4 Networking in Azure

Networking is a core building block of Azure solutions, enabling secure, reliable communication between resources, the internet, and on‑premises environments. The chapter explains how to create and manage virtual networks (VNets) and subnets—often via PowerShell—while emphasizing careful IP planning with private address spaces and CIDR. Well‑planned subnetting supports scale, security, and operational clarity, and Azure reserves a few IPs per subnet for platform operations. The narrative highlights that choosing the right tool (such as PowerShell) and a consistent naming strategy helps streamline provisioning and governance.

Subnets provide logical separation for workloads, enable service delegation to certain PaaS offerings, and benefit from Azure’s built‑in system routes; custom routes can steer traffic through required appliances (for example, a firewall). Network Security Groups (NSGs) enforce inbound/outbound filtering at either the subnet or NIC level using priority‑based rules across protocol, ports, and sources/destinations (with service tags to avoid brittle IP lists). Best practices include applying NSGs at the subnet when possible, keeping rules simple and intentional, incrementing priorities in predictable steps, and avoiding overlapping policies that are hard to reason about.

For interconnectivity, the chapter contrasts three options: VNet peering for private, low‑latency VNet‑to‑VNet connectivity within Azure; VPN Gateway for encrypted tunnels between Azure and other networks (site‑to‑site or VNet‑to‑VNet); and ExpressRoute for private, dedicated circuits that bypass the public internet, with enterprise‑grade reliability and redundancy patterns. To handle external demand, Azure Load Balancer distributes traffic across a backend pool (often a VM scale set) using a public frontend IP, health probes to remove unhealthy instances, and load‑balancing rules to map frontend to backend. Together, these capabilities help secure, connect, and scale applications efficiently on Azure.

Alpaca-Ma-Bags network overview.

Creating a virtual network with PowerShell.

Devices on a VNet get local addresses, and traffic to the public internet get a public IP address.

Comparing a VNet and a subnet to a city and suburb.

Applying the mask defined in the CIDR notation.

System route connecting Subnet A and Subnet P.

Custom route make sure the traffic goes through the Firewall VM.

NSG1 applies to all VMs in the subnet, but NSG2 only applies to VM4.

Two VNets connecting via the public Internet.

Peering two VNets to get lower latency and higher throughput.

PeeringState property is “Connected” when successfully peered.

A site-to-site VPN connection using a Virtual Network Gateway.

ExpressRoute network diagram. Traffic never enters the public internet and flows directly into Azure.

A load balancer distributing traffic from the Internet to three VMs.

• Create a virtual network (VNet) in Azure to connect other Azure service to, such as a VM. A VNet has a local range of IP addresses that it can assign to device that connects to it.
• Subnets are logical separations of a VNet that get a portion of the available IP addresses in the VNet.
• You use subnets to logically separate resources and apply specific network security rules to them.
• Classless Inter-Domain Routing (CIDR) notation is used to accurately and efficiently describe and IP address range for a network.
• A Network security group (NSG) defines a set of rules that are applied to the resource it is attached to, such as a VM or subnet.
• The rules in a NSG are evaluated according to priority and evaluation stops once a rule is hit. Rules determine if certain types of network traffic is allowed or denied.
• You can connect VNets on Azure with each other using peering, or with on-premises networks using VPN gateways and ExpressRoute.
• When a single VM can’t manage the traffic to it, you can use a load balancer to distribute the traffic to more VMs that are identical and live in a backend pool.
• Azure Virtual Networks (VNets) are the foundation for securely connecting and isolating Azure resources.
• VNets can be segmented into subnets to improve security, manageability, and network performance.
• Network Security Groups (NSGs) control inbound and outbound traffic to resources at the subnet or NIC level.
• Azure Bastion provides secure, browser-based RDP and SSH access to virtual machines without exposing public IP addresses.
• A VPN Gateway provides secure site-to-site or point-to-site connectivity between on-premises networks and Azure VNets over the internet.
• ExpressRoute enables private, dedicated connections to Azure with consistent latency and higher reliability than internet-based VPNs.
• VNet peering connects VNets within the same or different regions, allowing resources to communicate privately without gateways.
• Service endpoints extend VNet private address space to Azure services over the Microsoft backbone network.
• Private endpoints provide private IP addresses from a VNet to connect securely to Azure PaaS services.
• Azure Firewall is a managed, cloud-based network security service that protects Azure VNets with stateful packet filtering and threat intelligence.

FAQ

New-AzVirtualNetwork -Name AlpacaVNet -ResourceGroupName AlpacaRG -Location "Australia Southeast" -AddressPrefix "10.0.0.0/16"