Compute resources alone are of little use if they know nothing about each other and nobody can reach them. Networks connect Azure resources with each other, with the internet and with your own site. This lesson explains the building blocks Azure offers for that and when to choose which: virtual networks and subnets, peering, Azure DNS, VPN Gateway, ExpressRoute and the two kinds of endpoints.
Virtual networks and subnets
An Azure Virtual Network (VNet) is your own isolated network in Azure. Microsoft describes it as an extension of your company network. When you create one, you define a private IP address space. This range exists only inside the virtual network and is not routable on the internet.
You divide the address space into subnets by assigning a part to each named subnet. That way you separate web servers from database servers, for example. According to Microsoft, virtual networks provide, among other things:
- Isolation and segmentation: several networks separated from each other.
- Internet connections: You allow incoming connections from the internet by giving a resource a public IP address or by placing it behind a public load balancer.
- Connection between Azure resources: The virtual network connects VMs and other services. Service endpoints connect resources such as Azure SQL databases or storage accounts to the network.
- Connection to your own site: through the options described below.
- Routing and filtering: By default Azure routes traffic between subnets, connected networks and the internet. With route tables you can change that. With network security groups (NSG) you allow or block traffic based on source, destination, port and protocol.
Peering
With peering you connect two virtual networks directly with each other. The traffic between them stays private and runs over Microsoft's backbone network, without touching the public internet. The networks may be in different regions. This creates a globally connected network in Azure.
Connection to your own site
If your company has a network of its own, there are two ways to Azure.
VPN Gateway
A virtual private network (VPN) is an encrypted tunnel through another network, usually through the public internet. The traffic stays encrypted on the way. An Azure VPN Gateway runs in a subnet of its own in the virtual network and enables three kinds of connections:
- Site-to-site: Your on-premises VPN device or gateway is connected to the Azure VPN Gateway. Devices in Azure appear as if they were on the local network.
- Point-to-site: A single device from outside builds an encrypted connection into the virtual network, for example a laptop in a home office.
- Network-to-network: One virtual network is connected to another.
You can run one VPN Gateway per virtual network, but it can connect several sites. By default it runs as two instances in active/standby mode, so that the second takes over if there is a failure.
ExpressRoute
Azure ExpressRoute extends your on-premises network into the Microsoft cloud over a private connection. It is created with the help of a network provider and is called an ExpressRoute circuit. The connection does not run over the public internet. That is why, according to Microsoft, it offers more reliability, higher speed, consistent latencies and more security than a normal internet connection. It reaches Azure services and also Microsoft 365. Built-in redundancy increases availability. Even with ExpressRoute, however, DNS queries, the checking of certificate revocation lists and requests to the Azure Content Delivery Network still run over the public internet.
You choose ExpressRoute when you need private, consistent connections, have strict requirements for data transfer or don't want to send critical traffic over the internet.
Azure DNS
Azure DNS is a hosting service for DNS domains. DNS translates names such as example.com into IP addresses. With Azure DNS you manage your records with the same credentials, tools and billing as your other Azure services, in the portal, with PowerShell, the Azure CLI or through the REST API. The domains live on Azure's worldwide network of name servers and, thanks to anycast, are answered by the nearest available server. Azure DNS also offers:
- Private DNS zones: your own domain names inside your virtual networks instead of the names Azure assigns.
- Alias records: They point to an Azure resource, such as a public IP address. If its address changes, the record adjusts itself.
With Azure DNS you don't buy a domain name. For that you need a registrar or App Service Domains. Afterward you can manage the domain in Azure DNS.
Public and private endpoints
An endpoint is the point at which a service can be reached.
- A public endpoint has a public IP address and can be reached from anywhere in the world.
- A private endpoint lies inside a virtual network and has a private IP address from its address space. It can be reached only in the network.
A database that only your web servers need therefore belongs behind a private endpoint.
The ways compared
| Connection | Runs over | Connects | Typical use |
|---|---|---|---|
| Peering | Microsoft backbone, private | two virtual networks | coupling networks in Azure, also across regions |
| VPN Gateway | encrypted over the internet | site, single device or network with Azure | encrypted connection over the internet |
| ExpressRoute | private line through a provider, not the internet | your network with Azure and Microsoft 365 | consistent, private connection |
An example
The made-up company "Nordlicht Verlag" runs an editorial system in Azure. The system lives in a virtual network with two subnets, one for the web servers, one for the database. The database has only a private endpoint. The editorial office reaches the network through a VPN Gateway. Editors in their home offices use a point-to-site connection. The network of a service provider that runs the image archives is connected through peering. The publisher manages its domain in Azure DNS.
Exercise 1
The made-up company "Baumann Logistik" plans two things:
- Two warehouse sites need a permanent, encrypted connection to Azure. A private line of their own is not required.
- The headquarters wants to transfer very large amounts of data to Azure every day over a line that doesn't run through the public internet and is consistently fast.
Choose a connection for each and justify the choice. What applies to the DNS queries if you choose the second option?
Solution 1
- VPN Gateway with a site-to-site connection. Each site connects its VPN device to the Azure VPN Gateway. The traffic is encrypted and runs over the internet. A line of their own isn't needed here, so the VPN fits.
- ExpressRoute. The connection is created with a network provider and doesn't run over the public internet. Microsoft names higher reliability, consistent latencies and more security for it.
On the question: Even with ExpressRoute, DNS queries, the checking of certificate revocation lists and requests to the Azure Content Delivery Network still run over the public internet. So an ExpressRoute circuit doesn't replace everything. Whoever wants to keep everything strictly private has to look at these points separately.