Moving to Azure?

[MatthewL]

We are on premises setup, multi sites back to our data centre, everywhere I've worked thats how its beeen for years.

 

Costs are going up with hardware renewal and licenses so cloud is what we are looking at. No issues with it, if it works great then no issues. Yes you are reliant on your connection but if we loose connection now sites cannot connect back so no change really.

 

Has anyone moved yet? If so you moved everything or done a hybird?

 

I've been on a course this week looking at it as an Administrator, we don't touch anything in the limited presence we have, just curious for things to look out for, what to do not do etc.

 

We have only looked at Microsoft but I am keen to have a nosey at Amazon's offerings, what are you using?

 

This is for our servers side of things only.

[supportman]

We are on premises setup, multi sites back to our data centre, everywhere I've worked thats how its beeen for years.

 

Costs are going up with hardware renewal and licenses so cloud is what we are looking at. No issues with it, if it works great then no issues. Yes you are reliant on your connection but if we loose connection now sites cannot connect back so no change really.

 

Has anyone moved yet? If so you moved everything or done a hybird?

 

I've been on a course this week looking at it as an Administrator, we don't touch anything in the limited presence we have, just curious for things to look out for, what to do not do etc.

 

We have only looked at Microsoft but I am keen to have a nosey at Amazon's offerings, what are you using?

 

This is for our servers side of things only.

 

Why even run servers? Most of our services are SASS now and you can use Azure to run authentication these days.

 

So no real need for onsite servers migrated to the cloud.

[lmrogers]

I have successfully moved away from on prem servers to Azure cloud hosted. It has worked brilliantly and was a pretty easy process. There are still a few things like PaperCut that are prohibitive to moving away from a traditional local DC and making everything cloud native and fully SASS based. Although there are alternatives like PaperCut Hive and Printix, I think they both need a little bit more work and will get reviewed at some point when our managed print contract comes up for renewal.

 

Going fully cloud made more sense for my use case though, small single school. Not sure how the costs would look on a larger scale, but certainly using Reserved Instances and in some cases using a virtual appliance firewall to do site to sites with certainly helps with that compared to using the Azure VPN.

[MatthewL]

Some services are not SASS ready yet for some of what we use so servers are needed, weather that be on site or a VM in Azure.

 

For PaperCut I would look at migrating the VM to Azure, no plans to move to Hive or anything else.

[chaplic]

Just finishing a piece of work to move 2000 servers to azure, some unstructured thoughts

 

Azure firewall has a shocking low limit for outgoing SNAT, maybe not an issue if you just have servers there

 

Moving a server as-is should be the last option in terms of what you do (though if you do azure migrate does a reasonable job of it). If you conclude it's necessary, consider what cloud features you can make use of to reduce costs (ASR, Azure Monitor). Some servers you can grossly under-spec compared to what you have today (and turn them off etc). you may well find some servers have to be beefier. Disk performance for basic disks is poor.

 

I seek to use MS infra tooling (AUM, Monitor, Policy) but be aware it's probably not as feature rich as you are used to and will have to roll out on things on top of it

 

Get your azure policy in there early, especially to stop you /others doing daft stuff like assigning public IPs to servers

 

Only use private endpoints if you want to access the service from inside your LAN via vpn/ expressroute. It travels over the same network and adds complexity

 

Setup cost alerts and a monthly session to review costs

 

Dont build stuff out via the UI, define it as code. Sharp learning curve but much stronger for governance

 

End user computing stuff, in general is better held in Office365

 

Do you really need multiple geographies? UK south has three Availability zones and makes life much easier. A lot of new stuff doesnt land in uk-west either.

[MatthewL]

Some interesting points there, a number of which we have already got on the list.

 

We are going to install our own virtual firewall although not cheap its something we are used to working with.

 

Interesting point re UK South and West will note that.

[Roberto]

To echo Chaplic somewhat, my template for migration to 'the cloud' would be to look at SaaS where possible - for example we take it for granted these days that running email via O365 or GApps is a perfectly normal thing to do, and it absolutely costs less than running your own Exchange cluster scoped to provide similar functionality in AWS or Azure.

 

So for example rather than have print servers as Azure VMs, I run printx. Rather than having more SQL servers in Azure than necessary, we use Azure SQL. If you host external DNS then there's cloud services for that. If you have lots of old files in a legacy file store then use Azure Files rather than hosting a server just to host a file share, etc. This practice is *usually* cheaper in terms of the purchase price of the service vs. equivilent cloud server capacity, and when you consider that Azure Files, say, doesn't need the same kind of management or monitoring overhead of your time that a server would (and your time is also a cost of course!) then the cost advantages start to become apparent imo.

