Azure VMware Solution Design

Azure VMware Solution is a Microsoft-managed service that provides VMware vSphere, vCenter, NSX-T, and HCX running on dedicated Azure bare-metal infrastructure. It allows organizations to migrate their on-premises VMware workloads to Azure without refactoring applications, rearchitecting networking, or changing management tools. AVS is an Azure first-party service, meaning it is fully integrated with Azure Resource Manager, Azure Active Directory, and Azure networking services like ExpressRoute and VPN Gateway.

Many enterprises have significant investments in VMware-based virtualization. Migrating those workloads to Azure natively would require converting VMDK files to VHD, reconfiguring networking, and retraining staff. AVS eliminates these barriers by providing a VMware environment that is fully compatible with existing tools (vCenter, NSX-T, PowerCLI) and processes (vMotion, HA, DRS). It enables a true hybrid cloud where workloads can move between on-premises and Azure without modification.

AVS is deployed in an Azure region within a customer's subscription, but it runs on dedicated bare-metal servers that are not shared with other customers. These servers are ESXi hosts managed by a vCenter Server that is accessible via the Azure portal. The service includes:

While AVS is managed through the Azure portal and VMware tools, some operations use Azure CLI or PowerShell:

Create a private cloud (Azure CLI):

az vmware private-cloud create \
  --resource-group rg-avs \
  --name my-private-cloud \
  --location eastus \
  --sku av36 \
  --cluster-size 3 \
  --network-block 10.0.0.0/22

List private clouds:

az vmware private-cloud list -o table

Add a cluster:

az vmware cluster create \
  --resource-group rg-avs \
  --private-cloud my-private-cloud \
  --cluster-name cluster-2 \
  --sku av36 \
  --size 4

Get vCenter credentials:

az vmware private-cloud list-admin-credentials \
  --resource-group rg-avs \
  --private-cloud my-private-cloud

Enable HCX:

az vmware hcx-enterprise-site create \
  --resource-group rg-avs \
  --private-cloud my-private-cloud \
  --name hcx-site

AVS private cloud is allocated a /22 network block (e.g., 10.0.0.0/22) that is used for management and provisioning. This block is divided into subnets:

Traffic flows from AVS to on-premises or Azure VNet via the ExpressRoute circuit. The Tier-0 gateway handles north-south traffic. For east-west traffic between AVS VMs, the Tier-1 gateway and NSX-T distributed firewall provide micro-segmentation.

HCX supports multiple migration methods: - vMotion: Live migration of running VMs with zero downtime. Requires low latency (< 10 ms RTT) and high bandwidth. - Cold migration: Power off VM and migrate. Suitable for non-critical workloads. - Bulk migration: Uses replication to migrate many VMs at once. Can be scheduled. - Disaster recovery: Replicates VMs to AVS for failover. Can be tested without impact.

HCX also provides network extension (L2 stretch) so that VMs retain their IP addresses after migration. This is achieved by extending VLANs from on-premises to AVS using the HCX Network Extension appliance.

AVS provides local NVMe storage from the bare-metal nodes (vSAN). Additionally, customers can attach: - Azure NetApp Files: NFS datastores that can be used for high-performance workloads. - Azure Disk Storage: Not directly attachable to AVS hosts; instead, use a file server VM inside AVS that mounts Azure disks. - Azure Files: Can be accessed via SMB from VMs in AVS.

For AZ-305, you need to know:

A global bank has over 2,000 VMs running on VMware vSphere in multiple data centers. Many of these VMs run legacy applications that cannot be containerized or refactored due to compliance and stability requirements. The bank needs to migrate to Azure to reduce data center footprint and gain cloud agility. They choose AVS because it allows them to vMotion live VMs with zero downtime using HCX. They deploy AVS in the East US region with three clusters of AV36 nodes (9 nodes total). They connect on-premises to AVS via ExpressRoute with Global Reach. The migration takes six months, moving 200 VMs per week. During the process, they use HCX network extension to keep IP addresses unchanged. After migration, they integrate vCenter with Azure AD for single sign-on and use Azure Backup for VM backups. The key challenge is managing the large number of NSX-T segments (over 100) and ensuring that firewall rules are correctly migrated. They use the NSX-T migration tool to convert on-premises distributed firewall rules. Performance-wise, they monitor host utilization and add nodes as needed. A common misconfiguration is not reserving enough IP space for HCX network extension appliances, causing IP conflicts.

A healthcare provider has a primary data center in Dallas and a secondary site in Phoenix. They want to use Azure as a disaster recovery target for their VMware workloads without changing their existing VMware tools. They deploy AVS in the West US region (closest to Phoenix) with a 3-node cluster. They use HCX disaster recovery to replicate critical VMs (about 500) from on-premises to AVS. Replication is set to every 15 minutes. In the event of a disaster, they can fail over to AVS and access applications via a VPN connection from their secondary site. They use Azure Site Recovery as an alternative, but HCX is preferred because it integrates directly with vSphere. The challenge is ensuring that the ExpressRoute bandwidth is sufficient for replication traffic (they use 1 Gbps). They also need to test failover quarterly without impacting production. A common mistake is not sizing the AVS cluster correctly for failover capacity—they initially underestimated CPU requirements and had to add nodes during a test.

A retail company with seasonal peaks (Black Friday) needs to burst capacity to Azure during high demand. They have a VMware environment with 500 VMs that handle e-commerce transactions. They deploy AVS with a 4-node cluster in the same Azure region as their web tier (Azure VMs). They use HCX vMotion to move VMs between on-premises and AVS during peak times. This requires low latency (< 10 ms) between on-premises and Azure, which they achieve with ExpressRoute Direct. They also use NSX-T to create a DMZ segment for web servers and a backend segment for databases. The critical integration is with Azure Load Balancer to distribute traffic to AVS VMs. They configure the Tier-0 gateway to advertise the DMZ subnet to Azure, so Azure Load Balancer can forward traffic. The biggest challenge is managing the dynamic routing updates when VMs are vMotioned—they use BGP with route maps to ensure traffic is optimally routed. A misconfiguration they encountered was not enabling 'send ARP' on the HCX network extension, causing network loops.