Azure Networking Overview

The Azure Networking Stack

Azure networking works in layers — each layer handles a different aspect of connectivity. Think of it like this:

Core Networking Components

Virtual Network (VNet)

A VNet is your private network in Azure — an isolated, logically defined network that your Azure resources live in. All VMs, databases, and other resources must be in a VNet to communicate privately. A VNet has an IP address space (e.g., 10.0.0.0/16) which you divide into subnets.

Subnet

A subnet is a segment within a VNet. You deploy resources into specific subnets to organise them and apply security policies. For example: a web subnet for front-end VMs, an app subnet for application servers, a data subnet for databases.

Network Interface Card (NIC)

Every VM has at least one NIC — the virtual network adapter connecting it to a subnet. The NIC has a private IP (from the subnet) and optionally a public IP.

Public IP Address

Resources need a public IP to be reachable from the internet. Public IPs can be dynamic (changes on stop/start) or static (fixed). Standard SKU is recommended for production.

Network Security Layer

Network Security Group (NSG)

An NSG is a virtual firewall — a set of inbound and outbound rules that allow or deny network traffic. NSGs can be applied to subnets or individual NICs. Rules are evaluated in priority order (lower number = higher priority).

Azure Firewall

A managed, cloud-native network firewall with advanced features — FQDN filtering, threat intelligence, central policy management across VNets. More powerful than NSGs but costs more.

Azure DDoS Protection

Protects Azure resources from Distributed Denial of Service attacks. Basic tier is free and automatically applied. Standard tier adds adaptive tuning, attack analytics, and SLA guarantees.

Load Balancing Options

Azure has four load balancing services — choosing the right one depends on the traffic type and use case:

Hybrid Connectivity

VNet Peering

Connects two VNets so resources in each can communicate privately. Traffic stays on Microsoft's backbone — low latency, no internet. Can peer VNets in the same region (regional peering) or different regions (global peering).

VPN Gateway

Creates an encrypted tunnel over the internet between your on-premises network and Azure VNet (Site-to-Site VPN), or between individual computers and Azure (Point-to-Site VPN).

Azure ExpressRoute

A dedicated private connection from your on-premises network to Azure — not over the internet. Higher bandwidth, lower latency, and consistent performance compared to VPN. More expensive and requires working with a connectivity provider.

DNS in Azure

Azure DNS

Host your public DNS domains in Azure. Manage DNS records (A, CNAME, MX, TXT) for your custom domains using Azure infrastructure.

Private DNS Zones

DNS resolution for private resources within VNets. Allows VMs to resolve each other by name (e.g., vm1.internal.com) without going through public DNS.

Traffic Routing Services

Route Tables (UDR — User Defined Routes)

Override Azure's default routing to force traffic through specific paths — for example, route all outbound traffic through Azure Firewall for inspection.

Service Endpoints

Extend VNet identity to Azure services (Storage, SQL) so traffic between your VNet and those services travels on the Microsoft backbone rather than the internet — without needing private endpoints.

Private Endpoints

Give Azure services (Storage, SQL, Key Vault) a private IP within your VNet. Completely removes public internet exposure for those services.

Typical Azure Network Architecture

A typical production architecture layers these services together: