Networking, Connectivity, and Hybrid Integration
Virtual network foundations
A Virtual Network (VNet) is the isolation boundary for Azure networking. Subnets segment address space; Network Security Groups (NSGs) filter traffic by rules; Application Security Groups group VMs by workload. User-defined routes (UDRs) override system routes. Azure Firewall, Azure Bastion, and DDoS Protection add centralized security and access.
Connectivity and hybrid
VNet peering connects VNets privately but is non-transitive by default. Hub-and-spoke designs centralize shared services, often with Azure Firewall and UDRs. VPN Gateway connects over the internet with IPsec; ExpressRoute provides private dedicated connectivity. Azure Bastion gives browser-based RDP/SSH without public IPs. Private Link and Private Endpoints expose PaaS services privately inside a VNet. Service endpoints extend VNet identity to PaaS but do not provide a private IP.
Name resolution and load balancing
Private DNS zones resolve private endpoints. Azure Load Balancer handles Layer 4; Application Gateway handles Layer 7 with WAF; Front Door provides global HTTP routing and acceleration; Traffic Manager provides DNS-based global routing.
Traps
Common traps include assuming peering is transitive, forgetting that overlapping address spaces block peering, confusing service endpoints with private endpoints, and assuming NSGs inspect all traffic. Also remember that gateway transit must be enabled for spokes to use a hub VPN or ExpressRoute gateway.
Worked example
A hub VNet contains Azure Firewall and a VPN Gateway. Spoke VNets peer with the hub. For spoke-to-spoke traffic, enable gateway transit and use UDRs to send traffic through the firewall; peering alone will not route it.
Rule of thumb
Design address space first, then connectivity, then security: overlapping IPs are expensive to fix later.