Menu

Showing posts with label Cloud Security. Show all posts
Showing posts with label Cloud Security. Show all posts

3 Feb 2026

🌩️ Azure Session 1 – Cloud Computing Basics

Cloud Computing Basics

Cloud Computing Basics

Target Audience: Beginners, DevOps Engineers, Middleware Administrators, AZ-900 & AZ-104 aspirants.


☁️ What is Cloud Computing?

Cloud Computing is the delivery of computing services such as servers, storage, databases, networking and software over the internet instead of using physical hardware in your own data center.

  • No need to buy physical servers
  • Resources can be created in minutes
  • Scalable and flexible
  • Pay only for what you use

☁️ Cloud Service Models

  • IaaS (Infrastructure as a Service): Virtual servers, storage and networks.
    Use: Full control over OS and applications (Azure Virtual Machines).
  • PaaS (Platform as a Service): Platform and runtime without managing servers.
    Use: Fast application deployment (Azure App Service, Azure SQL).
  • SaaS (Software as a Service): Fully managed software.
    Use: Ready-to-use applications (Microsoft 365).

☁️ Cloud Deployment Models

  • Public Cloud: Shared cloud infrastructure.
    Use: Cost-effective and scalable. like AWS, Azure, GCP [Pay As you Go]
  • Private Cloud: Dedicated infrastructure.
    Use: High security and compliance. like Azure Stack and AWS Outposts
  • Hybrid Cloud: On-premise + cloud.
    Use: Enterprise flexibility.
  • Multi-Cloud: Multiple cloud providers.
    Use: Avoid vendor lock-in. if one providers gets stuck others can be present

⚡ Cloud Characteristics (NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY- NIST)

  • On-Demand Self Service
  • Broad Network Access
  • Resource Pooling
  • Rapid Elasticity
  • Measured Service (Pay-as-you-go)

🌍 User Location & Latency

Latency: Delay between request and response.
Use: Deploy applications near users for better performance.


πŸ“Š Data Types in Cloud

  • Structured Data: SQL databases
  • Unstructured Data: Images, videos, logs
  • Semi-Structured Data: JSON, XML

πŸ›️ Compliance & Data Residency

Some industries require data to stay in specific countries due to legal rules.
Use: Banking, Finance, Healthcare, Government.


πŸ” Conditional Access

Controls access based on user identity, device and location.
Use: Block access from unknown or insecure devices.


πŸ—️ Azure Resource Hierarchy

  • Management Groups
  • Subscriptions
  • Resource Groups
  • Resources

🌐 Hub-and-Spoke Network Model

Central hub contains firewall and security services, while spokes host applications.
Use: Cost saving and centralized security.


πŸ“Š Logs vs Metrics vs Alerts

  • Logs: Event records
  • Metrics: Performance values (CPU, memory)
  • Alerts: Notifications when limits crossed

☁️ Cloud Bursting

Extra workload moves to cloud when on-premise capacity is full.
Use: Payroll processing, exam systems.


🏒 Business Continuity vs Disaster Recovery

  • Business Continuity (BCP): Keep business running
  • Disaster Recovery (DR): Recover systems after failure

πŸ§‘‍πŸ’Ό Identity & Access Management (IAM)

Manages users and their access to resources.
Use: Azure Active Directory, RBAC, MFA.


πŸ“Š Subscription Limits & Quotas

Limits resources to prevent misuse and control cost.


πŸ’° Cloud Pricing Models

  • Pay-as-you-go: Pay only for usage
  • Reserved Instances: Discount for long-term usage
  • Spot Instances: Low-cost unused capacity

🌐 Cloud Networking

  • VNet (Virtual Network): Private network for cloud resources.
    Use: Secure communication.
  • Subnet: Smaller network inside VNet.
    Use: Separate web, app and database layers.
  • NSG (Network Security Group): Firewall rules.
    Use: Allow or block traffic.
  • Load Balancer: Distributes traffic.
    Use: High availability.
  • VPN (Virtual Private Network): Secure tunnel to cloud.
    Use: Connect office to cloud.
  • ExpressRoute: Private dedicated connection.
    Use: Faster enterprise connectivity.

🚚 Cloud Migration – 6R Strategy

  • Rehost (Lift and Shift):
    Move applications from on-premise to cloud without changing their design.
    Use: Fast migration when you want minimal changes and quick cloud adoption.

  • Refactor:
    Modify application architecture to use cloud-native features like auto-scaling and managed databases.
    Use: Improve performance, scalability, and long-term cost efficiency.

  • Replatform:
    Move applications to cloud with small optimizations but without full redesign.
    Use: Gain some cloud benefits while keeping application structure mostly same.

