Introduction
With the release of BizTalk server 2013, BizTalk Server is ready to run in the cloud in 2 ways:
- BizTalk Server in an IaaS model
- BizTalk Services in a PaaS model.
In this post I will explain step-by-step how-to setup a BizTalk environment in Windows Azure IaaS in an automated way.
The environment we will setup will consist of 3 servers:
- A domain controller
- A SQL Server hosting our BizTalk databases
- A BizTalk 2013 Server
Besides the servers, we will also create a Virtual Network in Windows Azure and we will connect the Virtual Network with our local (on-premise) laptop.
To automate the provisioning of our environment we will make use of PowerShell and Remote PowerShell into our machines in the cloud.
STEP 1 – Prepare PowerShell
To be able to perform our Windows Azure tasks with PowerShell, you will need to download and install Windows Azure PowerShell.
You can find Windows Azure PowerShell on this location: http://www.windowsazure.com/en-us/downloads/ => download and install.
After downloading Windows Azure Powershell, it doesn’t know yet about your Azure subscription and how to connect to it.
To get this right, you have to download your PublishSettings file from this location: https://windows.azure.com/download/publishprofile.aspx.
You will be prompted for the credentials of your Azure account. Download the PublishSettings Xml file. This file contains the details about your Azure account and subscriptions.
Next, launch Windows Azure PorwerShell as an administrator.
Edit and execute these PowerShell commands:
#Initial settings
Set-ExecutionPolicy Unrestricted
#Import publish settings
Import-AzurePublishSettingsFile '<PATH>\Azure.publishsettings'
# SET AZURE SUBSCRIPTION
Set-AzureSubscription -SubscriptionName 'BizTalk Launch' -CurrentStorageAccount biztalkvms
Select-AzureSubscription -SubscriptionName 'BizTalk Launch'
Set-AzureSubscription -DefaultSubscription 'BizTalk Launch'
First we change the ExcecutionPolicy to ‘unrestricted’.
Then we import the PublishSettings file we just downloaded.
After importing the PublishSettings file, set the Azure Subscription. If you have more subscriptions available in your Azure account, this will tell PowerShell on with subscription to work, and what storage account will be used.
Make sure you have a storage account prepared to store the Virtual Machines disks on:
When step 1 is completed successfully, PowerShell is ready to create our Azure Virtual Machines.
STEP 2 – Create a Virtual Network
This step is not automated, since the creation of a Virtual Network will typically be done once.
Logon to the Azure Management Portal.
Create a new Virtual Network (custom create):
In the create Virtual Network wizard, choose a name for your Virtual Network and assign an Affinity Group:
Affinity groups allow you to group your Windows Azure services to optimize performance. All services within an affinity group will be located in the same data center. An affinity group is required in order to create a virtual network.
On the next screen, you can configure a DNS server for your network (I will leave it blank in my setup).
Later in the setup of this environment we will connect our on-premise laptop with the Virtual Network in the cloud. For this, we will need a Point-To-Site VPN. Enable ‘Configure Point-To-Site VPN’.
Azure Virtual Networks Connectivity with on-premise networks can be achieved in two ways:
- Point-To-Site VPN
Point-To-Site connectivity allows you to connect individual devices with your cloud network. Point-To-Site connections will even work from behind a firewall!
- Site-To-Site Connectivity
Site-To-Site connections will connect entire networks with one another.
A Site-To-Site connection can be setup in two ways:
- Hardware VPN: a hardware VPN device is necessary (Cisco, Juniper, …)
- Software VPN: Windows RRAS (Routing and Remote Access) is used as a software VPN
In both cases (hardware and software), you will need a public IP that is not behind NAT!
On the next screen, select the IP range that will be used for issuing IP’s to the remote devices that connect to you Virtual Network through the Point-To-Site connections:
Make sure that the IP range used for the clients does not conflict with the IP range of the Virtual Network itself.
