Azure Solutions Architecture · AZ-305 · Architecture Case Studies · by Raushan Ranjan, MCT

Tailwind Traders is moving its business to the cloud, and they have a big challenge: their network infrastructure. They need to connect their existing on-premises data centers to a new, global cloud environment in Azure.

Here's a breakdown of their specific needs:

  • A "Hub" for All Traffic: All traffic between on-premises locations and Azure must go through a single, central network to keep things organized and secure. This is also a way to save money by not having to pay for multiple connections.
  • Mission-Critical Application: They have a three-tier business intelligence (BI) application that is vital to the company. It needs to be highly available (99.99%) and have a solid disaster recovery plan with minimal data loss (RPO) and quick recovery time (RTO).
  • On-Premises Connectivity: They have one main connection to Azure using a service called ExpressRoute, but they need a backup plan that doesn't involve paying for a second, expensive ExpressRoute circuit.
  • Security: The different parts of the BI application (the web servers, the business logic, and the database) must be able to communicate, but only on the ports they need. They want a way to do this without having to manage a list of IP addresses.

The company needs a simple, elegant network design that meets all these requirements while being cost-effective and secure.

Part 1: The Best Solution - A Hub-and-Spoke Network

The ideal solution for Tailwind Traders is a hub-and-spoke network topology. Think of this as the main airport (the hub) connecting to several smaller, regional airports (the spokes). All flights (network traffic) from the regional airports must pass through the main airport, where security checks (firewall) are performed. This centralized model provides control, security, and cost savings.

Step 1: The Design - BI Application

Hub VNet (The Main Airport): This central virtual network will contain all shared, core networking services.

  • Azure ExpressRoute Gateway: This gateway is the primary connection to the on-premises datacenter.
  • Azure VPN Gateway: This will be the backup connection. In case the ExpressRoute circuit fails, the VPN Gateway provides a secure tunnel over the public internet. This satisfies the CFO's requirement to avoid a redundant ExpressRoute circuit.
  • Azure Firewall: This is the central traffic cop. All traffic from on-premises and between the different spoke networks must pass through this firewall for inspection and filtering.

Spoke VNet (The Regional Airport): The BI application will reside in its own dedicated virtual network. This VNet will be peered with the Hub VNet.

  • Tier 1 (Web): The web servers will be in a dedicated subnet. We'll place an Azure Application Gateway in front of them to act as a Layer 7 load balancer, distributing incoming web traffic and providing a Web Application Firewall (WAF) to protect against common web attacks.
  • Tier 2 (Logic): The business logic servers will be in another subnet.
  • Tier 3 (Database): The database servers will be in a third subnet.
  • Azure Load Balancer: This is a Layer 4 load balancer that will distribute traffic between the .NET application servers.

Step 2: Security and Access with Network Security Groups (NSGs)

To control traffic between the tiers without using IP addresses, we'll use Application Security Groups (ASGs) within Network Security Groups (NSGs).

The Analogy: Think of ASGs as digital tags you can put on your virtual machines. The web servers get a "Web Tier" tag, the business logic servers get a "Logic Tier" tag, and so on.

The Solution: We'll create NSG rules that say: "Allow traffic from the 'Web Tier' ASG to the 'Logic Tier' ASG on port 80". This approach is independent of IP addresses. If you add or remove VMs from a tier, the NSG rules automatically apply to the new machines, providing a scalable and manageable security solution.

Part 2: Why This is the Best Solution

Option A (The Best Way): The Hub-and-Spoke with Centralized Services

  • Cost: By centralizing the ExpressRoute and Firewall in a single hub, Tailwind Traders avoids paying for these resources in every single spoke VNet.
  • Security: All traffic is forced through a single firewall, making it easy to enforce security policies and log all traffic from one central point.
  • Scalability: When new applications are migrated, you simply create a new spoke VNet and peer it with the hub. The core networking is already in place.

Option B (The Less Efficient Way): A Flat Network Design

The Idea: All resources are placed in a single large VNet or in multiple un-peered VNets that each have their own ExpressRoute and firewall.

The Problem: This would violate the CFO's cost-saving requirement, as they would have to pay for a redundant ExpressRoute and a dedicated firewall for every new application. It would also be a security and management nightmare, as the IT team would have to manage dozens of individual firewalls and network connections.

Conclusion: The hub-and-spoke design is the only solution that meets all of Tailwind Traders' requirements for cost, security, and scalability.

Part 3: Updating the Network Design for Modernization

Impact of Modernizing to PaaS Services

  • Compute (from VM to App Service): If the three-tier application is modernized to use Azure App Service, the network design changes significantly. You no longer need to manage NSGs for the web and logic tiers, as App Service provides its own security and scaling. However, you'll need to use VNet Integration to connect the App Service to the spoke VNet and use a private endpoint to connect to the backend database.
  • Impact on Network Design: This eliminates the need for NSGs between the tiers, as a private connection is inherently more secure. It also removes the need for Azure Load Balancers, as App Service has a built-in load balancer.

Updating the Design for Relational Storage

  • Problem: The relational database (SQL) needs to be secured so that only select resources (the application) can access it.
  • Solution: We will use Azure Private Link. A private endpoint is a private IP address within your spoke VNet that connects to a PaaS service like Azure SQL Database.
  • How it works: This ensures that all traffic to the database stays on the private Azure backbone network and never goes over the public internet, eliminating a major security vulnerability.
  • Access Control: To ensure only specific applications have access, we'll use a Service Principal with RBAC. The application (e.g., the App Service) will be granted permissions to the database, and access will be denied to all others. This provides granular control and security.

Pragmatic Access to the Database (No Hard-Coded Secrets)

  • The Problem: Hard-coding database passwords in the front-end code is a major security risk.
  • The Solution: We will use Managed Identities. A managed identity provides an Entra ID identity for the Azure App Service. The App Service can use this identity to automatically and securely get an access token to the Azure SQL Database. The front-end code no longer needs a username or password, as Azure handles the authentication process securely behind the scenes.

Well-Architected Framework Pillars

  • Security: The hub-and-spoke model with a centralized Azure Firewall and NSGs provides a strong security posture. The use of private endpoints, VNet Integration, and Managed Identities ensures that data is always encrypted in transit and that credentials are never hard-coded or exposed.
  • Cost Optimization: Centralizing core services like ExpressRoute and Azure Firewall in the hub VNet avoids redundant spending. The use of a VPN Gateway as a failover is also a low-cost alternative to a second ExpressRoute circuit.
  • Reliability: The use of both ExpressRoute and VPN Gateway provides a highly resilient hybrid connection. The Application Gateway and Load Balancers ensure high availability for the application, and the use of private endpoints enhances reliability by keeping traffic on the secure Azure backbone.
  • Operational Excellence: The hub-and-spoke model simplifies management, and the use of ASGs and Managed Identities automates security and access control, reducing manual effort. The use of Azure Firewall Manager can also centralize firewall policy management.
📚 Continue Learning on RR Skillverse