|
| 1 | +Azure virtual networks and virtual subnets enable Azure resources, such as VMs, web apps, and databases, to communicate with each other, with users on the internet, and with your on-premises client computers. You can think of an Azure network as an extension of your on-premises network with resources that link other Azure resources. |
| 2 | + |
| 3 | +Azure virtual networks provide the following key networking capabilities: |
| 4 | + |
| 5 | + - Isolation and segmentation |
| 6 | + - Internet communications |
| 7 | + - Communicate between Azure resources |
| 8 | + - Communicate with on-premises resources |
| 9 | + - Route network traffic |
| 10 | + - Filter network traffic |
| 11 | + - Connect virtual networks |
| 12 | + |
| 13 | +Azure virtual networking supports both public and private endpoints to enable communication between external or internal resources with other internal resources. |
| 14 | + |
| 15 | + - Public endpoints have a public IP address and can be accessed from anywhere in the world. |
| 16 | + - Private endpoints exist within a virtual network and have a private IP address from within the address space of that virtual network. |
| 17 | + |
| 18 | +## Isolation and segmentation |
| 19 | + |
| 20 | +Azure Virtual Network lets you create multiple isolated virtual networks. When you set up a virtual network, you define a private IP address space by using either public or private IP address ranges. The IP range only exists within the virtual network and isn't internet routable. You can divide that IP address space into subnets and allocate part of the defined address space to each named subnet. |
| 21 | + |
| 22 | +For name resolution, you can use the name resolution service built into Azure. You also can configure the virtual network to use either an internal or an external DNS server. |
| 23 | + |
| 24 | +## Internet communications |
| 25 | + |
| 26 | +You can enable incoming connections from the internet by assigning a public IP address to an Azure resource, or putting the resource behind a public load balancer. |
| 27 | + |
| 28 | +## Communicate between Azure resources |
| 29 | + |
| 30 | +Azure resources can communicate securely with each other in one of two ways: |
| 31 | + |
| 32 | + - Virtual networks can connect not only VMs but other Azure resources, such as the App Service Environment for Power Apps, Azure Kubernetes Service, and Azure virtual machine scale sets. |
| 33 | + - Service endpoints can connect to other Azure resource types, such as Azure SQL databases and storage accounts. This approach lets you link multiple Azure resources to virtual networks to improve security and provide optimal routing between resources. |
| 34 | + |
| 35 | +## Communicate with on-premises resources |
| 36 | + |
| 37 | +Azure virtual networks let you link resources together in your on-premises environment and within your Azure subscription. In effect, you can create a network that spans both your local and cloud environments. There are three ways to achieve this connectivity: |
| 38 | + |
| 39 | + - Point-to-site virtual private network connections are from a computer outside your environment back into your private network. In this case, the client computer initiates an encrypted VPN connection to connect to the Azure virtual network. |
| 40 | + - Site-to-site virtual private networks link your on-premises VPN device or gateway to the Azure VPN gateway in a virtual network. In effect, the devices in Azure can appear as being on the local network. The connection is encrypted and works over the internet. |
| 41 | + - Azure ExpressRoute provides a dedicated private connectivity to Azure that doesn't travel over the internet. ExpressRoute is useful for environments where you need greater bandwidth and even higher levels of security. |
| 42 | + |
| 43 | +## Route network traffic |
| 44 | + |
| 45 | +By default, Azure routes traffic between subnets on any connected virtual networks, on-premises networks, and the internet. You also can control routing and override those settings, as follows: |
| 46 | + |
| 47 | + - Route tables let you define rules about how traffic should be directed. You can create custom route tables that control how packets are routed between subnets. |
| 48 | + - Border Gateway Protocol (BGP) works with Azure VPN gateways, Azure Route Server, or Azure ExpressRoute to propagate on-premises BGP routes to Azure virtual networks. |
| 49 | + - User-defined routes (UDR) let you control the routing tables between subnets within a virtual network or between virtual networks, giving you greater control over network traffic flow. |
| 50 | + |
| 51 | +## Filter network traffic |
| 52 | + |
| 53 | +Azure virtual networks let you filter traffic between subnets by using the following approaches: |
| 54 | + |
| 55 | + - Network security groups are Azure resources that can contain multiple inbound and outbound security rules. You can define these rules to allow or block traffic, based on factors such as source and destination IP address, port, and protocol. |
| 56 | + - Network virtual appliances are specialized VMs that can be compared to a hardened network appliance. A network virtual appliance carries out a particular network function, such as running a firewall or performing wide area network (WAN) optimization. |
| 57 | + |
| 58 | +:::image type="content" source="../media/virtual-network-filter-stack.png" alt-text="Diagram showing an inbound packet flowing through NSG security rules and then through a network virtual appliance before reaching the target VM."::: |
| 59 | + |
| 60 | +## Connect virtual networks |
| 61 | + |
| 62 | +You can link virtual networks together by using virtual network peering. Peering allows two virtual networks to connect directly to each other. Network traffic between peered networks is private, and travels on the Microsoft backbone network, never entering the public internet. Peering enables resources in each virtual network to communicate with each other. These virtual networks can be in separate regions, which lets you create a global interconnected network through Azure. |
| 63 | + |
| 64 | +:::image type="content" source="../media/virtual-network-peering-backbone.png" alt-text="Diagram of two peered Azure virtual networks in separate regions connected over the Microsoft private backbone network."::: |
| 65 | + |
0 commit comments