Azure Networking Concepts Overview

Azure networking provides a set of services that connect cloud resources to each other and to on-premises networks. The business problem is: how do you securely and reliably connect distributed resources—virtual machines, databases, web apps—across the globe while controlling traffic, ensuring high availability, and minimizing latency? On-premises, you'd use physical routers, switches, firewalls, and leased lines. In Azure, these are virtualized and delivered as services.

An Azure Virtual Network (VNet) is a logically isolated network in the Azure cloud. Think of it as your own private network in Azure. When you create a VNet, you define an IP address space using CIDR notation (e.g., 10.0.0.0/16). You then divide this space into subnets (e.g., 10.0.1.0/24 for web servers, 10.0.2.0/24 for databases). Resources like VMs are placed into subnets. VNets are region-specific—you cannot span a VNet across regions, but you can connect VNets via peering or VPN.

Subnets: Segments within a VNet. Each subnet has its own IP range. Network Security Groups (NSGs) and route tables can be applied per subnet.

Network Security Groups (NSGs): A firewall for inbound/outbound traffic to subnets or NICs. They contain rules that allow or deny traffic based on source/destination IP, port, and protocol. Default rules allow all outbound and deny all inbound from the internet.

Azure DNS: Hosts DNS domains and provides name resolution using Microsoft Azure infrastructure. You can use Azure DNS for public or private domains.

Azure Load Balancer: Distributes incoming traffic among healthy VM instances. It operates at Layer 4 (TCP/UDP). You can use it for internal or external traffic.

Azure Application Gateway: A Layer 7 load balancer with web application firewall (WAF) capabilities. It can route traffic based on URL path, host headers, etc.

Azure VPN Gateway: Sends encrypted traffic between an Azure VNet and an on-premises location over the public internet. Two types: policy-based (static routing) and route-based (dynamic routing).

Azure ExpressRoute: A dedicated private connection from on-premises to Azure, bypassing the internet for higher reliability, lower latency, and higher security.

Azure Traffic Manager: DNS-based traffic load balancer that distributes traffic to endpoints across global Azure regions based on routing methods (performance, weighted, priority, geographic).

Azure Firewall: A managed, cloud-based network security service that protects your VNet resources. It's a stateful firewall with built-in high availability and unlimited scalability.

Azure Content Delivery Network (CDN): Caches static content (images, videos, CSS) at edge locations worldwide to reduce latency for users.

Most networking services have a consumption-based pricing model. For example, VNet itself is free, but you pay for data transfer outbound. VPN Gateway charges per hour plus data transfer. ExpressRoute charges per month based on bandwidth and circuit type (metered vs. unlimited). Load Balancer charges per hour per rule and per GB of data processed.

On-premises, you need to buy, configure, and maintain physical routers, switches, firewalls, and load balancers. Scaling requires hardware procurement. In Azure, you provision these services instantly via the portal, CLI, or ARM templates. Azure handles redundancy and patching. However, you lose physical control and must manage virtual configurations.

az network vnet create \
  --name MyVNet \
  --resource-group MyRG \
  --location eastus \
  --address-prefix 10.0.0.0/16 \
  --subnet-name default \
  --subnet-prefix 10.0.1.0/24

Scenario 1: E-commerce Website with Global Users

A retail company launches an e-commerce site on Azure VMs in the East US region. To handle traffic spikes, they deploy a load balancer distributing requests across three VMs. They use Azure CDN to cache product images at edge locations worldwide, reducing load on origin servers and improving page load times for customers in Europe and Asia. They also set up Azure Traffic Manager with performance routing to direct users to the closest regional deployment (East US for US, West Europe for EU). Cost: CDN egress costs are lower than origin traffic. If misconfigured—e.g., missing NSG rules—the site could be vulnerable to DDoS attacks.

Scenario 2: Hybrid Cloud for a Financial Services Firm

A bank has an on-premises data center with legacy applications. They want to extend to Azure for burst capacity and disaster recovery. They set up an ExpressRoute circuit with a 1 Gbps connection to Azure, bypassing the internet for low latency and compliance. They create a VNet with subnets for web, app, and database tiers. They use Azure Firewall to inspect traffic between tiers and to the internet. They also deploy Azure VPN Gateway as a backup connection. Common mistake: not planning IP address ranges, causing overlaps and inability to connect. Cost: ExpressRoute monthly fee + data transfer; they choose the metered billing model for predictable costs.

Scenario 3: SaaS Application with Multi-Region Deployment

A SaaS provider runs their application in both US East and US West. They use VNet peering to connect the two VNets, allowing low-latency communication between databases. They use Azure Load Balancer in each region for high availability. They also use Traffic Manager with priority routing to failover to West if East goes down. They implement Azure DNS for custom domain names. A pitfall: forgetting to update DNS records after a failover test, causing prolonged downtime. They monitor with Azure Monitor and Network Watcher.