Azure Networking Deep Dive

Is the traffic HTTP/HTTPS?
  YES -> Do you need global distribution?
    YES -> Azure Front Door (Premium for WAF + Private Link)
    NO  -> Application Gateway v2 (with WAF if needed)
  NO  -> Do you need global distribution?
    YES -> Traffic Manager (DNS-based, works with any protocol)
    NO  -> Azure Load Balancer
           Standard SKU: cross-zone, HA ports
           Internal: for private backend services
           Public: for internet-facing non-HTTP

Common combinations:
  Web app:        Front Door -> App Gateway -> App Service
  API + backend:  Front Door -> Load Balancer (internal) -> AKS
  Multi-region:   Front Door -> App Service (per region)
  Non-HTTP:       Traffic Manager -> Load Balancer (per region)

resource frontDoorProfile 'Microsoft.Cdn/profiles@2023-05-01' = {
  name: 'myapp-fd'
  location: 'global'
  sku: {
    name: 'Premium_AzureFrontDoor'
  }
}

resource endpoint 'Microsoft.Cdn/profiles/afdEndpoints@2023-05-01' = {
  parent: frontDoorProfile
  name: 'myapp-endpoint'
  location: 'global'
  properties: {
    enabledState: 'Enabled'
  }
}

resource originGroup 'Microsoft.Cdn/profiles/originGroups@2023-05-01' = {
  parent: frontDoorProfile
  name: 'backend-origins'
  properties: {
    loadBalancingSettings: {
      sampleSize: 4
      successfulSamplesRequired: 3
      additionalLatencyInMilliseconds: 50
    }
    healthProbeSettings: {
      probePath: '/health'
      probeRequestType: 'HEAD'
      probeProtocol: 'Https'
      probeIntervalInSeconds: 30
    }
  }
}

resource originEastUS 'Microsoft.Cdn/profiles/originGroups/origins@2023-05-01' = {
  parent: originGroup
  name: 'eastus-origin'
  properties: {
    hostName: 'myapp-eastus.azurewebsites.net'
    httpPort: 80
    httpsPort: 443
    priority: 1
    weight: 1000
    enforceCertificateNameCheck: true
    originHostHeader: 'myapp-eastus.azurewebsites.net'
  }
}

resource originWestEurope 'Microsoft.Cdn/profiles/originGroups/origins@2023-05-01' = {
  parent: originGroup
  name: 'westeurope-origin'
  properties: {
    hostName: 'myapp-westeurope.azurewebsites.net'
    httpPort: 80
    httpsPort: 443
    priority: 1
    weight: 1000
    enforceCertificateNameCheck: true
    originHostHeader: 'myapp-westeurope.azurewebsites.net'
  }
}

resource wafPolicy 'Microsoft.Network/FrontDoorWebApplicationFirewallPolicies@2022-05-01' = {
  name: 'myappwaf'
  location: 'global'
  sku: {
    name: 'Premium_AzureFrontDoor'
  }
  properties: {
    policySettings: {
      mode: 'Prevention'
      requestBodyCheck: 'Enabled'
    }
    managedRules: {
      managedRuleSets: [
        {
          ruleSetType: 'Microsoft_DefaultRuleSet'
          ruleSetVersion: '2.1'
          ruleSetAction: 'Block'
        }
        {
          ruleSetType: 'Microsoft_BotManagerRuleSet'
          ruleSetVersion: '1.0'
        }
      ]
    }
  }
}

# Create a WAF policy
az network application-gateway waf-policy create \
  --name myapp-waf \
  --resource-group myRG \
  --location eastus2

# Enable managed rule set
az network application-gateway waf-policy managed-rule rule-set add \
  --policy-name myapp-waf \
  --resource-group myRG \
  --type OWASP \
  --version 3.2

