← Back to catalog
📚 Series

Azure - Implement and Manage Virtual Networking

How Azure connects, isolates and exposes resources, and how an administrator keeps that traffic both private and reachable. Work through the series to gain the judgement to lay out an address space, control what is allowed to talk to what, and diagnose a connection that will not go through.

Episodes (6)

  1. 1 Episode 1 — Virtual Networks, Subnets & the Azure Address Space The foundation of Azure networking: what a virtual network is, its region/subscription isolation boundary, designing a non-overlapping CIDR address space, subnetting, Azure's 5 reserved addresses per subnet, and dynamic vs static private IP allocation.
  2. 2 Episode 2 — Public IP Addresses & Outbound Connectivity (NAT Gateway) Public IP address resources, the Standard vs Basic SKU (and Basic's retirement), static vs dynamic allocation, the retirement of default outbound access, and scalable outbound SNAT with Azure NAT Gateway — including the outbound precedence order and SNAT port exhaustion.
  3. 3 Episode 3 — Connecting Virtual Networks: Peering How VNet peering connects networks privately over the Microsoft backbone: regional vs global peering, the bidirectional and non-transitive nature of peering, hub-and-spoke design, service chaining, gateway transit and remote gateways, and peering troubleshooting.
  4. 4 Episode 4 — Routing: System Routes & User-Defined Routes Azure's routing engine: the system (default) routes created for every subnet and their next hop types, route selection by longest-prefix match then UDR > BGP > system, configuring route tables and user-defined routes, forced tunneling through an NVA, disabling BGP propagation, and diagnosing routes.
  5. 5 Episode 5 — Network Security: NSGs & Application Security Groups How network security groups filter L3/L4 traffic via the 5-tuple and why they are stateful: rule anatomy and priority, default security rules, service tags, application security groups, the subnet-vs-NIC evaluation order, computing effective rules, and troubleshooting blocked traffic.
  6. 6 Episode 6 — Secure Access to VMs & PaaS: Bastion, Service Endpoints & Private Link Securing access rather than filtering packets: Azure Bastion for browser RDP/SSH over TLS with no public IP (and the AzureBastionSubnet requirement), service endpoints that extend VNet identity to public PaaS, and private endpoints (Private Link) that place a private IP in your VNet — plus how to choose between them.