Azure Windows Virtual Desktop is a Microsoft managed service. However, the host pools (virtual desktops) are deployed in Azure Virtual Networks (VNets), managed by the customer. The WVD VNet implementation, by default, has the same connectivity and security implications as any other IaaS workload in Azure and the WVD service control plane connectivity requires careful up-front planning to ensure regulatory and corporate security requirements are met and Day-2 operational best practices, such as visibility, availability and resiliency can be achieved.

Key Service Delivery Considerations

The Aviatrix cloud network platform enables enterprises deploying Azure WVD to quickly put an intelligent, secure cloud networking infrastructure in place as the foundation for their Azure WVD managed service. This Aviatrix validated design brings a standardized approach applicable whether you are in a single, or multiple clouds. The design specifically applies to WVD deployments. The Aviatrix cloud network platform quickly solves all of the inherent challenges with the service, accelerating the onboarding of users.

Secure Remote Access and Private On-premise Connectivity

While employees, partners and other WVD users are now working remotely from home and their Azure WVD is accessed over the internet using their home broadband connection, the backend applications are often operating on workloads still on-prem, or in a cloud other than Azure. There are two key features the Aviatrix design delivers:

Private On-Prem Connectivity – Express Route + Aviatrix CloudN appliances deliver enterprises line-rate encryption capabilities as well as extends visibility to on-premises. Standard IPSec encryption imposes a 1.25 Gbps performance limitation, Aviatrix allows customers to take full advantage of the throughput offered by Express Route connectivity (e.g 10 Gbps), while delivering private on-prem connectivity by aggregating multiple 1.25 Gbps tunnels and processing cores.

Multi-Cloud Network Connectivity – Utilizing Aviatrix transit gateways, host pools can easily and securely access workloads in other public clouds. The Aviatrix Multi-Cloud Network Architecture (MCNA) builds on its overlay transit network, which provides complete end-to-end encryption, and seamless connectivity into and across other cloud providers (AWS, GCP, and OCI). This design simplifies host connectivity to application services and/or data that reside in other clouds, while delivering a consistent, repeatable, auditable security model across all clouds.

Centralized Control, VNet Deployment Automation and Route Table Orchestration, Visibility and Troubleshooting

The brain of the Aviatrix cloud network platform is the Aviatrix intelligent controller. The Aviatrix controller allows you to leverage the native constructs in Azure and delivers an enterprise-grade cloud network. The controller allows you to take full control of your cloud networking, including on-prem connectivity, native construct orchestration (e.g VNet route tables), security orchestration (e.g. host pool segmentation), next gen firewall service insertion (e.g. Palo Alto Networks VM-series, Check Point Cloud Guard IaaS), Day2 operational visibility, and multi-cloud transit. The platform leverages the centralized intelligence and knowledge of the controller to dynamically program both native cloud network constructs and advanced services on Aviatrix’s own gateways. Combined with Aviatrix’s multi-cloud Terraform provider this design enables network and security Infrastructure-as-Code automation with a repeatable architecture across a multi-cloud environment. Three key features delivered by the Aviatrix design:

1. Direct Internet Access Control – The controller orchestrates VNet routing tables to connect through the Aviatrix Transit network, ensuring end-to-end routing correctness, including UDR management critical to secure VNet default routing behavior (0.0.0.0 default) so that network communications meet corporate and regulatory security requirements. Visibility and operational control over internet bound traffic is an important element of any enterprise cloud architecture. Aviatrix provides the visibility to understand what applications are communicating with and enables filtering control over those communications.
2. Host pool segmentation – Enterprises leverage our multi-cloud network segmentation to create security domains and isolate WVD host pools and their respective applications. This includes extending segmentation connection policies to other clouds, without requiring access to each cloud provider specific policy interfaces.
3. Visibility & Troubleshooting – Default deployments of WVD do not provide visibility into any traffic, and native tools offer silos of information which is not easily correlated to provide a complete picture. Aviatrix CoPilot delivers operational visibility that goes far beyond what any cloud provider delivers today. This includes dynamic multi-cloud network topology mapping, Aviatrix FlowIQ intelligent traffic flow analysis and several features which help cloud operations teams quickly isolate and troubleshoot network and/or application issues.

