Windows Azure Connect enables Windows Azure users to set up secure, IP-level network connectivity between their Windows Azure hosted services and local (on-premises) resources.
To set it up, you must first connect to the Windows Azure Management portal and enable it for your subscription.

Next you need to get the activation token.

Then open the ServiceDefinition.csdef file and import the Connect module for your roles.
<Imports>
<Import moduleName="Connect" />
</Imports>
And set the token in the csconfig file.
<Setting name="Microsoft.WindowsAzure.Plugins.Connect.ActivationToken" value="your_ activation_token_guid" />
To gain access to local resources you need to install Windows Azure Connect Endpoint software that you get on https://waconnecttokenpage.cloudapp.net/Default.aspx?token=yourtoken

After Connect Endpoint is installed, it will automatically “activate” itself with the Connect service which should take around 10 to 30 seconds. Once a local machine is activated, it will appear in the Virtual Network of the Management Portal when you select the “Activated Endpoints” node or the “Groups and Roles” node.

Now you have to you can define your network connectivity policy in the Virtual Networks section of the Management Portal.

If the “Interconnected” check box is checked, then machines that belong to the group will be able to communicate with each other via Connect. If it is set to false, then machines in the group will not be able to communicate with each other.

You cant ping your roles in the cloud because their local firewall prevents it, but there is a fix for that. Just add a startup task that ads a firewall rule to the firewall.
Echo Enable ICMP
netsh advfirewall firewall add rule name="ICMPv6 echo" dir=in action=allow enable=yes protocol=icmpv6:128,any
exit /b 0
Connect will automatically track changes made to your Windows Azure role and maintain connectivity. If you increase the number of Windows Azure role instances, Connect will automatically connect those new role instances based on the current network policy. The REALLY bad side of it is when you redeploy the app, you will have to add your new deployment to your network policy manualy, since we currently dont have this available in management api.