Final Network Private

Azure virtual network key capabilities

Isolation and segmentation, internet communications, communicate between Azure resources, communicate with on-premises resources, route network traffic, filter network traffic, and connect virtual networks

Public endpoint

Has a public IP address and can be accessed from anywhere in the world

Private endpoint

Exists within a virtual network and has a private IP address from within that virtual network's address space

How to enable incoming internet connections to an Azure resource

Assign a public IP address to the resource or put it behind a public load balancer

Two ways Azure resources communicate securely with each other

Virtual networks and service endpoints

Virtual networks (communicating between Azure resources)

Connect VMs and other Azure resources such as App Service Environment for Power Apps, Azure Kubernetes Service, and Azure virtual machine scale sets

Service endpoints

Connect to other Azure resource types such as Azure SQL databases and storage accounts, linking them to virtual networks for better security and optimal routing

Three ways to connect Azure to on-premises resources

Point-to-site VPN, site-to-site VPN, and Azure ExpressRoute

Point-to-site VPN

A connection from a computer outside your environment back into your private network, where the client initiates an encrypted VPN connection to the Azure virtual network

Site-to-site VPN

Links your on-premises VPN device or gateway to the Azure VPN gateway in a virtual network, making Azure devices appear on the local network; encrypted and works over the internet

Azure ExpressRoute

Dedicated private connectivity to Azure that does not travel over the internet; used when you need greater bandwidth and higher security

Default Azure routing behavior

Azure routes traffic between subnets on any connected virtual networks, on-premises networks, and the internet

Route tables

Let you define rules about how traffic should be directed; custom route tables control how packets are routed between subnets

Border Gateway Protocol (BGP)

Works with Azure VPN gateways, Azure Route Server, or Azure ExpressRoute to propagate on-premises BGP routes to Azure virtual networks

User-defined routes (UDR)

Let you control routing tables between subnets within a virtual network or between virtual networks for greater control over traffic flow

Two ways to filter traffic between subnets

Network security groups and network virtual appliances

Network security group (NSG)

An Azure resource containing multiple inbound and outbound security rules that allow or block traffic based on source and destination IP address, port, and protocol

Network security group rule evaluation

Rules are evaluated by priority and the first match wins

Network virtual appliance (NVA)

A specialized VM, like a hardened network appliance, that performs a particular network function such as running a firewall or WAN optimization

Virtual network peering

Connects two virtual networks directly to each other so resources in each can communicate

Traffic between peered networks

Private and travels on the Microsoft backbone network, never entering the public internet

Can peered virtual networks be in different regions

Yes, which lets you create a global interconnected network through Azure

Virtual private network (VPN)

Uses an encrypted tunnel within another network, typically to connect two or more trusted private networks over an untrusted network such as the public internet

Purpose of VPN encryption

Prevents eavesdropping or other attacks while traffic travels over the untrusted network

VPN gateway

A type of virtual network gateway

Where Azure VPN Gateway instances are deployed

In a dedicated subnet of the virtual network

Three connectivity types enabled by Azure VPN Gateway

Site-to-site (on-premises datacenters to virtual networks), point-to-site (individual devices to virtual networks), and network-to-network (virtual networks to other virtual networks)

Network-to-network connection

Two Azure virtual networks connect their VPN gateways across regions through an encrypted tunnel

How many VPN gateways can be deployed per virtual network

Only one, but it can connect to multiple locations including other virtual networks or on-premises datacenters

Policy-based VPN gateway

Statically specifies the IP addresses of packets that should be encrypted through each tunnel and evaluates every packet against those IP sets to choose the tunnel

Route-based VPN gateway

IPsec tunnels are modeled as a network or virtual tunnel interface, and IP routing (static routes or dynamic routing protocols) decides which tunnel interface to use for each packet

Preferred VPN type for on-premises devices

Route-based VPN, because it is more resilient to topology changes such as the creation of new subnets

Primary difference between policy-based and route-based VPNs

How they determine which traffic needs encryption

Authentication method used by Azure VPN gateways

Preshared key, regardless of VPN type

When to use a route-based VPN gateway

Connections between virtual networks, point-to-site connections, multisite connections, and coexistence with an Azure ExpressRoute gateway

Default VPN gateway high-availability configuration

Two instances deployed in an active/standby configuration, even if only one VPN gateway resource is visible in Azure

Active/standby failover recovery time

A few seconds for planned maintenance and within 90 seconds for unplanned disruptions

Active/active VPN gateway configuration

Both instances handle traffic at the same time, each with a unique public IP address and a separate tunnel from the on-premises device; requires BGP support

Active/active high-availability extension

Deploy an additional VPN device on-premises

ExpressRoute failover

Configure a VPN gateway as a secure failover path over the internet in case an ExpressRoute circuit or its entire location has an outage

Zone-redundant gateway

VPN and ExpressRoute gateways deployed across availability zones to physically and logically separate them and protect against zone-level failures

Requirements for zone-redundant gateways

Different gateway SKUs and Standard public IP addresses instead of Basic public IP addresses