Troubleshooting Networks
Azure networking troubleshooting revolves around name resolution, routing, and filtering. Know VNets, subnets, network security groups (NSGs), application security groups, user-defined routes (UDRs), Azure Firewall, NAT Gateway, load balancers, and private endpoints. Effective routes and effective security rules on a NIC are the two most useful diagnostic outputs; they show what Azure actually applies after inheritance and peering.
Traps: NSG rules are stateful and evaluated by priority (lowest number first), with default rules allowing VNet and Azure Load Balancer traffic; a deny rule can silently block health probes. UDRs can override system routes and blackhole traffic if the next hop is wrong. Peering is not transitive-hub-and-spoke requires a gateway or firewall in the hub. Private DNS resolution requires the private zone linked to the resolving VNet. Azure Firewall needs a route table on the subnet to force traffic through it, and SNAT behavior changes with multiple public IPs.
Worked rule of thumb: follow the packet. Start at the source NIC's effective routes and NSG rules, then the destination's, then any firewall or appliance in between. Use Network Watcher IP flow verify to test a specific 5-tuple, next hop to confirm routing, and connection troubleshoot for end-to-end path checks.
Also recognize service-level networking: storage and SQL firewalls, service endpoints versus private endpoints, and that private endpoints bypass service firewall rules for traffic arriving through the endpoint.