Microsoft Azure Networking

Microsoft Azure Networking gives workloads controlled paths to each other, users, the internet, Azure services, and external networks. It combines addressing, routing, traffic filtering, name resolution, private service access, hybrid connectivity, traffic distribution, and diagnostics.

Start with one mental model:

A name resolves to an address. A route selects a path. A security control permits or denies traffic. A frontend receives traffic for a service. Diagnostics show where the path failed.

These jobs interact, but they are not interchangeable. A route does not grant access. A network security group does not create a missing route. A DNS answer does not prove that an application is reachable.

Build on virtual networks and subnets

Azure Virtual Network provides an isolated private network in Azure. You assign each virtual network one or more address ranges. You divide those ranges into subnets and place supported resources in those subnets through network interfaces or service integration.

A virtual network is regional. Its subnets belong to the same region. Resources in one virtual network can communicate by default, subject to security controls. Separate virtual networks need an explicit connection.

Plan address space before deployment. Connected virtual networks and on-premises networks need nonoverlapping ranges. Leave room for workload growth and dedicated subnets required by platform services. Record each range's owner and purpose.

A subnet is more than an address bucket. It is a common scope for route-table and network-security-group associations. Subnet boundaries help separate workload tiers and apply common policy.

Trace traffic through distinct decisions