  • Retire:
    Remove applications that are no longer needed or used.
    Use: Reduce cost and simplify IT environment by eliminating unused systems.

  • Retain:
    Keep certain applications on-premise due to security, compliance, or technical reasons.
    Use: When apps cannot be moved to cloud immediately.

  • Replace:
    Replace existing applications with cloud-based SaaS solutions.
    Use: Modernize systems using ready-made cloud software (example: replace on-prem email with Microsoft 365).

πŸ“ˆ Scaling in Cloud

  • Vertical Scaling: Increase CPU or RAM
  • Horizontal Scaling: Add more servers
  • Auto Scaling: Automatic scaling based on load

πŸ” Cloud Security Concepts

  • HTTPS (HyperText Transfer Protocol Secure)
  • RBAC (Role-Based Access Control)
  • NSG (Network Security Group)
  • JIT (Just-In-Time)
  • MFA (Multi-Factor Authentication)

🧠 Cloud Computing Interview Questions

What is Cloud Computing?

Delivering IT services over the internet using pay-as-you-go model.

Difference between Backup and DR?

Backup stores data; DR restores systems.

What is Hybrid Cloud?

Combination of on-premise and cloud.

What is RPO and RTO?

RPO - Recovery Point Objective = How much data loss (time wise) is acceptable if a disaster occurs

RTO -Recovery Time Objective = How quickly the system must be back online after a failure.


πŸ’Ό Enterprise Real-World Scenarios

  • Banking app deployed in multi-region
  • Jenkins CI/CD hosted on Azure VM
  • Healthcare data stored in India region
  • E-learning platform auto scales
  • VPN connection from office to cloud

✅ Key Takeaways

  • Cloud computing is scalable and cost-effective
  • Security and compliance are critical
  • Understanding fundamentals helps interviews
  • Azure supports enterprise workloads

25 Oct 2025

🌐🧱 Enterprise Network Architecture — Akamai, DNS, WAF, DMZ, SSL & Firewall Flow Explained for Middleware & DevOps EngineersπŸ”’πŸ”‘

  • 🏒 In an enterprise environment, understanding how network traffic flows from users to internal applications is essential for performance, security, and compliance.
  • 🌐 This post explains the complete inbound and outbound flow — covering DNS, Akamai WAF, Firewall, DMZ, and SSL certificate management across enterprise systems.


πŸ—Ί️ Network Flow Diagram

πŸ”Ή Inbound Flow (User → Application → Database):
🌐 User → 🧭 Akamai DNS → πŸ›‘️ Akamai WAF → 🚧 Firewall → 🏰 DMZ → πŸ“‘ Load Balancer → πŸ–₯️ Web Server → ⚙️ App Server → πŸ’Ύ Database


πŸ”Ή Outbound Flow (Internal App → Internet):
πŸ–₯️ VM/App → 🧭 Internal DNS → πŸ›‘️ Proxy Server → πŸšͺ Firewall (SNAT) → 🌍 Internet


🧰 Setup Phase (One-Time Configurations)

  • 🧭 DNS (Domain Name System): Resolves domain names into IP addresses for user access.
  • πŸ“„ A Record: Maps a domain name to an IP address (e.g., app.company.com → 104.85.32.11).
  • DNS Validation: Verifies domain ownership during SSL or CDN setup using a TXT record.
  • πŸ”’ SSL Certificate Setup: Enables secure HTTPS communication between users and servers.
  • 🌍 Public SSL (Internet Apps): Managed by Akamai CPS, DigiCert, or Let’s Encrypt.
  • 🏒 Internal SSL (Intranet Apps): Used for applications accessed inside an organization’s private network — typically using Microsoft ADCS or HashiCorp Vault PKI for certificate management. Additionally, internal SSL certificates are often deployed directly on web servers such as:
    • 🌐 Apache HTTP Server — configured in ssl.conf or virtual host files.
    • ⚙️ NGINX — defined using ssl_certificate and ssl_certificate_key directives.
    • πŸͺŸ Microsoft IIS — managed via IIS Manager or PowerShell scripts.
    • πŸ–₯️ IBM IHS or F5 / Radware — for SSL termination or offloading at the load balancer level.
  • πŸ›‘️ Firewall & DMZ Setup: Protects internal systems from public exposure.

