License server peering

Some applications deployed in Schoolyear AVD require access to license servers running on your organization’s internal network. To enable this connectivity, you need to establish VNet peering between the Schoolyear AVD’s VNet and your license server network.

All Schoolyear exams use a single VNet to deploy the session hosts to. You can leverage Azure VNet peering to connect Schoolyear AVD’s VNET with your license server. Afterward, all deployed exams will have access to your license server.

This guide walks you through setting up VNet peering and testing the connection to ensure your licensed applications can activate properly during exams. This guide also assumes you have your license server already set up and running inside a resource group in a separate subscription in your Azure tenant. Setting up license servers is outside the scope of this guide, as that is different for every application.

The general solution for this problem in Azure is VNet peering. VNet peering allows 2 VNets, either in the same subscription or different, to communicate as if they were a single unified VNet and for their traffic to flow freely internally using Azure internal network backbone.

Caution

VNet peering only works for VNets which do not have overlapping address space. It is possible to connect 2 VNets in Azure that have overlapping address space, however VNet peering is by far the easiest solution to connect 2 VNets, so we highly recommend to either:

1. Configure the Schoolyear Exams Network address space to avoid your already existing license server address space
2. Install your license servers in a VNet with an address space that does not overlap with Schoolyear’s Exams Network address space.

Step 1: Locate your Schoolyear AVD VNet

First, you need to find your Schoolyear AVD VNet. When you installed the Schoolyear AVD add-on, it created three resource groups. One of these resource groups (default: rg-sy-exams-network) contains the VNet that all deployed exams use to deploy the session hosts. This is the VNet that we will peer to the license server VNet. Go inside the resource group and select the VNet.

Step 2: Create VNet peering

1. In the Azure Portal, navigate to your Schoolyear Exams Network VNet.

2. In the left menu, select Settings -> Peerings.

3. Click + Add to create a new peering.

4. Configure the peering with these settings:

   • Peering link name: sy-exams-network-to-license-server

5. Under subscription:

   • Select the subscription your license server VNet belongs to.

6. Under Virtual network:

   • Select the virtual network your license server belongs to.

7. Under Remote virtual network peering settings:

   • Make sure that Allow the peered virtual network to access vnet-sy is selected.

8. Under Local virtual network peering settings:

   • Make sure that Allow vnet-sy to access the peered virtual network is selected.

9. Click Add to create the peering.

Note

Wait for both sides to show “Connected” status before proceeding to testing.

Step 3: Create a test VM

To verify the peering works correctly, create a test VM in the Schoolyear Exams network and test connectivity to your license server.

1. In the Azure Portal, navigate to your Schoolyear Exams network resource group and click + Create a resource.

2. Search for Virtual Machine and click Create.

3. Configure the VM:

   • Subscription: Your Schoolyear AVD subscription
   • Resource group: Your Schoolyear AVD Resource Group
   • Virtual machine name: avd-connectivity-test
   • Region: Same region as your Schoolyear AVD deployment
   • Image: Windows Server 2022 Datacenter
   • Size: Standard_B2s (sufficient for testing)

4. Under Administrator account:

   • Username: testadmin
   • Password: Create a secure password

5. Under Inbound port rules:

   • Public inbound ports: Allow selected ports
   • Select inbound ports: RDP (3389)

6. Click Next: Disks, then Next: Networking.

7. Under Networking:

   • Virtual network: Select your Schoolyear Exams network
   • Subnet: Select the sessionhosts subnet
   • Public IP: Create new

8. Click Review + create, then Create.

9. Wait for the deployment to complete.

Step 4: Test connectivity with ping

Once your test VM is deployed, test connectivity to your license server.

1. Connect to your test VM via RDP using the public IP address and credentials you created.

2. Open Command Prompt as administrator.

3. Test basic network connectivity to your license server:

   ping [LICENSE_SERVER_IP]

   Replace [LICENSE_SERVER_IP] with your license server’s actual IP address.

4. If ping succeeds, test port connectivity using telnet:

   telnet [LICENSE_SERVER_IP] [PORT]

   Replace [PORT] with your license server’s port (e.g., 27000 for FlexNet).

5. If telnet connects successfully, the connection is working. Press Ctrl+] then type quit to exit telnet.

Note

If ping fails but you know your license server is running, the server may have ICMP (ping) disabled for security reasons. This is normal - focus on testing the actual license server port connectivity.

Step 5: Test application-specific connectivity

For a more thorough test, verify that your licensed application can actually reach the license server.

1. On your test VM, install the client portion of your licensed application (if possible).

2. Configure the application to point to your license server’s IP address.

3. Attempt to start the application or run a license check command.

4. Verify that the application can successfully authenticate with the license server.

Step 6: Clean up test resources

After successful testing, clean up the test VM to avoid unnecessary costs.

1. In the Azure Portal, navigate to your test VM (avd-connectivity-test).

2. Click Delete and confirm the deletion.

3. Also delete associated resources like:

   • Network interface
   • Public IP address
   • OS disk
   • Network security group (if created specifically for the test VM)

Troubleshooting

If connectivity tests fail, check these common issues:

• Peering Status: Ensure both peering connections show “Connected” status in the Azure Portal.
• Network Security Groups: Check that NSG rules allow traffic between the networks on the required ports.
• License Server Configuration: Some license servers may need to be configured to accept connections from the new network range.
• Firewall Rules: Windows Firewall or third-party firewalls on the license server may block connections from the AVD network.

Tip

If you continue to experience connectivity issues after verifying these common problems, check the support options available to your service team for additional assistance.