Implementing and Managing Networking in Hybrid Scenarios
Core concepts
Hybrid networking connects on-premises networks to Azure. Master Azure VPN Gateway (site-to-site, point-to-site, and ExpressRoute coexistence), Azure ExpressRoute circuits and peering, Azure Virtual WAN, hub-and-spoke topologies, VNet peering (regional and global), user-defined routes, and Azure DNS with private DNS zones and DNS forwarding.
On the Windows Server side, understand DNS (conditional forwarders, stub zones, DNSSEC), DHCP failover, IPAM, Windows Server routing and remote access, NAT, and Network Policy Server for RADIUS. For hybrid name resolution, private DNS zones linked to VNets plus on-premises conditional forwarders are the standard pattern. Also know Azure Bastion and just-in-time VM access for secure management access.
Traps to watch
- VNet peering is non-transitive. Spoke-to-spoke traffic requires a hub with gateway transit or UDRs; a common wrong answer assumes peering chains automatically.
- Gateway transit must be enabled on the hub peering for spokes to use the hub VPN or ExpressRoute gateway.
- ExpressRoute does not encrypt traffic by default; IPsec over ExpressRoute is a separate design choice.
- Point-to-site uses certificate or Entra ID authentication and is for individual clients, not site links.
- Private DNS resolution fails if the private zone is not linked to the VNet or if on-premises forwarders are not configured.
Rule of thumb
Design hub-and-spoke: hub holds shared services (gateway, firewall, DNS), spokes peer to the hub with gateway transit and allow forwarded traffic enabled, and UDRs force spoke egress through the hub firewall. For name resolution, link private zones to every VNet that must resolve them and add conditional forwarders on-premises pointing to Azure DNS Private Resolver or a DNS VM.
Worked example
Two spokes must reach each other and the on-premises network through a hub VPN gateway. Enable gateway transit on the hub-to-spoke peerings, allow forwarded traffic, and add UDRs on each spoke pointing 0.0.0.0/0 or the on-premises range to the hub firewall or gateway.