# Create Application Gateway v2 with WAF
az network application-gateway create \
  --name myapp-agw \
  --resource-group myRG \
  --location eastus2 \
  --sku WAF_v2 \
  --capacity 2 \
  --vnet-name prod-spoke-vnet \
  --subnet AppGatewaySubnet \
  --http-settings-protocol Https \
  --http-settings-port 443 \
  --frontend-port 443 \
  --waf-policy /subscriptions/<sub-id>/resourceGroups/myRG/providers/Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/myapp-waf

# Enable autoscaling (0-10 instances)
az network application-gateway update \
  --name myapp-agw \
  --resource-group myRG \
  --set sku.name=WAF_v2 sku.capacity=null \
  --set autoscaleConfiguration.minCapacity=0 autoscaleConfiguration.maxCapacity=10

Pattern 1: Standard Resiliency (single circuit, two connections)
  On-Premises -> Provider -> Primary Connection -> Azure (Zone 1)
  On-Premises -> Provider -> Secondary Connection -> Azure (Zone 2)
  SLA: 99.95%
  Risk: Single provider failure takes down both connections

Pattern 2: Maximum Resiliency (two circuits, different providers)
  On-Premises -> Provider A -> Circuit 1 -> Azure Region 1
  On-Premises -> Provider B -> Circuit 2 -> Azure Region 1
  SLA: 99.99%+
  Cost: 2x circuit cost, but eliminates single provider risk

Pattern 3: ExpressRoute + VPN Failover
  Primary:   On-Premises -> ExpressRoute -> Azure
  Backup:    On-Premises -> Site-to-Site VPN -> Azure
  BGP weight: ExpressRoute preferred, VPN as automatic failover
  Cost: ExpressRoute + VPN gateway cost

Pattern 4: ExpressRoute Global Reach (multi-region)
  Datacenter A -> ExpressRoute Circuit A -> Azure Region 1
  Datacenter B -> ExpressRoute Circuit B -> Azure Region 2
  Global Reach: Circuit A <-> Circuit B (cross-region via Microsoft backbone)
  Enables: On-premises site-to-site via Azure backbone

# Create Firewall Policy
az network firewall policy create \
  --name hub-firewall-policy \
  --resource-group myRG \
  --location eastus2 \
  --sku Premium \
  --threat-intel-mode Alert

# Create a rule collection group
az network firewall policy rule-collection-group create \
  --name DefaultRuleCollectionGroup \
  --policy-name hub-firewall-policy \
  --resource-group myRG \
  --priority 100

# Application rule: Allow outbound HTTPS to specific FQDNs
az network firewall policy rule-collection-group collection add-filter-collection \
  --policy-name hub-firewall-policy \
  --resource-group myRG \
  --rule-collection-group-name DefaultRuleCollectionGroup \
  --name AllowWebTraffic \
  --collection-priority 100 \
  --action Allow \
  --rule-type ApplicationRule \
  --rule-name AllowAzureServices \
  --source-addresses "10.1.0.0/16" \
  --protocols Https=443 \
  --target-fqdns "*.azure.com" "*.microsoft.com" "*.windows.net"

# Network rule: Allow spoke-to-spoke on specific ports
az network firewall policy rule-collection-group collection add-filter-collection \
  --policy-name hub-firewall-policy \
  --resource-group myRG \
  --rule-collection-group-name DefaultRuleCollectionGroup \
  --name AllowSpokeToSpoke \
  --collection-priority 200 \
  --action Allow \
  --rule-type NetworkRule \
  --rule-name AllowProdToStaging \
  --source-addresses "10.1.0.0/16" \
  --destination-addresses "10.2.0.0/16" \
  --destination-ports 443 8080 \
  --ip-protocols TCP

# Create route table to force traffic through firewall
az network route-table create \
  --name spoke-to-firewall-rt \
  --resource-group myRG \
  --location eastus2 \
  --disable-bgp-route-propagation true

# Default route through the firewall
az network route-table route create \
  --name to-internet \
  --route-table-name spoke-to-firewall-rt \
  --resource-group myRG \
  --address-prefix 0.0.0.0/0 \
  --next-hop-type VirtualAppliance \
  --next-hop-ip-address 10.0.1.4

