Exploring Network Watcher

The last chapter of this book will introduce you to the topic of Network Watcher. So far, in this book, we have worked with networking components (such as virtual networks, load balancers, and network security groups) by provisioning and configuring them. We also covered diagnostic settings, which allow us to export logs from a service to another component (such as Log Analytics, Azure Event Hub, or Azure Storage), which can be of use when investigating issues and auditing resources. However, none of those solutions covered give you the ability to check network traffic and analyze it. To do so, you need to leverage an optional capability of the Azure networking components called Network Watcher.

In this chapter, we’ll look at how to enable, configure, and work with Network Watcher. The information contained within this chapter will help you be more confident when working with networks in Azure and will simplify the analysis and debugging of network...

Technical requirements

For the exercises from this chapter, you’ll need the following:

• The Azure CLI (https://learn.microsoft.com/en-us/cli/azure/install-azure-cli)
• A command line of any kind (either the one available in your operating system by default or your personal preference)

The Code in Action video for this book can be viewed at: https://packt.link/GTX9F

Getting started – an overview of Network Watcher

As mentioned at the beginning of this chapter, Network Watcher is an additional component that you can leverage when working with networking in Azure. Because networking is an area that is difficult to manage and debug in the cloud (due to the lack of access to the hardware and the use of virtualized network devices), sometimes you may struggle to find the root cause of an issue or track packets being transported over your resources. This is where Network Watcher comes in handy – it covers areas including diagnostics, metrics, and monitoring to help you troubleshoot issues with connectivity, VPNs, and network security groups, and can even capture network packets. Let’s see what tools are available when working with Network Watcher.

Network Watcher toolset

As already pointed out, Network Watcher offers a variety of different tools that you can use to work with your network. For our examination, we will divide...

Verifying flows

Network Watcher can be used to verify traffic flows inside your network using a feature called IP flow verify. It’s meant to be used with Azure Virtual Machines, and its main purpose is to validate the network rules applicable to a given machine. Conceptually, it’s a simple feature – all you need is to configure the correct machine, IP, and ports you’d like to verify. In the Azure portal, it looks like this:

Figure 15.1 – IP flow verify screen in the Azure portal

If the connection is allowed, you’ll be notified about it as follows:

Figure 15.2 – Result of running IP flow verify when a connection is accepted

However, if a connection cannot be established (for instance, because of existing rules in the network security group assigned to the network interface of a machine), you’ll get information on what is blocking it (see Figure 15.3):

...

Diagnosing next hops

When running diagnostics on network traffic, sometimes you need to understand what stands between a virtual machine and the traffic destination. To analyze that, Network Watcher offers a feature called Next hop. To use it, you need to go to the Next hop blade in the Azure portal and configure the machine you’d like to check. In the Azure portal, it looks like this:

Figure 15.4 – Result of checking the next hop to a publicly available IP address

The hop type presented by the feature depends on your machine’s network configuration and the IP address selected as the destination. As of now, the following next hop types are supported:

• Internet
• VirtualNetwork
• VirtualNetworkPeering
• VirtualNetworkServiceEndpoint
• MicrosoftEdge
• VirtualAppliance
• VirtualNetworkGateway
• None

All of these types come from the route table selected by your machine. The default system routes are VirtualNetwork...

Visualizing the network topology

When working with a network in Azure, you may want to better understand its structure (or just validate it) by checking the components visually. A visualization feature is available in the Topology blade when you access your instance of Network Watcher. In the Azure portal, it looks like this:

Figure 15.5 – High-level visualization of an Azure VM with its network interface

Visualizing a network topology allows you to understand how different components are connected to each other. Network Watcher enables you to visualize different levels of detail by diving deeper into a given component (see Figure 15.6):

Figure 15.6 – Topology of a network interface integrated with a virtual machine, network security group, and public IP address

This feature is helpful to quickly validate the state of your network and what exactly is deployed on it. It can also be helpful in some debugging scenarios...

Summary

Chapter 15 was a short introduction to Network Watcher, which is a useful service for everyone working with networks in Azure. We explained the features it offers and looked at its most interesting capabilities (namely, verifying flows, checking next hops, and visualizing the topology of your networks). I strongly recommend playing around with the service a bit to properly understand everything it offers.

The topics covered in this chapter will help you when you’re tasked with debugging or validating network connections in Azure. Not everything can be checked using Network Watcher (it’s still a managed service), but it does come in handy when checking resources such as network security groups or troubleshooting VPN connections.

This was the last chapter of this book. Throughout all of the chapters, we covered lots of different topics, starting with an introduction to Azure, its structure, and its main APIs. We learned how to provision resources using the...