Azure Virtual Networks (VNets)

Azure Virtual Networks (VNets) are the fundamental building blocks for your private network in Azure. VNets enable you to provision and manage Azure resources, such as virtual machines, to securely communicate with each other, the internet, and on-premises networks. VNets provide the same benefits as a traditional network, but with added benefits of Azure's infrastructure, such as scalability, availability, and isolation.

Key Concepts

Subnets

A subnet is a range of IP addresses within your VNet. You can segment a VNet into smaller subnets, each with its own IP address range. This allows you to isolate resources within your network and control traffic flow between them.

• Subnets must have IP address ranges that are non-overlapping.
• Each subnet can contain multiple Azure resources.
• The first four IP addresses and the last IP address in each subnet are reserved and cannot be assigned to your resources.

IP Addressing

VNets support both public and private IP addresses. Private IP addresses are used for communication within your VNet and with your on-premises networks. Public IP addresses are used for direct access to resources from the internet.

You can assign:

• Private IP Addresses to VNets and subnets.
• Public IP Addresses to certain Azure resources for internet connectivity.

Network Security Groups (NSGs)

Network Security Groups are virtual firewalls that you can associate with subnets or individual network interfaces. NSGs allow you to filter network traffic to and from Azure resources in an Azure virtual network.

Each NSG consists of a set of security rules that allow or deny inbound network traffic to, or outbound network traffic from, various Azure resources.

Routing

Azure automatically routes traffic between subnets within a VNet. You can also configure custom routes to control the flow of traffic, for example, to direct traffic through a network virtual appliance (NVA) for enhanced security or inspection.

Common Scenarios

Connecting Virtual Machines

VNets are essential for deploying and connecting Azure Virtual Machines. You can place VMs in specific subnets and control their network access using NSGs and routing rules.

Hybrid Connectivity

Azure provides mechanisms to securely connect your on-premises networks to your VNets, enabling hybrid cloud scenarios. Common methods include:

• VPN Gateway: Establish secure, encrypted connections over the public internet.
• ExpressRoute: Create private, dedicated connections from your premises to Azure.

Isolating Resources

By segmenting your VNet into multiple subnets and applying NSGs, you can create isolated environments for different applications or tiers of your application.

Getting Started

To start using Azure Virtual Networks:

1. Create a Virtual Network in the Azure portal.
2. Define subnets for your VNet.
3. Configure Network Security Groups to control traffic flow.
4. Deploy Azure resources (like Virtual Machines) into your VNet and subnets.
5. (Optional) Configure VPN Gateway or ExpressRoute for hybrid connectivity.

Further Reading

• Virtual network overview
• Subnet design best practices
• Network Security Group rules explained