 

If you haven't come across the terms before a document like this which discusses SaaS vs PaaS vs IaaS is quite instructive - https://www.ibm.com/topics/iaas-paas-saas. Generally IaaS offers the most flexibility but requires the most effort and (usually but not always) the most cost.

Edited October 18, 2024 by Roberto

[dmj]

100% on defining infrastructure as code and not using the UI. I know I keep saying it, and others here are opposed to doing so, but it DOES make a big difference in terms of accountability, reproduciblity, testing, DR and just general reliability.

[dhicks]

We have only looked at Microsoft but I am keen to have a nosey at Amazon's offerings, what are you using?

 

We're about to turn off our old Windows Domain Controller and file server, leaving just print server (Papercut), phone system (3CX) and door access (Paxton) to run as local Windows server, which could pretty much be run on a small NUC or similar. We have an on-site gateway / filter (Untangle), which can failover between our two internet connections. We have Ubiquiti network hardware, managed via their small on-site device, and we have a Synology backup device which we use to backup Google Drive, one of the larger 2U rackmount devices. We currently locally host a remote desktop server for a relativly few teachers who still want to use it, and a general scripts-and-stuff server which could both really be run on off-site servers if wanted. For everything else, we use Google Drive for file storage and workstations (Windows, Mac and ChromeOS) use Google logins.

 

As we already have a server cupboard complete with dual UPS-backed power supplies, aircon (with backup) and dual internet connections we keep a couple of larger servers on-site that we could probably move off. It might be that we wind up hosting AI services on hardware in that space as we have the facility available.

[StephenPink]

Following this with interest - having had server hardware failure, and quite an aged/legacy infrastructure overall at one site in particular. I'm currently of the opinion that actually a 4-node S2D cluster would be more cost effective in the long-run; gives the flex for legacy systems still, can up the strorage/expand the compute if/when required, and especially when you factor in the local caching required for media/large files regardless of cloud storage platform.

 

Open to being told I'm wrong though I've struggled to make the finances work, likely because to meet most the existing requirements it would have to be more IaaS.

 

Likewise the IaaC idea - really would like to explore - however the time/cost to invest in that doesn't seem to be worth the trade off in an environment where we're not actually spinning up/down servers regularly. (or should we be?)

 

Cheers

[dmj]

Likewise the IaaC idea - really would like to explore - however the time/cost to invest in that doesn't seem to be worth the trade off in an environment where we're not actually spinning up/down servers regularly. (or should we be?)

 

 

If you want to do any amount of testing you will be automating server deployments regularly: but IasC is more than that - there's an element of accountability and the fact that you can look through past changes and see why a change was made. When you go back to something in 6 months and can't figure out why a setting is there your future self, and anyone new to the system will thank you.

[supportman]

Following this with interest - having had server hardware failure, and quite an aged/legacy infrastructure overall at one site in particular. I'm currently of the opinion that actually a 4-node S2D cluster would be more cost effective in the long-run; gives the flex for legacy systems still, can up the strorage/expand the compute if/when required, and especially when you factor in the local caching required for media/large files regardless of cloud storage platform.

 

Open to being told I'm wrong though I've struggled to make the finances work, likely because to meet most the existing requirements it would have to be more IaaS.

Cheers

 

Your wrong lol.....

 

But seriously... building complicated onsite super server is the worst thing you could do. A simple server with large SSD's and virtualized machines on it is enough to run any school. Have a hotspare as well and move everything possible to the cloud.

 

You can plan out single failure quite easily these days.

[Roberto]

Your wrong lol.....

 

But seriously... building complicated onsite super server is the worst thing you could do. A simple server with large SSD's and virtualized machines on it is enough to run any school. Have a hotspare as well and move everything possible to the cloud.

 

You can plan out single failure quite easily these days.

 

If I was doing on-prem virtual servers on a budget, I'd look to relatively powerful but basic servers running HyperV, and using replicas to improve availability. That isn't perfect but may be adequate. And it's much cheaper than messing with more complex setups

[StephenPink]

Thanks all - definitely food for thought. I'm fairly confident with S2D, having implemented previously, hence the suggestion. It's the failover/redundancy piece that then comes up when on-prem - trying to find that balance between availability and simplicity.

 

But focusing back on the cloud piece - if I've secured good hardware, at a good price - and that works well, has redundancy, and performs - then I struggle further to justify the cost of cloud computing, when I've got that in place, with significantly less ongoing costs (assuming just electricity/some form of support costs)? Especially then with the points you made that would mean the server cost is even less?

 

Obviously the file storage piece is straightforward; to reduce on-site storage, move to cloud storage, relatively easy and quick, but taking that out of the equation, what about the rest?

