Azure Solutions Architecture · AZ-305 · Networking & Business Continuity · by Raushan Ranjan, MCT

Network infrastructure in Azure provides the foundation for your cloud deployment, connecting your resources to each other, to on-premises networks, and to the internet. Designing a robust network solution involves considering security, performance, and cost.

Network Architecture Recommendations

A hub-and-spoke network topology is the recommended architecture for most enterprise workloads in Azure. This design is highly scalable and manageable.

  • Hub Virtual Network (VNet): A central VNet acts as the hub, containing core services that are shared across all workloads. These services typically include a firewall, network management tools, and gateways for on-premises connectivity.
  • Spoke VNets: Workloads are deployed in separate VNets, called spokes. Each spoke VNet is peered with the hub VNet, allowing resources in the spokes to securely access shared services in the hub and communicate with on-premises networks.
  • Benefits: This model provides centralized control and security for all traffic, simplifies network management, and reduces costs by sharing resources.

On-Premises Connectivity

To connect on-premises networks to Azure, two primary solutions are available:

  • Azure VPN Gateway: This service establishes an encrypted connection over the public internet, creating a Site-to-Site VPN tunnel. This solution is cost-effective and suitable for scenarios where a high-speed, dedicated connection isn't required.
  • Azure ExpressRoute: This service provides a private, dedicated, and highly reliable connection from your on-premises network to Azure, bypassing the public internet entirely. It offers higher bandwidth and lower latency than a VPN Gateway and is ideal for mission-critical workloads, large data transfers, or hybrid applications with high traffic volume. For high availability, a combination of ExpressRoute with a VPN Gateway as a failover is a common pattern.

Application Delivery Services

These services are crucial for routing user traffic to your applications and ensuring high availability and performance.

  • Azure Load Balancer: This is a Layer 4 (transport layer) load balancer that distributes incoming network traffic across backend virtual machines or scale sets based on IP address and port. It provides high availability for your applications by directing traffic only to healthy instances.
  • Azure Application Gateway: This is a Layer 7 (application layer) load balancer that can make routing decisions based on HTTP/HTTPS attributes like the URL path. It includes a Web Application Firewall (WAF) to protect your web applications from common web-based attacks like SQL injection and cross-site scripting.
  • Azure Front Door: This service is a modern CDN and application delivery network that provides global routing and a single entry point for web applications. It improves performance for global users by routing them to the closest available backend and provides a high level of security with its built-in WAF.

Network Security

Protecting your network resources is paramount.

  • Network Security Groups (NSGs): NSGs act as a virtual firewall, controlling inbound and outbound traffic to Azure resources within a VNet. They allow you to define rules to permit or deny traffic based on source/destination IP address, port, and protocol.
  • Azure Firewall: A stateful, managed firewall service that provides centralized network security across all your VNets and subscriptions. It can filter traffic at both the VNet and subnet levels, providing a higher degree of control and logging than NSGs alone.
  • Azure DDoS Protection: This service protects your Azure resources from Distributed Denial of Service attacks. It comes in two tiers: a basic level that's automatically enabled for all Azure resources and a higher-tier plan that provides enhanced mitigation and monitoring.

Optimizing Performance

  • Azure ExpressRoute: For hybrid scenarios, ExpressRoute provides lower and more consistent latency compared to connections over the public internet.
  • Azure Front Door/CDN: A Content Delivery Network (CDN) caches static content at edge locations close to users, reducing latency and speeding up content delivery. Azure Front Door combines this with smart routing.
  • Azure Private Link: This service allows you to access Azure services (like Storage or SQL Database) over a private endpoint within your VNet, keeping traffic on the Microsoft backbone network and improving performance and security.

Optimizing Security

  • Zero Trust Model: The foundational principle is to never trust, always verify. All the recommended services, from NSGs to Azure Firewall, align with this model.
  • Private Endpoints: Using Azure Private Link, you can ensure that traffic to platform-as-a-service (PaaS) resources never traverses the public internet, significantly reducing the attack surface.
  • Azure Firewall and WAF: These are critical for controlling and inspecting network traffic. The WAF, in particular, provides protection against common application-layer attacks.

Load-Balancing and Routing

  • Regional Traffic: For distributing traffic within a single Azure region, use a combination of Azure Application Gateway (for web traffic) and Azure Load Balancer (for other TCP/UDP traffic).
  • Global Traffic: For distributing traffic across multiple Azure regions to ensure high availability and low latency for a global audience, use Azure Front Door.
📚 Continue Learning on RR Skillverse