On the last screen of the ‘Create Virtual Network’ wizard, choose the ip range of the Virtual Network in Windows Azure:
The IP range will be different than the one we chose on the Point-To-Site connectivity screen.
The Point-To-Site VPN also requires us to have Gateway. The wizard will not allow us to create the Virtual Network without a Gateway.
Click the ‘add gateway subnet’ button. A Gateway will be added. You can keep the proposed IP.
When you finish the ‘Create Virtual Network Wizard’, the Virtual Network will be created in Windows Azure:
When the Virtual Network is created, open its properties in the Windows Azure Management Console:
As you can see, Windows Azure reports an error ‘The Gateway was not created’.
The only problem is that Windows Azure does not generate the Gateway automatically. The fix is easy, click the ‘Create Gateway’ button at the bottom of the screen, and the Gateway will be created for you.
After a while, the Gateway will be ready and the properties of the Virtual Network should look like this:
The error ‘Certificate not set up’ will be handled in a later step of our setup.
STEP 3 – Create Domain controller
In this step, we will run a PowerShell script that will create our domain controller.
The script looks like this (you should edit variables to match your environment).
# CREATE BIZTALK DOMAIN CONTROLLER
#Variables
$dcname = 'btsdcDemoLive'
$AG = 'BizTalkAFLive'
$vnet = 'BizTalkVNLive'
$adminusername = 'codit'
$myDNS = New-AzureDNS -Name $dcname -IPAddress '127.0.0.1'
$vmname = $dcname
$image = 'a699494373c04fc0bc8f2bb1389d6106__Windows-Server-2012-Datacenter-201305.01-en.us-127GB.vhd'# old image'a699494373c04fc0bc8f2bb1389d6106__Windows-Server-2012-Datacenter-201302.01-en.us-30GB.vhd'
$service = $dcname
$restart = 'false'
$credential = Get-Credential
#Create Virtual Machine
$mydc = New-AzureVMConfig -name $vmname -InstanceSize 'ExtraSmall' -ImageName $image | Add-AzureProvisioningConfig -Windows -Password $password -AdminUsername $adminusername | Set-AzureSubnet -SubnetNames 'Subnet-1'
New-AzureVM -ServiceName $service -AffinityGroup $AG -VMs $mydc -DnsSettings $myDNS -VNetName $vnet -WaitForBoot
WaitStartVM $service $vmname $restart
# Get the uri for remote configuration
# Get credentials to connect to the remote machine
$cmduri = Get-AzureWinRMUri -ServiceName $service -Name $vmname
#Install the certificate for remote PowerShell
InstallWinRMCert $service $vmname
#enable ping (closed by default)
Invoke-Command -ConnectionUri $cmduri.ToString() -Credential $credential -ScriptBlock {
Import-Module NetSecurity
Set-NetFirewallRule -DisplayName "File and Printer Sharing (Echo Request - ICMPv4-In)" -enabled True
}
#Add Domain Controller Windows feature
Invoke-Command -ConnectionUri $cmduri.ToString() -Credential $credential -ScriptBlock {
$loglabel = $((get-date).ToString("yyyyMMddHHmmss"))
$logPath= "$env:TEMP\init_dcservervm_install_$loglabel.txt"
Import-Module -Name ServerManager
Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools -LogPath $logPath
}
#Add DNS Windows Feature
Invoke-Command -ConnectionUri $cmduri.ToString() -Credential $credential -ScriptBlock {
$loglabel = $((get-date).ToString("yyyyMMddHHmmss"))
$logPath= "$env:TEMP\init_dcservervm_install_$loglabel.txt"
Import-Module -Name ServerManager
Install-WindowsFeature -Name DNS -IncludeManagementTools -LogPath $logPath
}
#Promote to domain controller
Invoke-Command -ConnectionUri $cmduri.ToString() -Credential $credential -ScriptBlock {
$loglabel = $((get-date).ToString("yyyyMMddHHmmss"))
$logPath= "$env:TEMP\init_dcservervm_install_$loglabel.txt"
$safemodepass = ConvertTo-SecureString <password> -asPlainText -Force
Import-Module ADDSDeployment
Install-ADDSForest `
-InstallDns:$true `
-CreateDnsDelegation:$false `
-DatabasePath "C:\Windows\NTDS" `
-SysvolPath "C:\Windows\SYSVOL" `
-DomainName "BTS2013.com" `
-DomainNetbiosName "BTS2013" `
-NoRebootOnCompletion:$false `
-Force:$true `
-LogPath $logPath `
-SafeModeAdministratorPassword $safemodepass
}
Let’s go over the steps executed in the script above:
Line 4 to 12: we set variables that will be used
Line 8: DNS server, the domain controller will use itself as DNS server
Line 13: Get-Credentials asks for credentials in an interactive way. This allows you to create scripts without passwords in clear text in the script.
