience of course, but it's why I keep referring to Azure as the "Excel spreadsheet of the cloud" because the entire design of it is in your face and non intuitive. For instance if I wanted to make a direct connection like DirectConnect to multiple VPC's in AWS, I'd use the Transit Gateway, connect to it from on-prem, add the VPC and the route, and be done. In Azure, I'd use expressroute, add the Expressroute circuit to a Subscription, add a gateway for that, and then an additional gateway for each VPC equivalent, create an authorization key for each 'VPC' equivalent and sync them, and then define routing per gateway. Then when you go in to trace the network path ICMP is blocked. I know AWS is more mature than Azure, so it's not entirely fair to criticize them, but every time I touch Azure I miss AWS, or even GCP. Perhaps it's just me not being familiar enough with Azure. ¯\_(ツ)_/¯

filmgirlcw 8y ago
Microsoft employee here - I don’t work specifically on the networking side of Azure but this is really good feedback that I’ll share with the product teams.
- bg24 8y ago
  I do not and did not work for Microsoft, but love this very attitude.
  - late2part 8y ago
    Well, it’s pointless, really. They’ve been given feedback that blocking I Mp is harmfulmsince 2011 and it’s done no good.
    - CloudNetworking 8y ago
      Disclaimer: I have worked for Azure in the past -not anymore- and specifically in Networking. Do you have evidence that they've been saying they block ICMP because of security reasons that I can forward to the right folks? I can help getting this feedback to them to correct that, because I can guarantee 100% that's not the reason why ICMP is not forwarded by the SLB (and engineering/PM would never say it's for security reasons).
      - late2part 8y ago
        I don’t know why they do it and I didn’t say it’s because of security. It’s harmful enough to my experience that I haven’t used them since.
tlynchpin 8y ago
Transit Gateway was announced at re:invent 2018. That's a few months ago. DirectConnect Gateway and Transit VPC were announced the year before. I would guess about nobody is currently in production with Transit Gateway.
- Hikikomori 8y ago
  Currently testing it, can do lots of fun stuff with the routing domains. Will roll it out once they get Direct Connect support in Q1.
- curiouserrr 8y ago
  Except you can’t yet do cross-account transit, which makes their Transit VPC offering pretty much useless. The whole point of transit is so you can talk to other VPCs across accounts.
  - joemag 8y ago
    EC2 engineer here. You can connect transit gateway to VPCs owned by different accounts.
    - Hikikomori 8y ago
      Will BYOIP be sharable with RAM?
  - Hikikomori 8y ago
    You can. Share it with Resource Access Manager, can even share it to accounts outside of your own AWS organisation.
deepsun 8y ago
What about GCP? I've always heard that Google is way better at networking, at least internally (having their own cables, basically own internet), is that true for their public cloud?
- MoOmer 8y ago
  Mixed reviews from me on GCP. Some of their services don’t offer many of the network controls that you might expect. IIRC network rules with cloud functions and managed database services were a painpoint for a pet project of mine. Whereas with AWS, there might be quirks, but the ability to configure your network across most services is done so well that it’s a huge differentiator.
baseballMan 8y ago
Yeah virtual network gateways in Azure are probably the lamest feature ever. Takes literally 40+ minutes to provision one. I've worked about 2+ years on Azure and 5-6 months on AWS and while they both of course have their pros and cons, I prefer AWS for things like this. I do love ARM templates though. <3
CloudNetworking 8y ago
Disclaimer: I have worked for Azure in the past -not anymore- and specifically in networking. There's a few things I agree (the UI, even though I like it more than the AWS UI, is not my all time favourite GUI application) and others I disagree, but I wanted to correct some things about your specific example as I'm sure you'll find the information useful: > In Azure, I'd use expressroute, add the Expressroute circuit to a Subscription, Anything you create is created inside a subscription and those are not separate steps. > add a gateway for that, and then an additional gateway for each VPC equivalent, That's accurate and by design. Each VNet needs their ExpressRoute gateway - that's unless you peer those VNets, then you can use the "hub vnet"'s gateway for all of them, e.g.: https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/hub-spoke https://docs.microsoft.com/en-us/azure/architecture/referenc... > create an authorization key for each 'VPC' equivalent and sync them, Only if those VNets belong to other subscriptions, that's why you have to authorize them as the owner of the ExpressRoute. Depending on how your company has structured their access to Azure (they might have a subscription only for ER circuits, I've seen that a few times) you'll need to do this or not. > and then define routing per gateway. Not sure what you mean by "define routing". ExpressRoute uses BGP and learns routes from on-prem and from the VNet itself. > Then when you go in to trace the network path ICMP is blocked. ICMP is not forwarded by the Azure Load Balancer, but the load balancer is not in the path of traffic between on-premises and your VNets. You totally be able to traceroute to/from on-prem in an ExpressRoute scenario. Also, as per the transit gateway I believe the equivalent might be the Virtual Want https://docs.microsoft.com/en-us/azure/virtual-wan/virtual-wan-about https://docs.microsoft.com/en-us/azure/virtual-wan/virtual-w... but I haven't really dug much into it yet. As far as I'm aware it doesn't support ExpressRoute at the moment. All in all I believe your opinion is biased due to what you're used to (unconscious bias, plz don't get me wrong). I had the similar feeling when going to AWS, but after using it daily for some time you see the rationale behind the (different) product design decisions. We're humans, that's how our brain works! :) Now on the other hand, I've got this daily AWS exposure for the last few months and it's very similar networking-wise. Heck, I even guessed existing features based on troubleshooting + my previous Azure knowledge (I'm looking at you "Src dst check" https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html#change_source_dest_check https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-en... - AKA "IP Forwarding" in Azure).