🌐 How CDN & DNS Flow Works

Let’s simplify what happens when someone accesses https://app.company.com and you’re using a CDN like Akamai:

  1. 🧭 DNS resolution (First Step)
    app.company.com → app.company.com.edgesuite.net # The domain is not directly mapped to your firewall. Instead, it's pointed to Akamai’s CDN hostname (CNAME). This lets Akamai handle global routing, SSL, and caching before hitting your network.
  2. 🌍 Akamai Edge IP resolution
    app.company.com.edgesuite.net → 104.85.32.11 # Akamai DNS picks the nearest edge server IP based on user location. This gives low latency and faster content delivery (geo-DNS routing).
  3. πŸ›‘️ User connects to Akamai Edge
    Akamai Edge performs:
    - WAF (Web Application Firewall) checks
    - SSL/TLS termination
    - Content caching for faster response
    - Origin fetch (only if needed) # The user’s browser never touches your firewall directly. Akamai acts as the “front door” — securing, filtering, and caching content. This is where DDoS protection and certificate validation happen.
  4. 🏰 CDN connects to your enterprise public IP
    Akamai Edge → 203.122.10.55 # Akamai now makes a backend (origin) call to your organization’s public IP. This IP is provided by your ISP and configured on your enterprise firewall as a VIP (Virtual IP). It represents your app’s public presence on the Internet.
  5. 🚧 Firewall DNAT Mapping (Public → Private)
    203.122.10.55 → 10.10.5.21 # The firewall receives the request on the public IP and uses DNAT (Destination NAT) to map it to the private IP of your internal web/app server. This keeps internal servers hidden while maintaining full access control.
  6. πŸ–₯️ Private App Server Processing
    The request reaches 10.10.5.21 → app logic executes → response generated. # This is where your actual business logic runs (Tomcat, WebSphere, NGINX, etc.). The app prepares a response that travels back the same path — but in reverse.
  7. πŸ” Response Path (Reverse Flow)
    App Server → Firewall SNAT → Akamai Edge → User Browser # The firewall uses SNAT (Source NAT) to mask internal IPs with the public IP. Akamai then caches or delivers the content to the user securely.

πŸ§‘‍πŸ’» User Browser
   ↓
🧭 DNS → 🌐 app.company.com → πŸŒ€ app.company.com.edgesuite.net
   ↓
🌍 Akamai Edge IP (104.85.32.11)
   ↓
πŸ›‘️ Akamai Edge → 🚧 Firewall Public IP (203.122.10.55)
   ↓
🏒 Firewall DNAT → πŸ–₯️ Internal DMZ / Web / App Server (10.10.5.21)
   ↓
πŸ” Response → πŸšͺ Firewall SNAT → 🌍 Akamai Edge → πŸ§‘‍πŸ’» User
πŸ’¬ In short:
  • πŸ‘₯ Users never connect directly to your private network.
  • πŸ›‘️ Requests first hit Akamai’s Edge IPs — acting as a secure global shield for your applications.
  • 🌍 Akamai forwards clean traffic to your enterprise Public IP (assigned by ISP).
  • 🚧 The Firewall performs DNAT to map the public IP to a Private App Server (10.x.x.x).
  • πŸ” During the return flow, the Firewall uses SNAT to mask internal IPs before sending responses back to the user.

⚙️ Runtime Flow (When Users Access the App)

Inbound Flow (Internet → App)

  • 🌍 User opens https://app.company.com
  • 🧭 DNS resolves to Akamai Edge IP.
  • πŸ›‘️ Akamai WAF filters and forwards clean traffic.
  • 🚧 Firewall performs DNAT to internal private IP.
  • 🏰 DMZ hosts load balancer/web proxies.
  • πŸ“‘ Load balancer distributes traffic to web/app servers.
  • πŸ–₯️ App processes request and sends response back through the same path.

πŸ”  Key Terms (Full Forms)

TermFull FormSimple Meaning
DNSDomain Name SystemConverts website names into IPs
WAFWeb Application FirewallBlocks bad web traffic
CDNContent Delivery NetworkDelivers cached web content faster
DMZDemilitarized ZoneBuffer zone between internet & private network
NATNetwork Address TranslationMaps public ↔ private IPs
DNATDestination NATInbound mapping (public → private)
SNATSource NATOutbound mapping (private → public)
PKIPublic Key InfrastructureManages SSL certificates
LBLoad BalancerDistributes traffic across servers

✅ Summary

  • DNS only maps names to IPs — it doesn’t store servers.
  • CDNs like Akamai act as a smart middle layer for caching and security.
  • Public IPs are used on firewalls or load balancers; private IPs stay hidden inside.
  • DNAT and SNAT handle IP translation for inbound and outbound traffic.
  • SSL ensures secure HTTPS connections both at the CDN and internal layers.

πŸ”§ Authored by Pradeep Vishwakarma — Senior Middleware & DevOps Engineer | MiddlewareBox.com