Line 16 to 17: Here we create the Virtual Machine in Windows Azure based on an Image. We set the configuration of our Virtual Machine via the parameters.
The Virtual Machine Image can be either:
- A Windows Azure Gallery Image: Microsoft provided Images
- A self-created Image that you first upload to Windows Azure
- Third party Image
Line 18: The WaitStartVM is a function that waits for a VM to be completely ready to start receiving remote PowerShell commands. By default, PowerShell will not wait for the Virtual Machine to finish ‘provisioning’. PowerShell well continue as soon as the Virtual Machine is ‘Started’. This function will fix that.
The function looks like this:
function WaitStartVM($serviceName, $vmname, $restart)
{
if($restart -eq 'false')
{
Start-AzureVM -ServiceName $serviceName -Name $vmname
}
else
{
Restart-AzureVM -ServiceName $serviceName -Name $vmname
}
do{
$vm = Get-AzureVM -ServiceName $serviceName -Name $vmname
$state = $vm.PowerState
$instancestate = $vm.InstanceStatus
write-host "Waiting for VM to start..."
sleep 10
} until ($state -eq 'Started' -and $instancestate -eq 'ReadyRole')
write-host "VM Started!"
}
We will also use this function throughout the other scripts of our environment setup.
Line 22: We get the URI where our Virtual Machine will accept remote PowerShell commands.
Line 25: The InstallWinRMCert is a function that downloads and installs the certificate that is necessary to execute remote PowerShell commands on our Virtual Machine in a secure way. More info about this function can be found here.
The InstallWinRMCert function looks like this:
function InstallWinRMCert($serviceName, $vmname)
{
$winRMCert = (Get-AzureVM -ServiceName $serviceName -Name $vmname | select -ExpandProperty vm).DefaultWinRMCertificateThumbprint
$AzureX509cert = Get-AzureCertificate -ServiceName $serviceName -Thumbprint $winRMCert -ThumbprintAlgorithm sha1
$certTempFile = [IO.Path]::GetTempFileName()
Write-Host $certTempFile
$AzureX509cert.Data | Out-File $certTempFile
# Target The Cert That Needs To Be Imported
$CertToImport = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2 $certTempFile
$store = New-Object System.Security.Cryptography.X509Certificates.X509Store "Root", "LocalMachine"
$store.Certificates.Count
$store.Open([System.Security.Cryptography.X509Certificates.OpenFlags]::ReadWrite)
$store.Add($CertToImport)
$store.Close()
Remove-Item $certTempFile
}
We will also use this function throughout the other scripts of our environment setup.
Line 28 to 31: The invoke-command executes on a remote machine, in this case our Virtual Machine in Windows Azure. In this step we enable ICMP in the Windows Firewall. This will allow us to ping the machine in the Virtual Network.
Line 33 to 39: We add the ‘Active Directory’ Windows Feature to our Virtual Machine.
Line 41 to 47: We add the ‘DNS’ Windows Feature to our Virtual Machine.
Line 49 to 66: We promote our Virtual Machine to domain controller.
Domain Users and Groups
Because we are creating a domain that must host a BizTalk environment, we will also need to created the necessary users and groups in Active Directory.
