Virtual Networks and Subnetting Fundamentals
Virtual Networks (VNets) are the foundation of Azure networking. They represent your private network infrastructure in the cloud. A VNet operates within a specific region and contains subnets, which subdivide your address space.
Understanding VNet Architecture
When creating a VNet, you define an address space using CIDR notation, such as 10.0.0.0/16. This gives you 65,536 usable IP addresses. Subnets are carved from this address space. For example, 10.0.1.0/24 provides a subnet with 256 addresses.
Azure reserves the first three and last one IP address in each subnet for network operations. This leaves fewer usable addresses than the mathematics suggests. Plan your subnet sizing carefully to account for this requirement.
Security and Traffic Control
Network Security Groups (NSGs) control traffic at the subnet or network interface level. They use inbound and outbound rules to filter traffic. Service Endpoints allow you to secure Azure service access to specific subnets without routing traffic through the public internet.
Design Considerations
When designing VNets, consider these key factors:
- IP addressing strategy and future growth
- Subnet sizing for scalability
- Whether to use custom DNS servers
Azure provides the IP Calculator and networking reference architecture documentation to guide these decisions. Good planning prevents costly redesigns when your organization scales.
Load Balancing and Traffic Distribution Solutions
Azure offers multiple load balancing options, each optimized for different use cases and network layers. Choosing the right solution requires understanding where routing decisions occur and your geographic distribution needs.
Layer 4 Transport Layer Balancing
The Azure Load Balancer operates at Layer 4 (transport layer). It distributes incoming network traffic across multiple virtual machines in an availability set or scale set. It supports inbound and outbound traffic patterns with TCP and UDP protocols.
The Standard SKU provides availability zone support and better diagnostics compared to the Basic SKU.
Layer 7 Application Layer Routing
Application Gateway operates at Layer 7 (application layer). It understands HTTP and HTTPS protocols, routing traffic based on URL paths, hostnames, or other application-level criteria. Use this for complex routing scenarios where you need to direct requests to different backend pools based on application logic.
Global Traffic Distribution
Traffic Manager uses DNS-based traffic routing across Azure regions or external endpoints. It works well for disaster recovery scenarios and global distribution.
Azure Front Door combines Traffic Manager and Application Gateway capabilities. It adds DDoS protection and Web Application Firewall integration for comprehensive defense.
Choosing the Right Solution
Analyze your application's requirements, the OSI layer at which routing decisions occur, and your geographic distribution needs. Load balancing is critical for building highly available applications that handle growth without performance degradation.
Network Security Groups and Firewall Rules
Network Security Groups are stateful firewalls that filter traffic at the subnet or network interface level. They contain inbound and outbound security rules specifying source, destination, protocol, port range, and action (allow or deny).
Rule Processing and Priority
Rules are processed in priority order. Lower numbers are evaluated first, and the first matching rule determines whether traffic passes. Each NSG can contain up to 1000 rules. Best practice suggests organizing rules logically to stay well below this limit.
Default rules exist in every NSG:
- Allow all inbound VNet traffic
- Allow all outbound traffic
- Deny traffic from the internet
Advanced Security Grouping
Application Security Groups create logical groupings of resources for rule assignment. They help you write more efficient and maintainable rules compared to using IP addresses directly.
Managed Firewall Services
Azure Firewall is a managed stateful firewall service that operates at the hub level in network architectures. It enforces application and network-level policies across your entire Azure network. Threat intelligence filtering automatically blocks traffic to and from known malicious IP addresses and domains.
Best Practices for Firewall Design
Follow the principle of least privilege by allowing only necessary traffic. Regularly audit rule effectiveness. Service tags simplify rule creation by representing ranges of IP addresses for Azure services, reducing complexity when managing rules that reference external services or regions.
Hybrid Connectivity and VPN Solutions
Connecting on-premises networks to Azure requires understanding multiple connectivity options. Each option has different characteristics, performance profiles, and cost implications. Many organizations use a combination of solutions for redundancy and flexibility.
Site-to-Site and Point-to-Site VPN
Site-to-Site VPN uses IPsec tunnels over the public internet to connect your entire on-premises network to Azure. This suits branch offices and scenarios where you need persistent encrypted connectivity. The VPN Gateway supports multiple connections with active-active configurations for high availability.
Point-to-Site VPN allows individual users or devices to connect securely to Azure from anywhere. It uses OpenVPN, IKEv2, or SSTP protocols. This is ideal for remote workers accessing Azure-hosted resources.
Dedicated Private Connectivity
ExpressRoute provides dedicated private connectivity to Azure through a connectivity provider. It offers higher bandwidth, lower latency, and more consistent performance compared to VPN solutions. ExpressRoute also enables connectivity to Microsoft cloud services like Office 365 and Dynamics 365 without traversing the public internet.
Centralized Hybrid Management
Azure Virtual WAN simplifies hybrid network management by providing a central hub for multiple sites and branches. It automatically manages routing and security policies across your hybrid environment.
Selecting Your Connectivity Strategy
Consider these factors when choosing a solution:
- Required bandwidth and throughput
- Latency sensitivity for your applications
- Security and compliance requirements
- Budget constraints
Understanding the strengths and limitations of each option enables you to design resilient, scalable hybrid networks.
DNS, Name Resolution, and Azure DNS Management
Domain Name System infrastructure makes your Azure applications accessible by user-friendly names rather than IP addresses. Proper DNS architecture reduces operational overhead and improves user experience.
Azure DNS Hosting and Record Types
Azure DNS allows you to host DNS zones for your domain names directly in Azure. It integrates with Azure Resource Manager for unified management. You can create multiple record types:
- A records for IPv4 addresses
- AAAA records for IPv6 addresses
- CNAME records for aliases
- MX records for mail servers
- TXT records for text information
Private and Public DNS Zones
Private DNS zones enable you to use custom DNS names within your VNet without exposing them to the public internet. This is essential for internal services that shouldn't be discoverable externally.
Alias records create intelligent references to other Azure resources. They automatically update when those resources' IP addresses change, reducing manual maintenance.
Advanced DNS Features
Conditional forwarding allows you to configure VNets to forward DNS queries to on-premises DNS servers or custom DNS infrastructure. This enables split DNS scenarios where internal and external DNS names coexist.
When deploying Azure DNS, you receive four authoritative name servers that Azure assigns. Configure these at your domain registrar. DNSSEC signing provides additional security by digitally signing DNS records to prevent spoofing attacks.
DNS Troubleshooting
Understanding DNS propagation, TTL values, and DNS resolution order helps troubleshoot connectivity issues. These concepts ensure your applications remain discoverable throughout your infrastructure.