filmgirlcw 8y ago

Microsoft employee here - I don’t work specifically on the networking side of Azure but this is really good feedback that I’ll share with the product teams.

bg24 8y ago
I do not and did not work for Microsoft, but love this very attitude.
- late2part 8y ago
  Well, it’s pointless, really. They’ve been given feedback that blocking I Mp is harmfulmsince 2011 and it’s done no good.
  - CloudNetworking 8y ago
    Disclaimer: I have worked for Azure in the past -not anymore- and specifically in Networking. Do you have evidence that they've been saying they block ICMP because of security reasons that I can forward to the right folks? I can help getting this feedback to them to correct that, because I can guarantee 100% that's not the reason why ICMP is not forwarded by the SLB (and engineering/PM would never say it's for security reasons).
    - late2part 8y ago
      I don’t know why they do it and I didn’t say it’s because of security. It’s harmful enough to my experience that I haven’t used them since.

tlynchpin 8y ago

Transit Gateway was announced at re:invent 2018. That's a few months ago. DirectConnect Gateway and Transit VPC were announced the year before. I would guess about nobody is currently in production with Transit Gateway.

Hikikomori 8y ago
Currently testing it, can do lots of fun stuff with the routing domains. Will roll it out once they get Direct Connect support in Q1.
curiouserrr 8y ago
Except you can’t yet do cross-account transit, which makes their Transit VPC offering pretty much useless. The whole point of transit is so you can talk to other VPCs across accounts.
- joemag 8y ago
  EC2 engineer here. You can connect transit gateway to VPCs owned by different accounts.
  - Hikikomori 8y ago
    Will BYOIP be sharable with RAM?
- Hikikomori 8y ago
  You can. Share it with Resource Access Manager, can even share it to accounts outside of your own AWS organisation.

deepsun 8y ago

What about GCP? I've always heard that Google is way better at networking, at least internally (having their own cables, basically own internet), is that true for their public cloud?

MoOmer 8y ago
Mixed reviews from me on GCP. Some of their services don’t offer many of the network controls that you might expect. IIRC network rules with cloud functions and managed database services were a painpoint for a pet project of mine. Whereas with AWS, there might be quirks, but the ability to configure your network across most services is done so well that it’s a huge differentiator.

baseballMan 8y ago

Yeah virtual network gateways in Azure are probably the lamest feature ever. Takes literally 40+ minutes to provision one. I've worked about 2+ years on Azure and 5-6 months on AWS and while they both of course have their pros and cons, I prefer AWS for things like this. I do love ARM templates though. <3

CloudNetworking 8y ago

Disclaimer: I have worked for Azure in the past -not anymore- and specifically in networking. There's a few things I agree (the UI, even though I like it more than the AWS UI, is not my all time favourite GUI application) and others I disagree, but I wanted to correct some things about your specific example as I'm sure you'll find the information useful: > In Azure, I'd use expressroute, add the Expressroute circuit to a Subscription, Anything you create is created inside a subscription and those are not separate steps. > add a gateway for that, and then an additional gateway for each VPC equivalent, That's accurate and by design. Each VNet needs their ExpressRoute gateway - that's unless you peer those VNets, then you can use the "hub vnet"'s gateway for all of them, e.g.: https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/hub-spoke https://docs.microsoft.com/en-us/azure/architecture/referenc... > create an authorization key for each 'VPC' equivalent and sync them, Only if those VNets belong to other subscriptions, that's why you have to authorize them as the owner of the ExpressRoute. Depending on how your company has structured their access to Azure (they might have a subscription only for ER circuits, I've seen that a few times) you'll need to do this or not. > and then define routing per gateway. Not sure what you mean by "define routing". ExpressRoute uses BGP and learns routes from on-prem and from the VNet itself. > Then when you go in to trace the network path ICMP is blocked. ICMP is not forwarded by the Azure Load Balancer, but the load balancer is not in the path of traffic between on-premises and your VNets. You totally be able to traceroute to/from on-prem in an ExpressRoute scenario. Also, as per the transit gateway I believe the equivalent might be the Virtual Want https://docs.microsoft.com/en-us/azure/virtual-wan/virtual-wan-about https://docs.microsoft.com/en-us/azure/virtual-wan/virtual-w... but I haven't really dug much into it yet. As far as I'm aware it doesn't support ExpressRoute at the moment. All in all I believe your opinion is biased due to what you're used to (unconscious bias, plz don't get me wrong). I had the similar feeling when going to AWS, but after using it daily for some time you see the rationale behind the (different) product design decisions. We're humans, that's how our brain works! :) Now on the other hand, I've got this daily AWS exposure for the last few months and it's very similar networking-wise. Heck, I even guessed existing features based on troubleshooting + my previous Azure knowledge (I'm looking at you "Src dst check" https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html#change_source_dest_check https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-en... - AKA "IP Forwarding" in Azure).