Also this is scripted.
In the first script, I create the necessary domain users:
#Create Biztalk user accounts
# BiztalkAdmin, btssvc, btsisolated, entsso,
New-ADUser -SamAccountName "BiztalkAdmin" -Name "BiztalkAdmin" -DisplayName "Biztalk Administrator" -PasswordNeverExpires 1
Set-ADAccountPassword -Identity BiztalkAdmin -NewPassword (ConvertTo-SecureString -AsPlainText "azert@12345" -Force)
New-ADUser -SamAccountName "btssvc" -Name "btssvc" -DisplayName "Biztalk Service Account" -PasswordNeverExpires 1
Set-ADAccountPassword -Identity btssvc -NewPassword (ConvertTo-SecureString -AsPlainText "azert@12345" -Force)
New-ADUser -SamAccountName "btsisolated" -Name "btsisolated" -DisplayName "Biztalk Isolated Host Users" -PasswordNeverExpires 1
Set-ADAccountPassword -Identity btsisolated -NewPassword (ConvertTo-SecureString -AsPlainText "azert@12345" -Force)
New-ADUser -SamAccountName "entsso" -Name "entsso" -DisplayName "Enterprise Single Sign Service" -PasswordNeverExpires 1
Set-ADAccountPassword -Identity entsso -NewPassword (ConvertTo-SecureString -AsPlainText "azert@12345" -Force)
#Now Enable those accounts that you just created
Enable-ADAccount -Identity "BiztalkAdmin"
Enable-ADAccount -Identity "btssvc"
Enable-ADAccount -Identity "btsisolated"
Enable-ADAccount -Identity "entsso"
Next, we need to create the BizTalk domain groups:
# Create Biztalk Administrators Domain Group
New-ADGroup -Name "Biztalk Server Administrators" -SamAccountName BiztalkServerAdmins -GroupCategory Security -GroupScope Global -DisplayName "Biztalk Server Administrators" -Path "CN=Users,DC=BTS2013,DC=Com" -Description "Members of this group are Biztalk Server Administrators"
# Create Biztalk Server Operators Group
New-ADGroup -Name "Biztalk Server Operators" -SamAccountName BiztalkServerOperators -GroupCategory Security -GroupScope Global -DisplayName "Biztalk Server Operators" -Path "CN=Users,DC=BTS2013,DC=Com" -Description "Members of this group are Biztalk Server Operators"
# Create Biztalk Server Operators Group
New-ADGroup -Name "Biztalk B2B Server Operators" -SamAccountName BiztalkB2BServerOperators -GroupCategory Security -GroupScope Global -DisplayName "Biztalk B2B Server Operators" -Path "CN=Users,DC=BTS2013,DC=Com" -Description "Members of this group are Biztalk B2B Server Administrators"
# Create SSO Administrators Domain Group
New-ADGroup -Name "SSO Administrators" -SamAccountName SSOAdmins -GroupCategory Security -GroupScope Global -DisplayName "SSO Administrators" -Path "CN=Users,DC=BTS2013,DC=Com" -Description "Members of this group are SSO Administrators"
# Create SSO Affiliate Administrators Domain Group
New-ADGroup -Name "SSO Affiliate Administrators" -SamAccountName SSOAffiliateAdmins -GroupCategory Security -GroupScope Global -DisplayName "SSO Affiliate Administrators" -Path "CN=Users,DC=BTS2013,DC=Com" -Description "Members of this group are SSO Affiliate Administrators"
# Create Biztalk Application Users Domain Group
New-ADGroup -Name "Biztalk Application Users" -SamAccountName BiztalkApplicationUsers -GroupCategory Security -GroupScope Global -DisplayName "Biztalk Application Users" -Path "CN=Users,DC=BTS2013,DC=Com" -Description "Members of this group are Biztalk Application Users"
