Azure Network Service

Azure Network Services provide the infrastructure to build and manage your isolated networks in the cloud. The core building block of Azure networking is the Virtual Network (VNet), which allows users to create a customized network environment, including multiple subnets for different application components.

1. Virtual Networks and Subnets

• Virtual Network (VNet): This is the foundational element for Azure networking. It enables the creation of a private network in Azure where you can deploy services and resources.
• Subnets: A VNet can be divided into subnets to organize resources effectively. Common examples include:
  • Web Server Subnet
  • Application Server Subnet (e.g., App Servers 1 and 2)
  • Database Subnet
  • Gateway Subnet
  • Virtual Appliance Subnet

By segmenting resources into subnets, you can manage network traffic more efficiently and implement security measures specific to each subnet.

2. Deploying Azure Services

Once subnets are established, various Azure services can be deployed within them, including:

• Virtual Machines (VMs): Deploy your compute resources.
• PaaS Environments: Services like Azure App Service environments can be deployed in their dedicated subnets.
• Managed Services: Services such as Azure SQL Managed Instance and Azure Integration Services can also be deployed within a VNet, enabling private connectivity.

3. Security and Protection Strategies

To safeguard your Azure resources, Azure offers several protection strategies:

a. DDoS Protection

• Basic Tier: Free and automatically enabled for all Azure subscriptions, offering baseline protection against Distributed Denial-of-Service (DDoS) attacks.
• Standard Tier: Provides advanced DDoS protection features, including cost protection and attack analytics.

b. Azure Firewall

• A robust network security service that provides centralized management of firewall rules.
• Supports inbound and outbound rules, network and application-level filtering, and SNAT/DNAT configurations.

c. Network Security Groups (NSGs)

• If the firewall is too costly, NSGs can be used to filter inbound and outbound traffic at the subnet or VM level.
• You can define specific rules to allow or deny traffic based on IP addresses, ports, and protocols.

d. Application Security Groups (ASGs)

• ASGs allow you to group related servers and apply NSG rules collectively, simplifying rule management.

4. Service Availability

To ensure high availability and resilience, Azure provides several services:

a. Traffic Manager

• A DNS-based traffic load balancer that distributes traffic across service endpoints in different regions, enhancing availability and responsiveness.

b. Load Balancer

• Distributes incoming traffic among a pool of servers:
  • External Load Balancer: Sits outside the VNet to balance public traffic.
  • Internal Load Balancer: Operates within the VNet for private traffic management.

c. Application Gateway

• An application-level load balancer that provides features like URL path-based routing and multi-site hosting.

d. Availability Zones

• Deploy resources in different availability zones within a region to safeguard against data center failures.

5. Communication Between Workloads

Creating a VNet allows for seamless communication between workloads through default system routes. However, you can also configure user-defined routes (UDRs) to customize traffic flow.

a. VNet Peering

• Enables communication between two VNets, either within the same region or across regions (global peering).

b. Connectivity to On-Premises Data Centers

• Site-to-Site VPN: Connects Azure VNets to on-premises networks over the Internet.
• ExpressRoute: Offers private, dedicated connectivity from on-premises networks to Azure.

6. Monitoring Network Services

After deploying services, monitoring is essential for performance and security.

a. Azure Security Center

• A unified security management system that provides insights into the security posture of your resources.
• Offers security recommendations based on applied policies and configurations across your network and services.

b. Azure Monitor

• A comprehensive monitoring service that allows you to track performance and health metrics of your network resources.