EEdukron DevOps Library
Microsoft AzureIntermediate19 submodules

Azure Networking

Design private, controlled, observable connectivity between Azure workloads, users, on-premises networks, the internet, and global entry points.

How this module works

From concept to production evidence

Start with address space and traffic flows, segment by trust and function, route deliberately, inspect at boundaries, prefer private service access, and validate every path with platform diagnostics.

Learning outcomes

  • Design VNets, subnets, and routing
  • Apply NSGs and application security groups
  • Choose public, private, NAT, VPN, ExpressRoute, and peering connectivity
  • Select load-balancing and global-routing services
  • Use private endpoints and Network Watcher

Flow diagram

Azure Networking end-to-end flow

Use this sequence as the operating backbone for every submodule note and hands-on exercise.

  1. 01
    Plan addressesAzure Networking stage 1: plan addresses with an auditable result before the next stage begins.
  2. 02
    Segment subnetsAzure Networking stage 2: segment subnets with an auditable result before the next stage begins.
  3. 03
    Select routesAzure Networking stage 3: select routes with an auditable result before the next stage begins.
  4. 04
    Enforce boundariesAzure Networking stage 4: enforce boundaries with an auditable result before the next stage begins.
  5. 05
    Publish or privatize serviceAzure Networking stage 5: publish or privatize service with an auditable result before the next stage begins.
  6. 06
    Observe packet pathAzure Networking stage 6: observe packet path with an auditable result before the next stage begins.

Integrated hands-on lab

Build a hub-and-spoke traffic path

  1. Create an address plan
  2. Design hub and spoke subnets
  3. Apply routes and security groups
  4. Add private service access and controlled egress
  5. Validate flows with Network Watcher

Complete module contents

19 full submodule notes

Read in order
01

Virtual Network

Virtual Network governs how a request is named, addressed, routed, filtered, transported, protected, and delivered to a healthy endpoint within Azure Networking. It is not an isolated definition: its value appears when it supports start with address space and traffic flows, segment by trust and function, route deliberately, inspect at boundaries, prefer private service access, and validate every path with platform diagnostics.

Open full notes
02

Subnets

Subnets governs how a request is named, addressed, routed, filtered, transported, protected, and delivered to a healthy endpoint within Azure Networking. It is not an isolated definition: its value appears when it supports start with address space and traffic flows, segment by trust and function, route deliberately, inspect at boundaries, prefer private service access, and validate every path with platform diagnostics.

Open full notes
03

NSG

NSG provides a concrete platform capability that must be configured, secured, validated, observed, and owned throughout its lifecycle within Azure Networking. It is not an isolated definition: its value appears when it supports start with address space and traffic flows, segment by trust and function, route deliberately, inspect at boundaries, prefer private service access, and validate every path with platform diagnostics.

Open full notes
04

ASG

ASG provides a concrete platform capability that must be configured, secured, validated, observed, and owned throughout its lifecycle within Azure Networking. It is not an isolated definition: its value appears when it supports start with address space and traffic flows, segment by trust and function, route deliberately, inspect at boundaries, prefer private service access, and validate every path with platform diagnostics.

Open full notes
05

Route Tables

Route Tables governs how a request is named, addressed, routed, filtered, transported, protected, and delivered to a healthy endpoint within Azure Networking. It is not an isolated definition: its value appears when it supports start with address space and traffic flows, segment by trust and function, route deliberately, inspect at boundaries, prefer private service access, and validate every path with platform diagnostics.

Open full notes
06

Public IP

Public IP governs how a request is named, addressed, routed, filtered, transported, protected, and delivered to a healthy endpoint within Azure Networking. It is not an isolated definition: its value appears when it supports start with address space and traffic flows, segment by trust and function, route deliberately, inspect at boundaries, prefer private service access, and validate every path with platform diagnostics.

Open full notes
07

Private IP

Private IP governs how a request is named, addressed, routed, filtered, transported, protected, and delivered to a healthy endpoint within Azure Networking. It is not an isolated definition: its value appears when it supports start with address space and traffic flows, segment by trust and function, route deliberately, inspect at boundaries, prefer private service access, and validate every path with platform diagnostics.

