4: Implement and Manage Virtual Networking

Learning Objectives

By the end of this chapter, you will be able to:

• Configure and manage virtual networks in Azure.
• Configure secure access to virtual networks.
• Configure name resolution and load balancing.

Executive Summary

• A VNet is a regional, software-defined layer 3 network where every subnet permanently reserves five IP addresses and where peering must be configured on both sides and remains non-transitive.
• Network Security Groups filter at layer 4 with stateful 5-tuple rules, while Azure Firewall provides stateful filtering plus FQDN, threat intelligence, and TLS inspection at the network perimeter.
• Service endpoints extend VNet identity to PaaS services over the Azure backbone but still resolve to public IPs, while private endpoints inject a private NIC into a subnet and require private DNS zone integration to resolve correctly.
• Azure Load Balancer operates at layer 4 with health probes and hash-based distribution, while Application Gateway operates at layer 7 with path and host header routing plus optional Web Application Firewall.

Assumptions

• All examples use the West Europe region (location code westeurope) and a single fictional naming convention: vnet-*, snet-*, nsg-*, asg-*, pip-*, rt-*, lb-*, agw-*, fw-*, with resources grouped in rg-network-prod.
• IPv4 RFC 1918 address space is used throughout. Dual-stack IPv6 mechanics are referenced only where they alter a configuration limit.
• Hybrid connectivity (VPN gateway, ExpressRoute, Virtual WAN) is referenced where relevant for routing context but is covered in depth in Chapter 5.