Understanding Networking in Azure

An organization is in the process of migrating infrastructure and applications to Azure. As part of the networking team, you are assigned to be part of this project. You need to allow employees to securely access resources such as databases, files, and applications on-premises and in Azure.

This chapter will review how to design and implement the core Azure networking infrastructure, including hybrid networking connections, load balancing components, routing, and network security.

Starting with the basics, we will understand the core Azure networking services such as virtual networks, DNS, and virtual network peering. We will also discuss various topics so that you can learn how to design and implement hybrid network connections such as Site-to-Site, Point-to-Site, and ExpressRoute.

Then, we will move on to how you can implement routing and load balancing components and secure your networks.

If we want to have a holistic view of all Azure...

Connectivity in Azure

The fundamental building block of your network in Azure is Azure Virtual Networks or VNets, as we will refer to from now on. VNets allow organizations to build networks as if they were on-premises. Think of VNets as the primary component for availability and isolation purposes.

On top of VNets, you can configure and manage Virtual Private Networks or VPNs and connect with other VNets across the various regions available in Azure and extend your on-premises network. Similar to an on-premises network, each VNet has its own Classless Inter-Domain Routing or CIDR block, and they can be connected with other VNets as long as their CIDR blocks don’t overlap.

Similar to on-premises networks, TCP, UDP, and ICMP TCP/IP protocols are supported within VNets.

Now we will discuss how you can start designing your virtual networks in Azure.

Design considerations for VNets

Before creating a VNet, consider using address ranges enumerated in RFC 1918 to facilitate...

Hybrid networking

Imagine SpringToys is evaluating the adoption of a global transit network architecture. This network will be utilized to connect the headquarters and multiple branch offices. Given the trend to enable remote work, SpringToys will address work-from-home scenarios. The organization needs users to access various resources, such as databases, files, and applications, in Azure and on-premises.

This section will review how you can leverage site-to-site VPN connections, point-to-site VPN connections, and how to configure Azure Virtual WAN.

When organizations connect on-premises resources to Azure, it is referred to as a hybrid network, and one way to enable this scenario is by using VPN connections. A virtual private network or VPN uses an encrypted tunnel within another network to establish connectivity.

VPNs are usually deployed to connect at least two trusted private networks, to one another and over an untrusted network such as the internet. Traffic is encrypted...

Load balancing

Load balancing refers to distributing incoming requests across servers or resources to optimize resource use, maximize throughput, minimize response time, and avoid overloading any one resource.

In this section, we will analyze the following services in two categories:

• Load balance non-HTTP(S) traffic: We will discuss Azure Load Balancer (ALB) and Azure Traffic Manager (ATM)
• Load balance HTTP(S) traffic: We will review Azure Application Gateway and Azure Front Door.

The following diagram shows a high-level overview of the load balancing solutions available on Azure:

Figure 8.24 – Overview of the load balancing solutions available on Azure

At a very high level, we have the following solutions available on Azure:

• Azure Load Balancer: This is a layer 4 (TCP, UDP) load balancer that distributes incoming traffic among healthy instances of services in virtual machine scale sets or individual virtual machines...

Network security

Imagine SpringToys is spread across multiple Azure regions, and their infrastructure includes multiple virtual networks and connections to an on-premises network. The SpringToys IT team is looking for options to protect its assets against malicious actors trying to infiltrate the network and web applications.

In this section, we will discuss the core services available in Azure that help secure network connections and communications. We will highlight the following:

• Azure DDoS Protection
• Azure Firewall
• Azure WAF

Let’s start by reviewing how SpringToys can leverage Azure DDoS Protection to improve its security posture.

Azure DDoS protection

First, let’s set the stage and agree on terminology. DDoS stands for Distributed Denial of Service – a type of cyber-attack in which many devices, often infected with malware, are used to flood a targeted website or server with a huge amount of fake traffic.

The goal of a DDoS...

Summary

As your organization transitions to Azure, it’s important to design a secure network that prevents unauthorized access or attacks by implementing controls on network traffic and only allowing legitimate requests.

In this chapter, we discussed various network security options that can be implemented to meet the specific security needs of your organization. In the next chapter, we will analyze how SpringToys can manage and control its Azure environment, ensuring that resources are used efficiently and securely and that compliance requirements are met.