Skip to content

Core networking concepts (IP, subnets, DNS) are in the Networking notes, see Subnetting and DNS. This note is how Azure applies them.

Services at a glance

Service Purpose
Virtual Network (VNet) and subnets Private network
Network Security Group (NSG) Subnet / NIC firewall rules
Azure Firewall, WAF, DDoS Protection Perimeter protection
Azure Bastion Secure RDP / SSH without public IPs
Private Link / Private Endpoint, Service Endpoints Private access to PaaS
VNet Peering, VPN Gateway, ExpressRoute, Virtual WAN Connect networks
Load Balancer, Application Gateway, Front Door, Traffic Manager Traffic distribution
Azure DNS, Private DNS Name resolution
Azure CDN Content delivery
Network Watcher Diagnostics and monitoring

Virtual Network (VNet)

A private, isolated network in Azure scoped to one region and one subscription.

  • You choose an address space in CIDR, e.g. 10.0.0.0/16
  • Divide it into subnets, e.g. 10.0.1.0/24
  • Azure reserves 5 IPs per subnet (network, gateway, two DNS, broadcast)
  • Resources in one VNet reach each other by default
$ az network vnet create -g rg-demo -n vnet-main \
    --address-prefix 10.0.0.0/16 \
    --subnet-name snet-web --subnet-prefix 10.0.1.0/24

Public vs private IPs

  • Private IP: inside the VNet (dynamic or static)
  • Public IP: reachable from the internet, SKUs Basic / Standard. Standard is zone-aware and secure by default (closed until an NSG allows traffic)

Securing Traffic

Network Security Group (NSG)

Stateful allow/deny rules attached to a subnet or a NIC. Rules have a priority (100-4096, lower is evaluated first), direction, protocol, source, destination and port.

Priority Name Port Source Action
100 AllowHTTPS 443 Internet Allow
110 AllowSSH 22 My IP Allow
65500 DenyAllInbound Any Any Deny (default)

Use service tags (Internet, VirtualNetwork, Storage) and application security groups so rules read by role instead of IP.

Azure Firewall

Managed, stateful firewall-as-a-service for the whole VNet: FQDN filtering, threat intelligence, central logging.

DDoS Protection

Basic protection is included. DDoS Network / IP Protection adds adaptive tuning, telemetry and cost protection.

Azure Bastion

Browser-based RDP/SSH to VMs over TLS without exposing public IPs on the VMs.

Private connectivity to PaaS

  • Service endpoints: extend your VNet identity to a PaaS service over the Azure backbone, public IP of the service remains
  • Private Endpoint (Private Link): gives the PaaS service a private IP in your VNet; best for locking storage/SQL off the internet

Connecting Networks

Option Use
VNet peering Connect two VNets over the Microsoft backbone, low latency, not transitive
VPN Gateway (site-to-site) IPsec tunnel between on-prem and Azure over the internet
Point-to-site VPN A single client device to Azure
ExpressRoute Private dedicated circuit via a provider, does not traverse the public internet
Virtual WAN Managed hub-and-spoke for many branches and VNets 
Hub VNet (firewall, gateway)
   ├── peering ── Spoke VNet A
   └── peering ── Spoke VNet B

Gateway transit lets spokes use the hub's VPN/ExpressRoute gateway.

Load Balancing and Delivery

Service Layer Scope Typical use
Load Balancer 4 (TCP/UDP) Regional Distribute traffic to VMs
Application Gateway 7 (HTTP/S) Regional Path routing, TLS offload, WAF
Front Door 7 Global Global HTTP entry, CDN, WAF, failover
Traffic Manager DNS-based Global Route by priority, performance, geography
  • WAF (Web Application Firewall) protects against OWASP top threats, available on Application Gateway and Front Door
  • Azure CDN caches static content close to users

DNS

  • Azure DNS: host your public DNS zones in Azure
  • Private DNS zones: name resolution inside VNets without running DNS servers
  • Default Azure-provided DNS resolves VM names inside a VNet

Routing

  • System routes: default routes created by Azure
  • User-defined routes (UDR): force traffic through an appliance (e.g. firewall) using a route table
  • BGP: dynamic route exchange with VPN/ExpressRoute gateways