Azure Solutions Architecture — Networking, Business Continuity & Migration: An Architect's Overview

Azure Solutions Architecture · AZ-305 · Networking & Business Continuity · by Raushan Ranjan, MCT

Network Infrastructure: The Big Picture

Designing a robust network in Azure involves a multi-layered approach to ensure security, performance, and manageability. You can simplify the process by breaking it down into four main pillars: architecture, connectivity, security, and traffic management.

1. Network Architecture: The Hub-and-Spoke Model

The most common and recommended network design is the hub-and-spoke model.

Hub VNet: This is a central network that acts as a secure control center. It contains shared services like a firewall, gateways for connecting to your on-premises network, and tools for monitoring traffic. Think of it as the main intersection where all the traffic is inspected and directed.
Spoke VNets: These are separate networks where your actual workloads, like applications and databases, are deployed. Each spoke connects to the hub, which allows them to share services securely without needing a direct connection to each other. This setup is great for keeping your different applications isolated while still being centrally managed.

2. On-Premises Connectivity: Connecting to Your Office

To connect your existing office or data center to Azure, you have two main options:

Azure VPN Gateway: This creates a secure, encrypted tunnel over the public internet. It's a simple, cost-effective choice for connecting to Azure when you don't need very high speeds.
Azure ExpressRoute: This provides a private, dedicated, high-speed connection between your network and Azure. It bypasses the public internet completely, offering lower latency and higher reliability. This is ideal for critical workloads or for transferring large amounts of data. For maximum reliability, many businesses use ExpressRoute and keep a VPN Gateway as a backup.

3. Network Security: Protecting Your Assets

Security is critical. Azure provides several tools to protect your network.

Network Security Groups (NSGs): These are like basic firewalls for your individual resources. You create rules to allow or deny traffic based on IP address, port, and protocol.
Azure Firewall: A managed, stateful firewall service that offers more comprehensive and centralized security than NSGs. It's the primary tool you'd use in the hub network to inspect and control traffic for all your spokes.
DDoS Protection: Azure has built-in protection against distributed denial of service attacks. A higher-tier plan offers enhanced features for mission-critical applications.
Azure Private Link: This service keeps traffic to Azure services (like Storage Accounts or SQL Databases) on the private Microsoft network, never touching the public internet. This significantly improves security and performance.

4. Traffic Management: Directing User Traffic

These services ensure your applications are available and perform well for your users.

Azure Load Balancer: This is a basic load balancer that distributes network traffic to a group of virtual machines within a single region. It's great for ensuring high availability for internal applications.
Azure Application Gateway: A more advanced load balancer for web applications. It can inspect HTTP/HTTPS traffic and route it based on the URL. It also includes a Web Application Firewall (WAF) to protect against common web attacks.
Azure Front Door: This is for global applications. It routes user traffic to the closest data center, improving performance. It also includes a WAF and can act as a global load balancer, ensuring high availability across multiple regions.

Business Continuity and Disaster Recovery Simplified

Think of it like this: business continuity is about making sure your business keeps running no matter what, and a disaster recovery plan is a big part of that. Azure has two main tools to help you do this: Azure Backup and Azure Site Recovery.

Azure Backup: Saving Your Data

Think of Azure Backup like a high-tech safety deposit box for your digital stuff. It creates copies of your data and applications and stores them safely in the cloud. This is your plan for when things get accidentally deleted or corrupted.

What It Protects

Azure Storage (Blobs and Files): Imagine you have a digital file cabinet. Operational backup is like having a copy of a file you just worked on in a special folder right inside the cabinet—it's super quick to get back if you accidentally delete it. Vaulted backup is like sending a copy of that file to a bank vault across town—it's a little slower to retrieve, but it's completely safe even if your whole cabinet gets destroyed.
Virtual Machines (VMs): These are like your digital computers running in the cloud. Azure Backup takes a snapshot of your entire computer, including all its files and programs. It then sends only the changes to a separate safe location, which is a very efficient way to back up.
Azure SQL Databases: Azure automatically backs up your databases for you. It takes a full backup once a week, and then smaller, more frequent backups of just the changes. This lets you restore your database to almost any moment in the recent past, which is perfect if someone accidentally messes up some data.