Security Service Insertion – Aviatrix Firewall Network

A critical part of this Aviatrix Validated Design is the Aviatrix Firewall Network or “FireNet” service. WVD traffic flows can be classified into two groups – WVD service control plane traffic and host pool traffic. By default, both of these flows have access to both the Internet and the WVD control plane. Both WVD host pool communications and WVD control plane connections should be secured by routing inter-pool communication for firewall inspection. Other WVD dependencies (e.g. Windows Activation and Updates) should also be routed and secured through centralized firewalls.The Aviatrix controller seamlessly orchestrates Firewall insertion (e.g. Palo Alto Networks VM-Series or Check Point Cloud Guard, Fortinet) as part of the FireNet deployment. The controller then automatically manipulates VNet route tables to direct specific traffic to service chain through the centralized firewalls. This allows traffic flows to be inspected and controlled. Leveraging a combination of security domains, connection policies and firewall inspection delivers granular, intent based isolation within region, across multiple regions, or across multiple clouds.

Aviatrix FireNet is used through a simple point a click interface or infrastructure-as-code Terraform automation. Operations teams easily select which traffic requires inspection by selecting which on-prem connections, spoke VNet connections, or transit hub connections should be inspected and controlled. FireNet provides a number of additional services including firewall scale-out and Source Network Address Translation (SNAT) elimination, allowing network teams to maintain source address visibility for VNet-to-VNet traffic flows.

Security Service Insertion – Aviatrix Firewall Network

Utilizing Aviatrix transit gateways, host pools can easily and securely access workloads in other public clouds. The Aviatrix Multi-Cloud Network Architecture (MCNA) builds on its overlay transit network, which provides complete end-to-end encryption, and seamless connectivity into and across other cloud providers (AWS, GCP, and OCI). This design simplifies host connectivity to application services and/or data that reside in other clouds, while delivering a consistent, repeatable, auditable security model across all clouds.

Infrastructure as Code Automation

Deployment and updates easily fit into existing CI/CD pipelines with the Aviatrix multi-cloud Terraform Provider. The Aviatrix Terraform Provider leverages the multi-lingual capabilities of the Aviatrix Controller. The controller communicates with the unique, native network constructs in each cloud through public APIs, creating a multi-cloud abstraction layer. Terraform modules are then developed with the Aviatrix Terraform Provider to deploy repeatable network designs in different clouds with a single Terraform module.

Secure Remote Access (SAML SSL VPN) – Leverage Active Directory, Okta, Duo or other enterprise identity provider for SAML Authentication, then leverage Aviatrix OpenVPN Client to establish IPSec connectivity to Aviatrix transit VPN gateways. This provides customers secure, end-to-end encrypted connectivity to only their WVD hosts.

Performance

In Azure, VM sizing determines the performance of an instance. Customers should do careful planning to ensure proper sizing is in place for the initial deployment. Aviatrix does provide resizing capabilities, which allows customers to grow gateway instances on demand. Our Aviatrix “InsaneMode” high-performance encryption provides capability to aggregate multiple tunnels and processing cores to deliver wire speed encryption to create high-performance private connections over data center to cloud connections such as Express Route. The Aviatrix patented solution overcomes the 1.25 Gbps limit delivered by native cloud solutions, to provide 10 Gbps of IPSec encrypted throughput. This same solution can be provided in the cloud with performance up to 75 Gbps.

High Availability

This validated design for WVD in Azure recommends Aviatrix gateways to be deployed in high-availability pairs, each in a different availability zone. Aviatrix ActiveMesh is automatically enabled, creating an active-active full mesh ECMP connection between Aviatrix gateways. The Aviatrix controller monitors all gateways that make up the ActiveMesh to ensure that traffic is directed across the optimal path, CoPilot highlights latency spikes and any connectivity failures and gateway automatically recover and resume position in the ActiveMesh network topology.