Azure
Intermediate 16 min read Azure

Azure Networking Services

VNets, traffic routing and hybrid connectivity

VNets, subnets, NSGs, peering, Load Balancer and Application Gateway form Azure networking. VPN/ExpressRoute connect on-prem; Private Endpoint keeps traffic off the internet.

VNetsubnetNSGpeeringLoad BalancerApplication GatewayExpressRouteVPN
Prerequisites: Azure Service Catalog Cloud Networking
Before we start

What you will learn

  • Design VNets and subnets
  • Apply NSGs for network security
  • Route traffic with LB/App Gateway and connect on-prem
In 60 seconds

A VNet is your private address space; subnets carve it into zones; NSGs filter traffic per subnet/NIC; VPN/ExpressRoute connect on-premises; Load Balancer / Application Gateway route inbound traffic.

Introduction

What is this?

Azure Virtual Network (VNet) is the foundation: a private IP space with subnets and default system routes. Network Security Groups (NSGs) are stateless-ish rule collections applied to subnets or NICs. Peering joins VNets (transitive via routing hubs), and virtual network gateways (VPN/ExpressRoute) connect on-prem networks. Azure Load Balancer (L4) distributes traffic; Application Gateway (L7) adds HTTP rules + WAF; Azure Front Door/CDN sits globally. Private Endpoint attaches a private IP to PaaS services so traffic never leaves Azure.

Motivation

Why do you need it?

  • VNet design is the blast radius: a bad subnet + NSG placement exposes services.
  • On-prem hybrid is the common enterprise reality — ExpressRoute/VPN is table stakes.
  • Private Endpoint removes internet egress for PaaS — a security and audit win.
  • LB vs App Gateway: L4 for TCP/UDP scale, L7 for HTTP routing, WAF and path rules.
Think about it

Mental model

Imagine

A campus with roads, gates, and a mailroom

Think of

Azure networking

VNet is the campus; subnets are departments on separate roads; NSGs are gates per road/building; the load balancer is the reception desk distributing visitors; ExpressRoute is a private highway to downtown so you don't use public streets.

Mechanics

How it works

  • VNet CIDR → subnets per tier/AZ; system routes keep traffic between subnets local.
  • NSGs filter with priority-ordered rules (apply to subnet or NIC); they are not NACL-like stateless but still rule-based.
  • Peering: two VNets peer for direct private traffic; a hub-and-spoke topology centralizes egress/inspection.
  • VPN gateway/S2S or ExpressRoute (private circuit) connects on-prem; ExpressRoute avoids public internet.
  • LB (L4) spreads TCP/UDP over a backend pool of NICs with health probes; App Gateway (L7) routes HTTP paths, terminates TLS, WAF.
  • Private Endpoint gives PaaS (SQL, Storage) a private IP in your VNet; DNS resolves to it.

A hub-and-spoke Azure network.

VNet hub
Spoke VNet A
Spoke VNet B
ExpressRoute/VPN
LB / App Gateway
Real world

In production

  • An enterprise uses hub-spoke: spoke VNets per app, a central ExpressRoute hub, NSGs per subnet, and Front Door on top.
  • A fintech puts all PaaS (SQL, Storage) behind Private Endpoints to keep the attack surface private.
  • A gaming backend routes HTTP via Application Gateway with WAF in front of a VMSS across zones; TCP workloads via Load Balancer.
Guidelines

Best practices

  • Plan VNets with non-overlapping CIDRs; overlapping ranges break peering/VPN.
  • Apply NSGs at both subnet and NIC when semantics differ; avoid rule sprawl.
  • Route east-west through the hub only where needed; peering is cheaper and simpler for clean, isolated spokes.
  • Use Private Endpoint for PaaS access; reserve public exposure for genuine public services.
Watch out

Common mistakes

  • Reusing the same CIDR across subscriptions, then hitting peering conflicts.
  • Implicit trust: no NSG on 'private' subnets, then an accidental public IP on a VM inside.
  • Peering everything mesh-style, creating explosion of peer links and unpredictable routing.
  • Forgetting NSG rules are state-aware in direction for ICMP/response flows.
Root cause analysis

Common issues

Error
Can't reach a VM from the internet on port 443
Root cause

NSG inbound rule missing or priority issue

Fix

Add an Allow HTTPS rule in the NSG with correct priority; verify via network watcher effective rules.

Error
Peered VNets can't talk despite peering
Root cause

Overlapping address spaces or route bleed

Fix

Check both address spaces for overlap and the peering connection state.

Error
ExpressRoute link is down
Root cause

Circuit/provider issue or gateway subnet misrouted

Fix

Check ExpressRoute circuit health in portal and the virtual network gateway/VPN devices.

When things break

Debugging tips

  • Trace the path: VM to VM via network watcher IP flow verify shows NSG/route blocks.
  • 'Denied by policy' for NSG → check Azure Policy network rules and effective NSG on the subnet/NIC.
  • HB/LB probe failing? Verify the probe port/path and backend health.
  • Peering route missing: check both peering routings and the address spaces.
Interviews

Interview checkpoint

Practice

Hands-on lab

Build a VNet with NSGs and Peering
35 min · intermediate
In progress
Objectives
  • Create two VNets in one region
  • Peer the VNets successfully
  • Add an NSG rule and verify effective rules

Build a VNet with NSGs and Peering

35 min · intermediate

0/5 steps
0%
sandbox · Linux sandbox
$
Try these commands
Test yourself

Quick quiz

0/1
1

Which service attaches a private IP to PaaS so traffic never leaves Azure?

Go deeper

Official documentation

Azure — VNet overview
docs
Azure — Network security groups
docs
Azure — Private endpoint
docs