1. VNet and NSG #
The private network and its filtering.
Basics #
A VNet is a private network in a region, split into subnets. NSGs filter traffic with prioritized rules (allow or deny, stateful) and are attached to a subnet or a network interface. Application security groups let you write rules per role (web, database) rather than per address.
az network vnet create -g rg-reseau -n vnet-app --address-prefixes 10.1.0.0/16 --subnet-name web --subnet-prefixes 10.1.1.0/24
az network nsg create -g rg-reseau -n nsg-web
az network nsg rule create -g rg-reseau --nsg-name nsg-web -n https --priority 100 --access Allow --protocol Tcp --destination-port-ranges 443
az network vnet subnet update -g rg-reseau --vnet-name vnet-app -n web --network-security-group nsg-web2. Connecting and protecting #
Peering, hub and spoke, Private Endpoint.
Architecture #
| Need | Service |
|---|---|
| Connecting two VNets | Peering (low latency, non-transitive) |
| Private access to a PaaS service | Private Endpoint (private address in the VNet) |
| Centralized filtering | Azure Firewall |
| Administrator access without a public IP | Azure Bastion |
| Connecting the company site | VPN Gateway (encrypted Internet) or ExpressRoute (private link) |
3. Exposing an application #
Load balancing and delivery.
Choosing #
| Service | Level | Usage |
|---|---|---|
| Load Balancer | Layer 4 (TCP/UDP), regional | Balancing VMs |
| Application Gateway | Layer 7, regional, WAF | Web applications, path-based routing |
| Front Door | Layer 7, global, WAF, CDN | Global applications, failover between regions |
| Traffic Manager | DNS, global | Routing by priority, performance or geography |
Advice #
Good practice: Combine Front Door (global) with Application Gateway or regional PaaS services behind Private Link so that nothing is exposed directly on the Internet.