Open full notes
08

NAT Gateway

NAT Gateway governs how a request is named, addressed, routed, filtered, transported, protected, and delivered to a healthy endpoint within Azure Networking. It is not an isolated definition: its value appears when it supports start with address space and traffic flows, segment by trust and function, route deliberately, inspect at boundaries, prefer private service access, and validate every path with platform diagnostics.

Open full notes
09

VNet Peering

VNet Peering governs how a request is named, addressed, routed, filtered, transported, protected, and delivered to a healthy endpoint within Azure Networking. It is not an isolated definition: its value appears when it supports start with address space and traffic flows, segment by trust and function, route deliberately, inspect at boundaries, prefer private service access, and validate every path with platform diagnostics.

Open full notes
10

VPN Gateway

VPN Gateway governs how a request is named, addressed, routed, filtered, transported, protected, and delivered to a healthy endpoint within Azure Networking. It is not an isolated definition: its value appears when it supports start with address space and traffic flows, segment by trust and function, route deliberately, inspect at boundaries, prefer private service access, and validate every path with platform diagnostics.

Open full notes
11

ExpressRoute

ExpressRoute governs how a request is named, addressed, routed, filtered, transported, protected, and delivered to a healthy endpoint within Azure Networking. It is not an isolated definition: its value appears when it supports start with address space and traffic flows, segment by trust and function, route deliberately, inspect at boundaries, prefer private service access, and validate every path with platform diagnostics.

Open full notes
12

Azure Load Balancer

Azure Load Balancer governs how a request is named, addressed, routed, filtered, transported, protected, and delivered to a healthy endpoint within Azure Networking. It is not an isolated definition: its value appears when it supports start with address space and traffic flows, segment by trust and function, route deliberately, inspect at boundaries, prefer private service access, and validate every path with platform diagnostics.

Open full notes
13

Application Gateway

Application Gateway governs how a request is named, addressed, routed, filtered, transported, protected, and delivered to a healthy endpoint within Azure Networking. It is not an isolated definition: its value appears when it supports start with address space and traffic flows, segment by trust and function, route deliberately, inspect at boundaries, prefer private service access, and validate every path with platform diagnostics.

Open full notes
14

Azure Front Door

Azure Front Door governs how a request is named, addressed, routed, filtered, transported, protected, and delivered to a healthy endpoint within Azure Networking. It is not an isolated definition: its value appears when it supports start with address space and traffic flows, segment by trust and function, route deliberately, inspect at boundaries, prefer private service access, and validate every path with platform diagnostics.

Open full notes
15

Traffic Manager

Traffic Manager governs how a request is named, addressed, routed, filtered, transported, protected, and delivered to a healthy endpoint within Azure Networking. It is not an isolated definition: its value appears when it supports start with address space and traffic flows, segment by trust and function, route deliberately, inspect at boundaries, prefer private service access, and validate every path with platform diagnostics.

Open full notes
16

Private Endpoint

Private Endpoint provides a concrete platform capability that must be configured, secured, validated, observed, and owned throughout its lifecycle within Azure Networking. It is not an isolated definition: its value appears when it supports start with address space and traffic flows, segment by trust and function, route deliberately, inspect at boundaries, prefer private service access, and validate every path with platform diagnostics.

Open full notes
17

Private Link

Private Link provides a concrete platform capability that must be configured, secured, validated, observed, and owned throughout its lifecycle within Azure Networking. It is not an isolated definition: its value appears when it supports start with address space and traffic flows, segment by trust and function, route deliberately, inspect at boundaries, prefer private service access, and validate every path with platform diagnostics.

Open full notes
18

Azure DNS

Azure DNS governs how a request is named, addressed, routed, filtered, transported, protected, and delivered to a healthy endpoint within Azure Networking. It is not an isolated definition: its value appears when it supports start with address space and traffic flows, segment by trust and function, route deliberately, inspect at boundaries, prefer private service access, and validate every path with platform diagnostics.

Open full notes
19

Network Watcher

Network Watcher governs how a request is named, addressed, routed, filtered, transported, protected, and delivered to a healthy endpoint within Azure Networking. It is not an isolated definition: its value appears when it supports start with address space and traffic flows, segment by trust and function, route deliberately, inspect at boundaries, prefer private service access, and validate every path with platform diagnostics.

Open full notes