Application in Spoke VNet (10.1.2.5)
  |
  | DNS query: mystorageaccount.blob.core.windows.net
  | -> CNAME: mystorageaccount.privatelink.blob.core.windows.net
  | -> A record: 10.1.4.5 (from Private DNS Zone)
  |
  v
Private Endpoint (10.1.4.5 in private-endpoints subnet)
  |
  | Traffic flows over Microsoft backbone
  | (never crosses the public internet)
  |
  v
Azure Storage Account (mystorageaccount)
  Public access: DISABLED
  Only accessible via Private Endpoint

Required components:
1. Private Endpoint (NIC with private IP in your subnet)
2. Private DNS Zone (privatelink.blob.core.windows.net)
3. VNet Link (connect DNS zone to VNets that need resolution)
4. DNS Zone Group (auto-register PE IP in DNS zone)
5. PaaS service configured with publicNetworkAccess: Disabled

# Create a Private DNS Resolver in the hub VNet
az dns-resolver create \
  --name hub-dns-resolver \
  --resource-group myRG \
  --location eastus2 \
  --id /subscriptions/<sub-id>/resourceGroups/myRG/providers/Microsoft.Network/virtualNetworks/hub-vnet

# Create inbound endpoint (on-premises queries Azure)
az dns-resolver inbound-endpoint create \
  --name inbound-endpoint \
  --dns-resolver-name hub-dns-resolver \
  --resource-group myRG \
  --location eastus2 \
  --ip-configurations '[{"id": "/subscriptions/<sub-id>/resourceGroups/myRG/providers/Microsoft.Network/virtualNetworks/hub-vnet/subnets/DNSResolverInbound", "private-ip-allocation-method": "Dynamic"}]'

# Create outbound endpoint (Azure queries on-premises)
az dns-resolver outbound-endpoint create \
  --name outbound-endpoint \
  --dns-resolver-name hub-dns-resolver \
  --resource-group myRG \
  --location eastus2 \
  --id /subscriptions/<sub-id>/resourceGroups/myRG/providers/Microsoft.Network/virtualNetworks/hub-vnet/subnets/DNSResolverOutbound

# Create forwarding ruleset for on-premises domains
az dns-resolver forwarding-ruleset create \
  --name onprem-forwarding \
  --resource-group myRG \
  --location eastus2 \
  --outbound-endpoints '[{"id": "/subscriptions/<sub-id>/resourceGroups/myRG/providers/Microsoft.Network/dnsResolvers/hub-dns-resolver/outboundEndpoints/outbound-endpoint"}]'

# Forward corp.contoso.com queries to on-premises DNS
az dns-resolver forwarding-rule create \
  --name forward-to-onprem \
  --ruleset-name onprem-forwarding \
  --resource-group myRG \
  --domain-name "corp.contoso.com." \
  --target-dns-servers '[{"ip-address": "192.168.1.10", "port": 53}, {"ip-address": "192.168.1.11", "port": 53}]'

# Test connectivity between a VM and a destination
az network watcher test-connectivity \
  --resource-group myRG \
  --source-resource myVM \
  --dest-address 10.1.3.4 \
  --dest-port 1433

# Check effective routes for a NIC (shows actual routing table)
az network nic show-effective-route-table \
  --resource-group myRG \
  --name myVM-nic \
  --output table

# Check effective NSG rules (combined subnet + NIC NSGs)
az network nic list-effective-nsg \
  --resource-group myRG \
  --name myVM-nic

# Verify IP flow (is this traffic allowed or denied by NSG?)
az network watcher test-ip-flow \
  --vm myVM \
  --resource-group myRG \
  --direction Inbound \
  --protocol TCP \
  --local 10.1.2.5:80 \
  --remote 10.1.1.10:*

# Enable NSG flow logs with Traffic Analytics
az network watcher flow-log create \
  --name myNSGFlowLog \
  --nsg myNSG \
  --resource-group myRG \
  --storage-account mystorageaccount \
  --workspace myLogAnalyticsWorkspace \
  --enabled true \
  --traffic-analytics true \
  --interval 10