# Create Biztalk Administrators Domain Group
New-ADGroup -Name "Biztalk Isolated Host Users" -SamAccountName BiztalkIsolatedHostUsers -GroupCategory Security -GroupScope Global -DisplayName "Biztalk Isolated Host Users" -Path "CN=Users,DC=BTS2013,DC=Com" -Description "Members of this group are Biztalk Isolated Host Users"
Finally, the users we just created must be added to the correct groups:
#Add users to appropriate Groups
#BiztalkAdmin to Biztalk Server Administrators
$user = Get-ADUser -Identity "BiztalkAdmin"
$group = Get-ADGroup -Identity "BiztalkServerAdmins"
Add-ADGroupMember $group -Member $user
#BiztalkAdmin to Domain Admins
$user = Get-ADUser -Identity "BiztalkAdmin"
$group = Get-ADGroup -Identity "Domain Admins"
Add-ADGroupMember $group -Member $user
#BiztalkAdmin to SSO Administrators
$user = Get-ADUser -Identity "BiztalkAdmin"
$group = Get-ADGroup -Identity "SSOAdmins"
Add-ADGroupMember $group -Member $user
#BTSSVC to Biztalk Application Users
$user = Get-ADUser -Identity "btssvc"
$group = Get-ADGroup -Identity "BiztalkApplicationUsers"
Add-ADGroupMember $group -Member $user
#BTSSVC to Biztalk Application Users
$user = Get-ADUser -Identity "btsisolated"
$group = Get-ADGroup -Identity "BiztalkIsolatedHostUsers"
Add-ADGroupMember $group -Member $user
#entsso to entssoadmins and entssoaffiliateadmins
$user = Get-ADUser -Identity "entsso"
$group = Get-ADGroup -Identity "SSOAdmins"
Add-ADGroupMember $group -Member $user
#entsso to entssoadmins and entssoaffiliateadmins
$user = Get-ADUser -Identity "entsso"
$group = Get-ADGroup -Identity "SSOAffiliateAdmins"
Add-ADGroupMember $group -Member $user
The Virtual Machines node in the Windows Azure Management Portal should look like this:
You can open a Remote Desktop session on the created Virtual Machine. Click the ‘Connect’ button at the bottom of the screen.
Let’s also verify that our users and groups are created in Active Directory:
When the scripts of STEP 3 executed successfully, you will have an operational Active Directory Domain Controller in the Virtual Network created in STEP 2.
The domain is ready and all necessary users and group are created in Active Directory.
We can now continue with the setup of SQL and BizTalk.
STEP 4 – Create SQL Server
In this step, we will run a PowerShell script that will create our SQL Server Virtual Machine.
After analyzing the script of STEP 3, most things will be already familiar! (the explanation will not be repeated here)
The script looks like this (you should edit variables to match your environment).
$credential = Get-Credential
$sqlname = 'sqlbtsDemoLive'
$AG = 'BizTalkAFLive'
$vnet = 'BizTalkVNLive'
$adminusername = 'codit'
$mySQLDNS = New-AzureDNS -Name 'sqldnsLive' -IPAddress '10.0.0.4'
$vmname = $sqlname
$image = '2cdc6229df6344129ee553dd3499f0d3__BizTalk-Server-2013-Evaluation'
$sqlservice = $sqlname
$restart = 'false'
#Create the SQL Server Virtual Machine $password = 'Codit*1234'
$mysql = New-AzureVMConfig -name $vmname -InstanceSize 'Small' -ImageName $image | Add-AzureProvisioningConfig -Windows -Password $password -AdminUsername $adminusername | Set-AzureSubnet -SubnetNames 'Subnet-1'
New-AzureVM -ServiceName $sqlservice -AffinityGroup $AG -VMs $mysql -DnsSettings $mySQLDNS -VNetName $vnet
WaitStartVM $sqlservice $vmname $restart
#Get the remote PowerShell URI
$cmduri = Get-AzureWinRMUri -ServiceName $sqlservice -Name $vmname
InstallWinRMCert $sqlservice $vmname
#Add the SQL Server Virtual Machine to the domain we created in STEP 3
