Microsoft Azure Networking
Microsoft Azure Networking connects and controls traffic among Azure resources, users, the internet, and external networks. You build it with virtual networks, subnets, routes, security controls, private endpoints, DNS, gateways, and traffic-distribution services.
itCloud computing | OpenSkills.info
Course pathWalk it in order
Look it upDip in anytime
Go furtherLeaves this page
Intro
Microsoft Azure Networking
Microsoft Azure Networking gives workloads controlled paths to each other, users, the internet, Azure services, and external networks. It combines addressing, routing, traffic filtering, name resolution, private service access, hybrid connectivity, traffic distribution, and diagnostics.
Start with one mental model:
A name resolves to an address. A route selects a path. A security control permits or denies traffic. A frontend receives traffic for a service. Diagnostics show where the path failed.
These jobs interact, but they are not interchangeable. A route does not grant access. A network security group does not create a missing route. A DNS answer does not prove that an application is reachable.
Build on virtual networks and subnets
Azure Virtual Network provides an isolated private network in Azure. You assign each virtual network one or more address ranges. You divide those ranges into subnets and place supported resources in those subnets through network interfaces or service integration.
A virtual network is regional. Its subnets belong to the same region. Resources in one virtual network can communicate by default, subject to security controls. Separate virtual networks need an explicit connection.
Plan address space before deployment. Connected virtual networks and on-premises networks need nonoverlapping ranges. Leave room for workload growth and dedicated subnets required by platform services. Record each range's owner and purpose.
A subnet is more than an address bucket. It is a common scope for route-table and network-security-group associations. Subnet boundaries help separate workload tiers and apply common policy.
Trace traffic through distinct decisions
Continue the course
This section is part of the paid course.
See pricing to subscribe, or log in if you already have access.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://learn.microsoft.com/en-us/azure/networking/design-guide/overview
Supports
- Azure networking spans virtual networking, hybrid connectivity, application delivery, security, management, and observability
- Network design begins with requirements and service selection across these categories
- https://learn.microsoft.com/en-us/azure/networking/design-guide/vnets-subnets
Supports
- Virtual networks are isolated private networks in Azure
- Subnets divide virtual-network address space and scope route-table and network-security-group associations
- Connected address spaces must not overlap
- Virtual-network peering provides direct private connectivity and is nontransitive
- Platform services can require dedicated subnets
- https://learn.microsoft.com/en-us/azure/virtual-network/network-overview
Supports
- Network interfaces connect virtual machines to virtual-network subnets
- Virtual machines use private and optional public addressing with related network resources
- Subnet selection places a network interface in a virtual network
- https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview
Supports
- Azure provides system routes and supports user-defined and Border Gateway Protocol routes
- Route tables associate with subnets
- User-defined routes can override default system routes
- Routes select next hops for destination prefixes
- More specific route prefixes participate in route selection
- https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview
Supports
- Network security groups filter inbound and outbound virtual-network traffic
- Rules have priority, source, destination, protocol, port, and allow or deny action
- Lower numerical priorities are processed before higher priorities
- Network security groups are stateful
- Application security groups and service tags reduce direct IP-address management
- https://learn.microsoft.com/en-us/azure/networking/design-guide/hub-spoke
Supports
- Hub-and-spoke topology centralizes shared connectivity services and isolates workloads in spokes
- Virtual-network peering is nontransitive
- Spoke transit needs explicit routing and forwarding
- Virtual WAN provides a Microsoft-managed hub alternative
- Virtual Network Manager can automate connectivity and route management at scale
- https://learn.microsoft.com/en-us/azure/virtual-network-manager/overview
Supports
- Virtual Network Manager groups and manages virtual networks across subscriptions and tenants
- It applies connectivity, security, and routing configurations through network groups
- https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateways
Supports
- VPN Gateway sends encrypted traffic between Azure virtual networks and external locations over the public internet
- VPN Gateway supports site-to-site, point-to-site, and virtual-network connections
- Multiple tunnels share gateway capacity
- https://learn.microsoft.com/en-us/azure/expressroute/expressroute-introduction
Supports
- ExpressRoute connects external networks to Microsoft cloud services through a connectivity provider
- ExpressRoute connections do not traverse the public internet
- ExpressRoute uses Border Gateway Protocol for dynamic route exchange
- ExpressRoute connectivity requires redundancy planning on the customer side
- https://learn.microsoft.com/en-us/azure/private-link/private-link-overview
Supports
- Private Link provides private access to supported Azure, customer-owned, and partner services
- A private endpoint uses a private IP address in the consumer virtual network
- Private Link traffic travels over the Microsoft backbone
- Private endpoints can be reached from peered and hybrid-connected networks
- https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview
Supports
- Service endpoints extend virtual-network identity to supported Azure services
- The target service continues to use a public endpoint
- Microsoft recommends Private Link and private endpoints for secure private access to supported services
- https://learn.microsoft.com/en-us/azure/dns/dns-overview
Supports
- Azure DNS provides public DNS, private DNS, and DNS Private Resolver services
- Public DNS hosts public domain records
- Private DNS resolves names within linked virtual networks
- Private Resolver enables queries between Azure and on-premises environments
- https://learn.microsoft.com/en-us/azure/dns/private-dns-privatednszone
Supports
- Private DNS zones resolve only from linked virtual networks and suitable connected resolvers
- Virtual-network links provide zone visibility
- Autoregistration can manage supported virtual-machine records
- Custom DNS requires forwarding integration to resolve linked private zones
- https://learn.microsoft.com/en-us/azure/architecture/guide/technology-choices/load-balancing-overview
Supports
- Azure provides multiple traffic-distribution services for different protocols and scopes
- Load Balancer, Application Gateway, Front Door, Traffic Manager, and API Management serve different requirements
- Service choice depends on traffic type, scope, and routing behavior
- https://learn.microsoft.com/en-us/azure/application-gateway/overview
Supports
- Application Gateway is a regional web traffic load balancer
- Application Gateway routes with HTTP request attributes such as URL paths and host headers
- Application Gateway can integrate with Web Application Firewall
- https://learn.microsoft.com/en-us/azure/network-watcher/connection-troubleshoot-overview
Supports
- Connection troubleshoot checks point-in-time reachability
- Results include configuration issues, latency, topology, and failed probes
- Findings can identify network security group, route, and port problems
- https://learn.microsoft.com/en-us/azure/network-watcher/connection-monitor-overview
Supports
- Connection Monitor continuously monitors selected Azure and hybrid paths
- Tests report reachability, latency, failed checks, and topology
- Connection Monitor supports Transmission Control Protocol, Internet Control Message Protocol, and Hypertext Transfer Protocol tests
- https://learn.microsoft.com/en-us/azure/network-watcher/network-insights-topology
Supports
- Network Watcher topology visualizes resources and relationships
- Topology provides access to connection troubleshoot, packet capture, and next-hop diagnostics