Azure Solutions Architecture · AZ-305 · Networking & Business Continuity · by Raushan Ranjan, MCT
1. Network Architecture: Hub-and-Spoke Topology
Analogy: Building a city with a central hub (city center) and separate neighborhoods (spokes).
What: A hub-and-spoke network topology is an architectural model that uses a central Virtual Network (VNet) (the hub) connected to multiple separate VNets (the spokes) via VNet peering.
Why: This design provides centralized control and security. All traffic between spokes or between a spoke and an on-premises network must pass through the hub, where it can be inspected and filtered by a shared Azure Firewall. This simplifies management, reduces costs by sharing services, and enforces consistent security policies.
How: You create a central VNet (the hub) and separate VNets for your different workloads (the spokes). Then, you use VNet peering to connect each spoke VNet to the hub VNet. This creates a secure, low-latency connection.
When: Use this model for most enterprise deployments to ensure a scalable, secure, and manageable network.
2. On-Premises Connectivity: VPN Gateway vs. ExpressRoute
Analogy: A secure tunnel over the public internet (VPN) versus a private, dedicated highway (ExpressRoute).
What:
- Azure VPN Gateway: Creates an encrypted Site-to-Site VPN tunnel over the public internet.
- Azure ExpressRoute: Provides a private, dedicated, and high-bandwidth connection from your on-premises network to Azure, bypassing the internet.
Why:
- VPN Gateway: It's a cost-effective solution suitable for scenarios where you need to connect to Azure but don't require extremely high speeds or guaranteed performance.
- ExpressRoute: It offers higher bandwidth, lower latency, and more reliable performance, making it ideal for mission-critical applications, large data transfers, and hybrid cloud scenarios with high traffic.
How:
- VPN Gateway: You configure a VPN device on your on-premises network and an Azure VPN Gateway in your Azure VNet to establish the connection.
- ExpressRoute: You work with a connectivity provider to establish a physical circuit between your on-premises network and a Microsoft Enterprise Edge router.
When:
- VPN Gateway: Use when you need a simple, low-cost connection.
- ExpressRoute: Use when you need a private, high-speed, and reliable connection. For maximum uptime, you can use both, with the VPN Gateway as a failover for the ExpressRoute connection.
3. Network Security: NSGs vs. Azure Firewall
Analogy: Security guards at a building (NSGs) vs. a central security checkpoint (Azure Firewall).
What:
- Network Security Groups (NSGs): A virtual firewall that controls inbound and outbound traffic for individual virtual machines or subnets.
- Azure Firewall: A fully managed, stateful firewall service that provides centralized network security for entire VNets and subscriptions.
Why:
- NSGs: They provide granular, subnet-level security. You use them to filter traffic for specific resources.
- Azure Firewall: It offers more comprehensive security, logging, and centralized management. It can filter traffic based on application-level rules and provides a higher degree of control, making it perfect for your hub VNet.
How:
- NSGs: You create inbound and outbound rules based on source/destination IP, port, and protocol and then associate the NSG with a resource or subnet.
- Azure Firewall: You deploy it into a dedicated subnet in your hub VNet and configure it to inspect all traffic to and from your spoke VNets.
When:
- NSGs: Use them for basic traffic filtering at the resource or subnet level.
- Azure Firewall: Use it as your primary, centralized security tool in a hub-and-spoke architecture to enforce strong security policies across your entire network.
4. Traffic Management: Load Balancer, Application Gateway, and Front Door
Analogy: A traffic manager for internal servers (Load Balancer), a smart traffic manager for websites (Application Gateway), and a global traffic manager (Front Door).
What:
- Azure Load Balancer: A Layer 4 (TCP/UDP) load balancer that distributes network traffic to healthy virtual machines within a single Azure region.
- Azure Application Gateway: A Layer 7 (HTTP/HTTPS) load balancer that routes web traffic based on URL paths and includes a Web Application Firewall (WAF).
- Azure Front Door: A global application delivery network and load balancer that routes traffic to the closest backend to improve performance for users worldwide.
Why:
- Load Balancer: Ensures high availability for your applications by distributing traffic and checking the health of your backend servers.
- Application Gateway: Provides more intelligent routing for web applications and protects them from common web attacks.
- Front Door: Optimizes performance for a global audience by using the closest "edge" location, and it provides global high availability across multiple Azure regions.
How:
- Load Balancer: You create a front-end IP address and a backend pool of virtual machines, then set up rules to direct traffic.
- Application Gateway: You configure listeners, backend pools, and routing rules based on the type of web traffic you're handling.
- Front Door: You create a single entry point and configure routing rules to direct user requests to different backends (which can be in different Azure regions).
When:
- Load Balancer: For non-web applications within a single region.
- Application Gateway: For web applications within a single region, especially when you need advanced routing or a WAF.
- Front Door: For globally-facing web applications that need high performance and availability across multiple regions.