Invoke-Command -ConnectionUri $cmduri.ToString() -Credential $credential -ScriptBlock {
$domain = "BTS2013.com"
$password = <password> | ConvertTo-SecureString -asPlainText -Force
$username = "$BTS2013\Codit"
$credential = New-Object System.Management.Automation.PSCredential($username,$password)
Add-Computer -DomainName $domain -Credential $credential
}
#Restart for domain join
$restart = 'true'
WaitStartVM $sqlservice $vmname $restart
#Set firewall rule and disable services we don't use (save resources)
#Enable MSDTC network access
Invoke-Command -ConnectionUri $cmduri.ToString() -Credential $credential -ScriptBlock {
Import-Module NetSecurity
Set-NetFirewallRule -DisplayName "File and Printer Sharing (Echo Request - ICMPv4-In)" -enabled True
Set-Service -Name 'ReportServer' -StartupType manual
Set-Service -Name 'MSSQLServerOLAPService' -StartupType manual
Set-Service -Name 'MsDtsServer110' -StartupType manual
Set-Service -Name 'SQLServerAgent' -StartupType automatic
Stop-Service -Name 'ReportServer'
Stop-Service -Name 'MSSQLServerOLAPService'
Stop-Service -Name 'MsDtsServer110'
Start-Service -Name 'SQLServerAgent'
#MSDTC settings!
Set-DtcNetworkSetting -DtcName Local -InboundTransactionsEnabled 1 -OutboundTransactionsEnabled 1 -RemoteAdministrationAccessEnabled 1 -RemoteClientAccessEnabled 1 -AuthenticationLevel NoAuth -Confirm:$false
}
#Open SQL Ports in the Windows Firewall (closed by default)
Invoke-Command -ConnectionUri $cmduri.ToString() -Credential $credential -ScriptBlock {
Import-Module NetSecurity
$GroupName = "BizTalk 2013"
$SQLPortLocal = 1433
$SQLBrowserPort = 1434
$RSQL = New-NetFirewallRule -DisplayName "SQL Server Communication (TCP-In)" -Description "This rule opens the SQL Server communication port $($SQLLocalPort) to the IP Address $($WFEIPAddress) for SharePoint 2013 communication" -Direction Inbound -LocalPort $SQLPortLocal -Group $GroupName -Protocol TCP -Profile Domain -Action Allow -RemoteAddress Any
Write-Host "$($RSQL.DisplayName) created: " -nonewline; Write-Host -foregroundcolor green "$($RSQL.PrimaryStatus)"
#Rule for SQL Browser - UDP Port 1434 Inbound
$RSQLBROWSER = New-NetFirewallRule -DisplayName "SQL Server Browser (UDP-In)" -Description "This rule opens the SQL Server Browser UDP port $($SQLBrowserPort) to the IP Address $($WFEIPAddress)" -Direction Inbound -LocalPort $SQLBrowserPort -Group $GroupName -Protocol UDP -Profile Domain -Action Allow -RemoteAddress Any
Write-Host "$($RSQLBROWSER.DisplayName) created: " -nonewline; Write-Host -foregroundcolor green "$($RSQLBROWSER.PrimaryStatus)"
}
Let’s go over the steps executed in the script above (I will only explain new things):
Line 6: DNS Server: The DNS Server that will be used by SQL Server should be the IP address of the domain controller we set up in STEP 3.
Line 8: Note that even for a SQL Server Virtual Machine we are using the BizTalk Evaluation Gallery Image. The reason for this is, at the point of writing this post, there is no SQL Server Evaluation Image available. The BizTalk Evaluation Image also contains a SQL Server Evaluation.
Line 21 to 28: We add our newly created SQL Server Virtual Machine to the BTS2013 domain we created in STEP 3.
Line 30 to 21: After joining the domain, we have to reboot our SQL Server.
Line 35 to 49: We configure the services start-up types, and stop any service we don’t need on our SQL Server.
