Azure Virtual Networking (VNet) Fundamentals: The Backbone of Cloud Infrastructure

Azure Virtual Network (VNet) is the fundamental building block for your private network in Microsoft Azure. It enables many types of Azure resources, such as Azure Virtual Machines (VM), to securely communicate with each other, the internet, and on-premises networks. Understanding VNets is critical for any cloud architect, as networking forms the foundation upon which all other services are built.

What is an Azure Virtual Network (VNet)?

A VNet is a representation of your own network in the cloud. It is a logical isolation of the Azure cloud dedicated to your subscription. You can think of a VNet as a traditional network that you'd operate in your own data center, but with the added benefits of Azure's infrastructure, such as scalability, availability, and isolation.

Key Components of Azure VNet

Address Space: When creating a VNet, you must specify a custom private IP address space using CIDR notation (e.g., 10.0.0.0/16). This defines the range of IP addresses available to your resources.
Subnets: You can segment your VNet into multiple subnets. Subnets allow you to group related resources and apply specific security rules to each group. For example, you might have a "Web" subnet and a "Database" subnet.
IP Addresses: Resources in a VNet can have Private IPs (for internal communication) and Public IPs (for communication with the internet).
Network Interfaces (NIC): The interconnection between a Virtual Machine and a virtual network.

Visualizing VNet Architecture

[ Azure Region ]
      |
      |---- [ Virtual Network (10.0.0.0/16) ]
                  |
                  |---- [ Subnet A: Web Tier (10.0.1.0/24) ]
                  |          |-- VM 1 (10.0.1.4)
                  |          |-- VM 2 (10.0.1.5)
                  |
                  |---- [ Subnet B: DB Tier (10.0.2.0/24) ]
                             |-- SQL Server (10.0.2.4)

Network Security Groups (NSG)

Security is paramount in cloud networking. A Network Security Group (NSG) contains security rules that allow or deny inbound or outbound network traffic. You can associate an NSG to each subnet or individual network interface. Rules are processed based on priority using a 5-tuple hash (Source, Source Port, Destination, Destination Port, and Protocol).

Example: Inbound Security Rule

To allow web traffic to your server, you would configure a rule like this:

Priority: 100
Port: 80
Protocol: TCP
Source: Any
Destination: Any
Action: Allow

Connecting VNets and On-Premises Networks

Azure provides several ways to connect your virtual networks and extend your local data centers to the cloud:

VNet Peering: Connects two VNets in the same or different regions. Traffic stays on the Microsoft backbone network and does not go over the public internet.
VPN Gateway: Sends encrypted traffic between an Azure virtual network and an on-premises location over the public internet.
ExpressRoute: Provides a private, dedicated connection between your on-premises infrastructure and Azure, bypassing the public internet for higher security and reliability.

Real-World Use Case: Multi-Tier Application

Imagine a retail company moving its e-commerce site to Azure. They create a VNet with two subnets. The first subnet (Public) hosts the web servers, which are accessible via the internet. The second subnet (Private) hosts the customer database. By using NSGs, they ensure that the database subnet only accepts traffic from the web server subnet and never directly from the internet, significantly reducing the attack surface.

Common Mistakes to Avoid

Overlapping IP Ranges: Ensure your VNet address space does not overlap with your on-premises network or other connected VNets. Overlapping ranges will cause routing failures.
Flat Network Design: Placing all resources in a single subnet makes it difficult to manage security. Always use subnets to isolate different tiers of your application.
Ignoring Default Rules: NSGs come with default rules (like "AllowVNetInBound"). Ensure you understand these before adding your own, as they might allow more traffic than intended.
Using Public IPs unnecessarily: For internal communication, always use Private IPs to save costs and increase security.

Interview Notes: Key Concepts for Success

What is the difference between VNet Peering and a VPN? Peering is for connecting VNets within the Azure backbone for high speed/low latency. VPN is for encrypted connections over the public internet, often used for on-premises to Azure connectivity.
Can you change the address space of a VNet after creation? Yes, you can add or remove address spaces, but it is easier to plan ahead to avoid downtime for peered VNets.
What is the purpose of the Azure Bastion service? It allows you to securely connect to your VMs via RDP/SSH over SSL without exposing Public IPs on the VMs.
Are VNets region-bound? Yes, a VNet is scoped to a single Azure region. To connect VNets in different regions, you must use Global VNet Peering.

Summary

Azure Virtual Networking is the foundation of your cloud journey. By mastering VNets, subnets, and NSGs, you ensure that your cloud infrastructure is organized, secure, and ready to scale. Remember to plan your IP address spaces carefully, use subnets to isolate application tiers, and leverage VNet peering for seamless communication between resources. In the next lesson, we will explore how to integrate these networking concepts with Azure Virtual Machines for a complete compute solution.