 

Thanks

[chaplic]

Move to the cloud is rarely an argument made purely on cost reasons, unless it's a immediate capex vs ongoing opex argument.

 

You are paying for extra flexibility, (probably) better physical hosting, better connectivity, better DR and the ability to differentiate key services

[PotNoodleTech]

Thanks all - definitely food for thought. I'm fairly confident with S2D, having implemented previously, hence the suggestion. It's the failover/redundancy piece that then comes up when on-prem - trying to find that balance between availability and simplicity.

 

I wholeheartedly aggree with supportman.

 

When people are talking about availability, the metric that no one ever seems to use is "what percentage improvement are you going to get in uptime by going with this new and expensive system"

 

For example If a Poweredge 740XD with Dual PSU dual NIC 24 x SSD's spread over 2 arrays/diskgroups achieves 99.0% uptime over the past 5 years - then whatever you are upgrading to is only actually going to be able to deliver up to 0.99% increased uptime. You have to ask yourself is the £thousands you are spending worth the possibility of an maximum uptime improvement of less than a percentile.

 

(and thats not even going into the argument of the more complicated you make something with NAS/SAN/CLUSTER/FIBRE CHANNEL/ETC the slower and less reliabile the system as a whole becomes so you might actually end up reducing your uptime below the 99% you had before)

 

Clearly the answer is no it not worth it - which is why I think any school can run on the above 1 server "model" and achieve 99% uptime whilst mitigating catastrophic faliure using Virtualisations, replicas and modern backup (including cloud storage).

[titch]

Have you considered If/How you will replace nps/radius without an onsite setup? Is your firewall capable of DHCP/DNS roles that are needed and the ability to HA the firewall/router/adva/Line etc. We are in the same boat and are moving away from NPS entirely.

[dmj]

Have you considered If/How you will replace nps/radius without an onsite setup? Is your firewall capable of DHCP/DNS roles that are needed and the ability to HA the firewall/router/adva/Line etc. We are in the same boat and are moving away from NPS entirely.

 

At my last place (but one, so 5 yrs ago) we ran radius and DHCP on a teeny tiny cloud cluster. Worked great.

Neither (free)radius nor dhcpd take any resources at all, and they both cluster quite nicely.

[MatthewL]

@PotNoddleTech, for us its not just about the extra 0.99% but the fact we dont have to run 2 data centres, licensing costs for VMware have gone through the roof, none of which would be needed moving to Azure, there is more resilience there which we need for a 24/ operation, less hardware to maintain, reducing our energy costs overall the figures work out massive cheaper.

@titch we will be having a VPN into Azure and will run NPS/Radius in the cloud, like we do now. Our firewalls have DHCP and DNS and each of our sites have access to to the data centres, most of our sites are already remote so its just a different location but a remote to each site. At the end of our migration we will not have any servers other than a PC at some sites hosting our images to PXE boot from to reimage. Our single point of failure is our connections on sites we HA our cores firewalls but the rest of the kit is not capable, we have 2 internet connections which helps us out but there is always going to be a point of failure somewhere unless you have more money than sense to throw at a network, likely hood if you loose that somethign else is going wrong.

[PotNoodleTech]

@PotNoddleTech, for us its not just about the extra 0.99% but the fact we dont have to run 2 data centres, licensing costs for VMware have gone through the roof, none of which would be needed moving to Azure, there is more resilience there which we need for a 24/ operation, less hardware to maintain, reducing our energy costs overall the figures work out massive cheaper.

@titch we will be having a VPN into Azure and will run NPS/Radius in the cloud, like we do now. Our firewalls have DHCP and DNS and each of our sites have access to to the data centres, most of our sites are already remote so its just a different location but a remote to each site. At the end of our migration we will not have any servers other than a PC at some sites hosting our images to PXE boot from to reimage. Our single point of failure is our connections on sites we HA our cores firewalls but the rest of the kit is not capable, we have 2 internet connections which helps us out but there is always going to be a point of failure somewhere unless you have more money than sense to throw at a network, likely hood if you loose that somethign else is going wrong.

 

I cant argue with that I mean if your still on Vmware then literally any thing else you do will be significantly cheaper. Ive been running on hyperv for the last 10 years I cant remember the figures but literally a grand or 2 for datacentre licences and used/refurb servers. Operating costs = peanuts. You dont have to spend 50 grand a year on servers unless your a university or massive MAT.

 

I went hyperV a long time ago as Vmware got rid of the educational licenceing back in the day and costs quadrupled overnight as I saw the writing was on the wall for VMware back then. The recent price increases are completely absurd.

 

I would look into cloud only if I was doing a refresh over the next couple of years.