Line 51 to 62: We open Windows Firewall to allow BizTalk Server to connect with SQL Server. SQL Server ports are closed by default on the Windows Azure Gallery Image we are using.
When the script of STEP 4 executed successfully, you will have an operational SQL Server in the Virtual Network created in STEP 2.
STEP 5 – Create BizTalk Server
In this step, we will run a PowerShell script that will create our BizTalk Server 2013 Virtual Machine.
After analyzing the script of STEP 3 and 4, most things will be already familiar! (the explanation will not be repeated here)
The script looks like this (you should edit variables to match your environment).
#Variables
$btsname = 'bts2013DemoLive'
$AG = 'BizTalkAFLive'
$vnet = 'BizTalkVNLive'
$credential = Get-Credential
$adminusername = 'codit'
$mybtsDNS = New-AzureDNS -Name 'btsdnsLive' -IPAddress '10.0.0.4'
$vmname = $btsname
$image = '2cdc6229df6344129ee553dd3499f0d3__BizTalk-Server-2013-Evaluation'
$btsservice = $btsname
#Create the BizTalk Virtual Machine $password = 'Codit*1234'
$restart = 'false'
$mybts = New-AzureVMConfig -name $vmname -InstanceSize 'Small' -ImageName $image | Add-AzureProvisioningConfig -Windows -Password $password -AdminUsername $adminusername | Set-AzureSubnet -SubnetNames 'Subnet-1'
New-AzureVM -ServiceName $btsservice -AffinityGroup $AG -VMs $mybts -DnsSettings $mybtsDNS -VNetName $vnet
WaitStartVM $btsservice $vmname $restart
#Get URI for remote PowerShell
$cmduri = Get-AzureWinRMUri -ServiceName $btsservice -Name $vmname
InstallWinRMCert $btsservice $vmname
#Add Domain Controller Windows feature
Invoke-Command -ConnectionUri $cmduri.ToString() -Credential $credential -ScriptBlock {
$domain = "BTS2013.com"
$password = <password> | ConvertTo-SecureString -asPlainText -Force
$username = "$BTS2013\Codit"
$credential = New-Object System.Management.Automation.PSCredential($username,$password)
Add-Computer -DomainName $domain -Credential $credential
}
#Restart for domain join
$restart = 'true'
WaitStartVM $btsservice $vmname $true
#Set firewall rules, Stop all SQL Services and set to manual start-up type, enable network access for MSDTC
Invoke-Command -ConnectionUri $cmduri.ToString() -Credential $credential -ScriptBlock {
Import-Module NetSecurity
Set-NetFirewallRule -DisplayName "File and Printer Sharing (Echo Request - ICMPv4-In)" -enabled True
Set-Service -Name 'SQLWriter' -StartupType manual
Set-Service -Name 'ReportServer' -StartupType manual
Set-Service -Name 'MSSQLServerOLAPService' -StartupType manual
Set-Service -Name 'MSSQLServer' -StartupType manual
Set-Service -Name 'MSSQLFDLauncher' -StartupType manual
Set-Service -Name 'MsDtsServer110' -StartupType manual
Stop-Service -Name 'ReportServer'
Stop-Service -Name 'SQLWriter'
Stop-Service -Name 'MSSQLServerOLAPService'
Stop-Service -Name 'MSSQLFDLauncher'
Stop-Service -Name 'MsDtsServer110'
Stop-Service -Name 'MSSQLServer'
#MSDTC settings!
Set-DtcNetworkSetting -DtcName Local -InboundTransactionsEnabled 1 -OutboundTransactionsEnabled 1 -RemoteAdministrationAccessEnabled 1 -RemoteClientAccessEnabled 1 -AuthenticationLevel NoAuth -Confirm:$false
}
WaitStartVM $btsservice $vmname $true
Line 40 to 51: I stop all services related to SQL Server. In STEP 4 we set up a separate machine for SQL Server, we don’t need SQL on the BizTalk machines. Also the start-up types are set to manual.
When the script of STEP 5 executed successfully, you will have an operational BizTalk Server 2013 in the Virtual Network created in STEP 2.
