Azure Infrastructure Provisioning

To deploy the required 3-tier network infrastructure on Azure, follow the guided console setup below to manually provision your Resource Group, virtual networks, subnets, and virtual machines.

---

1. Console Setup

If you prefer configuring resources manually in your Azure Portal, proceed with the following steps.

Virtual Network & Subnets

1. Create the Resource Group:
   • Navigate to the Azure Portal -> Resource Groups -> Create. Name it mcm-rg and select your target region.
2. Create the Virtual Network (VNet):
   • Search for Virtual Networks -> Create.
   • Select mcm-rg, name the network mcm-vnet, and set the address space to 10.0.0.0/16.
3. Create Subnets: Add subnets inside mcm-vnet (a single subnet can be used, or three subnets for strict tiering):
   • mcm-subnet-access: CIDR 10.0.1.0/24 (Hosts Access Gateway Node VM1). (Can be public or private depending on your network design).
   • mcm-subnet-app: CIDR 10.0.2.0/24 (Hosts App Node VM2).
   • mcm-subnet-db: CIDR 10.0.3.0/24 (Hosts Database Node VM3).

Outbound Internet Access Options

Depending on your enterprise cloud policies, configure outbound internet connectivity for your Azure subnets using one of the following methods:

• Azure NAT Gateway (Standard): Associate an Azure NAT Gateway resource with your subnets (mcm-subnet-app, mcm-subnet-db).
• Network Virtual Appliance (NVA) / Azure Firewall: Configure User-Defined Routes (UDR) to route 0.0.0.0/0 traffic through your internal NVA or Azure Firewall.
• Corporate Proxy: Route outbound application traffic via an HTTP/HTTPS proxy.

Virtual Machine Deployment

• Availability Zone (Optional): You can place the VMs in different Availability Zones (e.g., VM1 in Zone 1, VM2 in Zone 2, VM3 in Zone 3) to ensure high availability and physical fault tolerance, or keep them in the default/same zone.

1. Deploy VM1 (mcm-access):
   • Place in mcm-subnet-access. Associate a Public IP address with its NIC if user-facing directly, or use a private IP if behind an internal load balancer / VPN.
   • Image: Ubuntu Server 24.04 LTS (x86_64).
   • VM Size: Standard_D2als_v6.
2. Deploy VM2 (mcm-app) & VM3 (mcm-db):
   • Deploy VM2 inside mcm-subnet-app. Size: Standard_D4ads_v6.
   • Deploy VM3 inside mcm-subnet-db. Size: Standard_D4ads_v6.
   • Set public IP to None on both network interfaces to isolate them.

Network Security Groups (NSG) & Port Rules

Configure the following rules on your Azure Network Security Groups (NSGs):

Outbound Connection Requirements

The MCM platform requires outbound HTTPS (port 443) connectivity to the following main domains:

---

2. Next Steps

Once your network infrastructure and VMs are provisioned on Azure, you are ready to configure the cluster.

Proceed to Section 3: Installation Procedure in the main deployment guide to continue.