Azure Zero to Hero: Day 6 - Azure Networking Basic to Advanced

Welcome to Day 6 of the Azure Zero to Hero series. In this comprehensive module, we dive deep into Azure Networking, moving from absolute fundamentals (IP addressing, CIDR, subnets) to advanced cloud architectures (Virtual Networks, Route Tables, Network Security Groups, Application Security Groups, Load Balancers, Application Gateways, and Azure Firewalls).

1. Overview and the Real-World Analogy of Cloud Networking

Before looking at cloud configurations, we must understand why networking constructs exist in a hyperscale cloud environment like Microsoft Azure.

Real-Life Analogy: The Corporate Office Building

Imagine Azure as a massive, multi-tenant skyscraper (the cloud provider's data center).

• Virtual Network (VNet): This is your company's private, rented floor inside the skyscraper. No other company on any other floor can see or access your office space unless you explicitly build a bridge or open a door.
• Subnets: Inside your office floor, you partition departments: HR, Engineering, Finance, and Public Reception. These departments are isolated from one another via internal walls and doors.
• Network Security Groups (NSGs): These are the security guards standing at the doors of each department, checking ID badges and allowing or denying entry based on strict rulebooks (e.g., "Allow Engineering to talk to Database, but block Reception from talking to Finance").
• Load Balancers / Application Gateways: This is the front desk receptionist at the main lobby who greets visitors and routes incoming customer inquiries to the correct available employee.

2. Networking Fundamentals: IP Addresses, Subnets, and CIDR

To build networks in Azure, you must understand how IP addressing and subnetting work. Every resource deployed into a Virtual Network receives a private IP address assigned from the address space you define.

Understanding CIDR Notation

Classless Inter-Domain Routing (CIDR) is a method for allocating IP addresses and for IP routing. A CIDR block consists of two parts:

1. Base IP Address: e.g., 10.0.0.0
2. Network Prefix (Subnet Mask): e.g., /16 or /24

The prefix number indicates how many bits are fixed for the network portion. For example:

• /16: Leaves 32 - 16 = 16 bits for host addresses. This yields $2^{16} = 65,536$ total IP addresses.
• /24: Leaves 32 - 24 = 8 bits for host addresses. This yields $2^{8} = 256$ total IP addresses.

Note: Azure reserves the first 4 IP addresses and the last 1 IP address in every subnet for protocol and infrastructure management (e.g., network address, broadcast address, Azure DNS, and gateway). Therefore, a /24 subnet provides $256 - 5 = 251$ usable IP addresses.

3. Azure Virtual Network (VNet) Architecture

An Azure Virtual Network (VNet) is the fundamental building block for your private network in Azure. It enables many types of Azure resources—such as Virtual Machines (VMs)—to securely communicate with each other, the internet, and on-premises networks.

Key VNet Design Principles

• Isolation: VNets are logically isolated from one another in the Azure cloud.
• Private Connectivity: Resources in a VNet can communicate securely using private IP addresses.
• Extensibility: You can connect VNets to other VNets (VNet Peering) or to your corporate datacenter (VPN Gateway / ExpressRoute).
• Address Spaces: When creating a VNet, you must specify a custom private IP address space using RFC 1918 ranges (e.g., 10.0.0.0/16, 172.16.0.0/12, or 192.168.0.0/16).

4. Routes and Route Tables

By default, Azure automatically creates system routes for every subnet within a VNet, enabling resources within subnets to communicate with each other and route outbound traffic to the internet. However, enterprise architectures often require custom traffic routing.

User-Defined Routes (UDR)

User-Defined Routes allow you to override Azure's default system routing or add extra routes to control exactly where network traffic flows.

• Common Use Case: Forcing all outbound internet traffic (0.0.0.0/0) to flow through a centralized network virtual appliance (NVA) or Azure Firewall for inspection, logging, and filtering before hitting the public internet.

5. Network Security Groups (NSGs)

A Network Security Group (NSG) contains security rules that allow or deny inbound network traffic to, or outbound network traffic from, several types of Azure resources.

How NSG Rules Are Evaluated

NSG rules are processed based on priority numbers (ranging from 100 to 4096). Lower numbers are evaluated first. Once traffic matches a rule, evaluation stops (first-match wins).

Default NSG Rules

Azure injects default rules into every NSG:

• Inbound: Allows traffic from other VNets and load balancers, but denies all external internet traffic inbound by default.
• Outbound: Allows all outbound traffic to the internet and other subnets by default.

6. Application Security Groups (ASGs)

Managing NSG rules at scale using IP addresses can become an administrative burden, especially when VMs are dynamically created and destroyed. Application Security Groups (ASGs) solve this problem.

ASG vs. NSG

• NSG: The firewall rule container.
• ASG: A logical grouping of virtual machines based on application workload (e.g., web-servers, db-servers).

Instead of writing rules for specific IP addresses:

1. You create an ASG named ASG-Web.
2. You attach your web server VMs to ASG-Web.
3. You write a single NSG rule: Allow traffic from Any to ASG-Web on port 443.

7. Azure Load Balancer vs. Application Gateway

In cloud architecture, distributing incoming traffic across multiple backend servers is critical for high availability and fault tolerance. Azure provides different load-balancing solutions depending on the OSI layer.

Comparison of Traffic Distributors

8. Azure DNS

Azure DNS is a hosting service for DNS domains that provides name resolution using Microsoft Azure infrastructure.

Private vs. Public DNS Zones

• Public DNS Zones: Manages DNS records for your public-facing domain names (e.g., mycompany.com), resolving queries coming from the public internet.
• Private DNS Zones: Provides name resolution for virtual machines inside a VNet (or across peered VNets) without needing to configure a custom DNS server. VMs can talk to each other using friendly domain names (e.g., dbserver.internal.cloud) rather than raw IP addresses.

9. Azure Firewall

Azure Firewall is a managed, cloud-based network security service that protects your Azure Virtual Network resources. It is a stateful firewall as a service (FWaaS) with high availability and built-in cloud scalability.

Key Capabilities

• Stateful Inspection: Keeps track of active connections and inspects traffic contextually.
• FQDN-Based Outbound Rules: You can allow outbound network traffic to specified domain names (e.g., *.github.com), even as IPs change dynamically.
• Threat Intelligence: Alerts and denies traffic originating from or destined for known malicious IP addresses and domains.
• Centralized Management: Centrally create, enforce, and log application and network connectivity policies across multiple subscriptions and VNets.

10. Summary and Key Takeaways

• Virtual Networks (VNets) serve as your isolated, private enterprise space inside the Azure cloud infrastructure.
• CIDR notation and Subnetting partition your VNet address space logically to separate workloads (e.g., web, app, database tiers).
• Network Security Groups (NSGs) act as stateful, priority-based packet filters controlling inbound and outbound traffic at the subnet or NIC level.
• Application Security Groups (ASGs) simplify security administration by allowing you to group VMs logically by workload rather than IP addresses.
• User-Defined Routes (UDRs) override default routing tables to enforce custom traffic paths through network virtual appliances or firewalls.
• Azure Load Balancer operates at Layer 4 (TCP/UDP) for high-performance transport-layer distribution.
• Azure Application Gateway operates at Layer 7 (HTTP/HTTPS) enabling URL-based routing, SSL termination, and Web Application Firewall (WAF) protection.
• Azure Private DNS removes hardcoded IP dependencies by providing reliable internal domain name resolution across peered VNets.
• Azure Firewall provides fully managed, cloud-native stateful traffic inspection and FQDN filtering for enterprise governance.