Stage 5 · Platform

Azure Foundations

Azure Networking Basics

VNets, subnets, NSGs, peering, Private Endpoints, and DNS zones.

8 min readAzure Cloud EngineeringPlatform

Virtual Networks

A Virtual Network (VNet) is your isolated network space in Azure. Resources within a VNet can communicate with each other by default. Communication outside the VNet requires routing, peering, or gateways.

Create a VNet


# Create a VNet with a default subnet
az network vnet create \
  --resource-group rg-networking \
  --name vnet-prod-eastus \
  --address-prefixes 10.0.0.0/16 \
  --location eastus

The address prefix defines the IP range for the entire VNet. 10.0.0.0/16 gives you 65,536 IP addresses — enough for most environments.

Subnets

Subnets are subdivisions of a VNet's address space. Each subnet is a contiguous range of IPs. Resources in different subnets within the same VNet can still communicate — subnets are routing boundaries, not isolation boundaries.

Create subnets for different purposes


# Create a subnet for AKS nodes
az network vnet subnet create \
  --resource-group rg-networking \
  --vnet-name vnet-prod-eastus \
  --name subnet-aks \
  --address-prefixes 10.0.1.0/24

# Create a subnet for databases
az network vnet subnet create \
  --resource-group rg-networking \
  --vnet-name vnet-prod-eastus \
  --name subnet-db \
  --address-prefixes 10.0.2.0/24

# Create a subnet for private endpoints
az network vnet subnet create \
  --resource-group rg-networking \
  --vnet-name vnet-prod-eastus \
  --name subnet-pe \
  --address-prefixes 10.0.3.0/24 \
  --disable-private-endpoint-network-policies true

The subnet-pe subnet has private endpoint network policies disabled — this is required for Private Endpoints. Without this, private endpoint creation will fail.

Dedicate a subnet to private endpoints

Always create a dedicated /24 subnet for private endpoints. Mixing private endpoints with other resource types in the same subnet causes routing issues.

Network Security Groups

A Network Security Group (NSG) contains security rules that allow or deny traffic. NSGs can be associated with subnets or network interfaces. Rules are evaluated by priority — the lowest numbered rule wins.

Create an NSG with rules


# Create an NSG
az network nsg create \
  --resource-group rg-networking \
  --name nsg-aks-nodes

# Allow SSH from a specific IP
az network nsg rule create \
  --resource-group rg-networking \
  --nsg-name nsg-aks-nodes \
  --name AllowSSH \
  --priority 100 \
  --destination-port-ranges 22 \
  --source-address-prefixes 203.0.113.0/24 \
  --access Allow \
  --protocol Tcp

# Deny all inbound traffic except what's explicitly allowed
az network nsg rule create \
  --resource-group rg-networking \
  --nsg-name nsg-aks-nodes \
  --name DenyAllInbound \
  --priority 4096 \
  --direction Inbound \
  --access Deny \
  --protocol '*' \
  --source-address-prefixes '*' \
  --destination-port-ranges '*'

NSG rules are stateful — if you allow inbound traffic, the response is automatically allowed outbound. You do not need separate outbound rules for return traffic.

VNet Peering

VNet peering connects two VNets through the Azure backbone network. Peered VNets can communicate using private IP addresses as if they were on the same network. Peering is non-transitive — VNet A peered to VNet B and VNet B peered to VNet C does not connect A to C.

Peer two VNets


# Peer vnet-eastus to vnet-westus
az network vnet peering create \
  --resource-group rg-networking \
  --name peer-eastus-to-westus \
  --vnet-name vnet-prod-eastus \
  --remote-vnet vnet-prod-westus \
  --allow-vnet-access true

# Peering must be done from BOTH sides
az network vnet peering create \
  --resource-group rg-networking \
  --name peer-westus-to-eastus \
  --vnet-name vnet-prod-westus \
  --remote-vnet vnet-prod-eastus \
  --allow-vnet-access true

Both sides of the peering must be created independently. The peering will show a 'Connected' state only when both sides are configured.

Private Endpoints

A Private Endpoint is a network interface that connects you privately to an Azure service using a private IP from your VNet. This keeps traffic entirely within the Azure backbone and off the public internet.

Create a Private Endpoint for Storage


# Create a private endpoint for a storage account
az network private-endpoint create \
  --resource-group rg-payments \
  --name pe-storage-payments \
  --vnet-name vnet-prod-eastus \
  --subnet subnet-pe \
  --private-connection-resource-id "/subscriptions/{sub-id}/resourceGroups/rg-payments/providers/Microsoft.Storage/storageAccounts/stpaymentsprod" \
  --group-id table \
  --connection-name conn-storage-payments

The --group-id parameter specifies which sub-resource to connect to (blob, table, queue, file for storage accounts). Each sub-resource requires its own private endpoint.

Private DNS Zones

Private DNS zones ensure that private endpoints are resolvable via DNS. Without a Private DNS zone, your applications would need to be configured to use private IPs directly.

Link Private DNS zone to a VNet


# Create a Private DNS zone for Blob Storage
az network private-dns zone create \
  --resource-group rg-networking \
  --name "privatelink.blob.core.windows.net"

# Link the zone to a VNet
az network private-dns zone link create \
  --resource-group rg-networking \
  --zone-name "privatelink.blob.core.windows.net" \
  --name link-vnet-prod \
  --virtual-networks vnet-prod-eastus \
  --registration-enabled false

Each Azure service has a specific Private DNS zone name (e.g., privatelink.blob.core.windows.net for Blob Storage). Using the wrong zone name breaks DNS resolution for the private endpoint.

Peering is not transitive

If VNet A is peered with VNet B, and VNet B is peered with VNet C, VNet A cannot reach VNet C through VNet B. You must create direct peerings or use a hub-and-spoke topology with a gateway.

Mark this lesson complete to store local progress and unlock a cleaner resume path the next time you visit.