Let’s now verify that all our machines our up-and-running in Windows Azure.
Navigate to the ‘Virtual Machines’ node. In the screenshot below you can see that the domain controller, SQL Server and BizTalk Server are provisioned and running.
Click on the ‘Virtual Network’ node, and navigate to the network that was created prior in this post.
As you can see, our 3 new virtual machines are added in the ‘biztalkvnlive’ Virtual Network.
STEP 6 – Configure BizTalk Server
The BizTalk Server Gallery images in Windows Azure provide us with a new tool to configure BizTalk.
The Provisioning Tool allows you to configure a complete BizTalk group (multiple servers) at once. You run the Provisioning Tool on one server, all other servers will get their configuration via the tool!
Unfortunately, at this point in time, the Provisioning Tool does not support Active Directory groups yet, so we can’t use it in this situation.
To configure BizTalk in this case, I will run the BizTalk ‘Configuration.exe’ as a command line tool. The configuration is set by providing an Xml file as a parameter. The Xml file contains the BizTalk configuration.
To run the configuration, execute this command:
configuration /s c:\BTSConfig\btsconfigExport.xml /l c:\BTSConfig\log.txt
The first parameter is the configuration as Xml, the second parameter is the log file to use where possible errors are written to.
After executing the command above, BizTalk will start its configuration:
STEP 7 – Deploy BizTalk test application
STEP 7 will not be detailed in this blog post. Just create a small BizTalk application that is capable of picking up a file at a certain location and write it to an output folder.
STEP 8 – Network connectivity – Certificates
In this step, I will setup network connectivity between the Windows Azure Virtual Network and my local laptop.
We want this connection to be secure, because of that, we will need to generate a public/private key pair to secure the connection.
First we will generate a self-signed root certificate. This certificate will be used to generate client certificates for every device that needs to connect to the cloud network.
Certificates can be generated with the ‘makecert’ tool.
To create the root certificate, execute this command:
makecert -sky exchange -r -n "CN=BizTalkVNLiveRoot" –pe -a sha1 -len 2048 -ss My
Next, I will generate a client certificate from the root certificate that is just created. The client certificate will serve to identify my client computer to the cloud. The root certificate will be used to validate my client certificate in the cloud.
To create a client certificate from the root certificate, execute this command:
makecert -n "CN=BizTalkVNLiveClient" -pe -sky exchange -m 96 -ss My -in "BizTalkVNLiveRoot" -is my -a sha1
Install the client certificate on your local computer by double clicking the ‘.pfx’ file. Follow the instructions.
Export the root certificate to a .cer file (from the Windows Certificate store).
Now we have to tell our Windows Azure Virtual Network what client certificates are trusted to connect to the Virtual Network.
To do this, browse to the Virtual Network that was created in STEP 2.
The follow screen should be visible:
Click the ‘Upload client certificate’ link. The caption of this link is not correct! We will NOT upload the client certificate. We upload the root certificate that is able to issue client certificates.
STEP 9 - Network connectivity – VPN package
After uploading the certificate in the previous step, there is no more error on our Virtual Network:
Next we will prepare our client laptop to connect to the Virtual Network in Windows Azure.
Download and install the Client VPN Package that matches your machines hardware architecture. The download link to the VPN package is displayed on the bottom right of the screenshot above.
When the Client VPN Package is installed, go to you network settings.
The Virtual Network will have a separate entry in the network list:
Right click the ‘BizTalkVNLive’ network and click ‘Connect’. You will now connect your laptop with the Virtual Network in Windows Azure.
STEP 10 – Verification
In this step, test network connectivity between your client laptop and the Virtual Network by ‘pinging’ BizTalk Server.
When this works, you can add a receive location to the test application that you created earlier. Let this receive location pick-up a file from your local laptop over the Point-To-Site Virtual Network that is connected.
Peter Borremans
780d61ec-c70d-4577-a225-7ede6a1e7e85|4|5.0