Azure Site Recovery: Keeping the Lights On

Now, if Azure Backup is about getting your data back, Azure Site Recovery (ASR) is about getting your whole business back up and running. It's a "disaster recovery as a service" solution, which means it's a ready-to-go plan for when something big happens, like a whole data center going down.

How It Works

Imagine you have a main office and a second, secret office that's a perfect replica of the first. ASR continuously makes sure everything you do in the main office is immediately copied to the second office. If a disaster hits your main office, you just "failover" and switch to the second office. All your computers and applications are already there, and you can get back to work in minutes.

Key Features

Continuous Replication: ASR constantly sends copies of your servers and applications to a different Azure region, so the replica is always up-to-date.
Recovery Plans: This is like a pre-written playbook for a disaster. It tells ASR the exact order in which to turn on your applications in the backup location. For example, it might say "turn on the database server first, then the web servers," so everything starts correctly.
Failover and Failback: Failover is the process of switching to the backup site when a disaster happens. Once the main site is fixed, you can failback and switch operations back to your original location. You can even do a test failover at any time to make sure your plan works without disrupting anything.
Low Downtime and Data Loss: ASR is designed to get your business back online with as little downtime (Recovery Time Objective or RTO) and as little data loss (Recovery Point Objective or RPO) as possible. Some workloads can be restored in minutes with very little data loss.

Backup vs. Recovery

Azure Backup is for data protection. Use it for day-to-day issues like accidental deletions or file corruption. It's your long-term storage for data copies.
Azure Site Recovery is for business continuity. Use it for large-scale disasters where an entire location or data center is unavailable. It ensures your applications can be brought back online quickly.

Essentially, Backup is about your files, while Site Recovery is about your entire business operation. Both are important for a complete protection strategy.

Migration Simplified: The 3-Step Journey

Migrating to the cloud can be confusing, but a simple way to think about it is as a three-step journey: Plan, Move, and Improve. Microsoft provides a blueprint called the Cloud Adoption Framework (CAF) and a central tool called Azure Migrate to guide you through it.

1. Plan Your Move (Assess)

Before you move anything, you need a plan. This is the most important step. You use a special tool called the Azure Migrate appliance to do this.

What it is: The appliance is a small, lightweight program you install on a computer in your own data center. It's like a digital inventory tool.
What it does: It scans all your servers, databases, and websites to figure out exactly what you have.
What you learn: The appliance provides a detailed report that tells you:
- Dependencies: Which servers talk to each other so you know what needs to be moved together.
- Readiness: If your systems can be moved to Azure as-is or if they need changes.
- Cost: An estimate of what it will cost to run your systems in Azure.
- Sizing: Recommendations for the right size of virtual computers (VMs) in Azure to match your current performance.

2. Make the Move (Migrate)

Once you have your plan, you use different tools to actually move your stuff. The right tool depends on what you're moving.

Moving Servers (Lift-and-Shift): If you just want to copy your virtual machines from your data center to Azure, you use Azure Migrate: Server Migration. This tool replicates your on-premises servers to Azure with minimal downtime. It’s like creating a perfect clone of your computer in the cloud.
Moving Databases: Databases need special care. You have two main tools:
- Azure Database Migration Service (DMS): This is a managed service that handles the entire migration for you with almost no interruption to your business. It works for many different types of databases.
- Azure Data Studio: This is a free tool for SQL Server users. It helps you assess your database and then guides you through the process of moving it to an Azure SQL Database.
Moving Data (Files and Storage):
- For small amounts of data: You can use online tools like AzCopy (a command-line tool for fast copying) or Azure Storage Mover (a managed service).
- For huge amounts of data: If you have terabytes or petabytes of data, it would take too long to transfer over the internet. Instead, you use Azure Data Box. This is a physical device that Microsoft ships to you. You copy all your data onto it, ship it back, and Microsoft uploads the data to your Azure storage account. It's like a very large, secure external hard drive for the cloud.

3. Improve in the Cloud (Optimize)

After everything is moved, your job isn't done. You should optimize your workloads to take full advantage of the cloud. This means:

Right sizing: Making sure you're using the smallest possible VMs that can still handle your workload.
Cost management: Reducing your costs by using features like reserved instances or by shutting down VMs when they're not in use.
Security: Enhancing security by using Azure's built-in security features.

📚 Continue Learning on RR Skillverse