Azure Networking Fundamentals
Minimum price
Suggested price

Azure Networking Fundamentals

A Practical Guide to Understand How to Build a Virtual Datacenter into the Azure Cloud

About the Book

Chapter 1 - Azure Virtual Network (VNet): This chapter starts by introducing Azure Geographies, Regions, and Availability Zones. Then it discusses Subscriptions and Resources Groups. After these basic Azure building block introductions, this chapter focuses on Virtual Networks (VNet). It shows how to create VNet using Azure Portal and Azure Resource Manager tool ARM. This chapter also explains how we can use tags to give informative descriptions to our resources.

Chapter 2 – Network Security Group (NSG): This chapter introduces three NSG scenarios. The first section explains the NSG to NIC association. The second section describes the NSG-Subnet association. The last part of the chapter introduces an Application Security Group (ASG), which we are using to form a logical VM group.

Chapter 3 – Internet Access with VM-Specific Public IP: We can assign a Public IP address, an Instance Level Public IP (ILPIP) to Azure resources using either the Static or Dynamic method. Each VMs has an implicit, default outbound access to the Internet because Azure assigns a default Outbound Access IP address (OPIP) dynamically. The OPIP address is not owned by customers and they may change. Microsoft recommends disabling the default outbound access. The recommended method is using a NAT Gateway or Firewall.

Chapter 4 - Virtual Network NAT Service - NAT Gateway: This chapter explains how VMs without ILPIP can use Azure Virtual Network NAT service provided by the Azure NAT Gateway for the Internet connection. NAT GW is a managed distributed service, which allows an egress-only Internet connection from VMs using either TCP or UDP transport layer protocols.

Chapter 5 – Hybrid Cloud – Site-to-Site VPN (S2S VPN): A Hybrid Cloud is a model where we split application-specific workloads across the public and private clouds. This chapter introduces Azure's hybrid cloud solution using Site-to-Site (S2S) Active-Standby VPN connection between Azure and on-prem DC. Azure S2S A/S VPN service includes five Azure resources.  

Chapter 6 – Hybrid Cloud – S2S VPN with BGP: This chapter shows how to enable dynamic routing using BGP between on-prem DC and Azure VNet.

Chapter 7 – VNet-to-VNet VPN: This chapter explains how we can use a VPN GW for allowing an Inter-VNet connection.

Chapter 8 – VNet Peering: This chapter introduces an Azure VNet Peering solution. VNet peering creates bidirectional IP connections between peered VNets. VNet peering links can be established within and across Azure regions and between VNets under the different Azure subscriptions or tenants. The unencrypted data path over peer links stays within Azure private infrastructure.

Chapter 9 – Transit VNet – Hub and Spoke: VNet Peering alone is a non-transitive solution, which only allows IP connection between peered VNets. However, we can build a design where we configure one of the VNets as a Hub VNet, which has VNet peering with Spoke VNets. Then, we set up a gateway VGW into the Hub VNet, which routes traffic between multiple Spoke VNets.

Chapter 10 – Hybrid Cloud – Routing Studies: This chapter discusses route propagations between on-prem DC and Azure Virtual Network in a Hybrid Cloud solution.


Chapter 11 – Virtual WAN Part I – S2S VPN and VNet Connection: This chapter introduces Azure Virtual WAN (vWAN) service. It offers a single deployment, management, and monitoring pane for connectivity services such as Inter-VNet, Site-to-Site VPN, and Express Route. In this chapter, we are focusing on S2S VPN and VNet connections.


Chapter 12 - Virtual WAN Part II – VNet Segmentation: VNets and VPN/ExpressRoute connections are associated with vHub’s Default Route Table, which allows both Vnet-to-Vnet and VNet-to-Remote Site IP connectivity. This chapter explains how we can isolate vnet-swe3 from vnet-swe1 and vnet-swe2 using VNet-specific vHub Route Tables (RT), still allowing VNet-to-VPN Site connection.


Chapter 13 - Virtual WAN Part III – Global Transit Network: This chapter introduces a global transit network architecture based on Azure vWAN.


Chapter 14 – Hybrid Cloud – Express Route: ExpressRoute (ER) is an Azure service that offers a logical circuit between Customer Edge (CE) router(s) and the pair of Microsoft Enterprise Edge (MSEE) devices. MSEEs are in one of the Azure selected Co-locations (Colo) - Carrier Neutral Facilities having a connection straight to the Microsoft Backbone network and ExpressRoute Provider (ERP). We can deploy an ExpressRoute circuit between Customer Edge (CE) and MSEE directly (ExpressRouteDirect) if the CE device is in Colo. If we don’t have existence in Colo, we can use ExpressRoute Provider’s infrastructure as a transport network between on-prem CE and MSEE. In this model, the ERP provides a layer 2 circuit (VLAN) between the CE-facing interface and to MSEE-facing port through its ExpressRoute Provider Edge (ERPE) devices. The ExpressRoute Provider model is the main focus of this chapter. 

Chapter 15 – Load Balancer & NAT - Ananta: This chapter introduces Azure’s cloud-scale load-balancing/NAT service Ananta. It consists of three building blocks. Ananta Manager (AM) is a highly available centralized Control Plane. Multiplexer (MUX) pool has a set of MUXs, which offer a Load Balancing service for inbound traffic. Ananta Host Agent (HA) is like a virtual switch within the Hypervisor’s VMSwitch performing NAT functions.

About the Author

Toni Pasanen
Toni Pasanen

Toni Pasanen. CCIE No. 28158 (RS), Distinguished Engineer at Fujitsu Finland. Toni started his IT carrier in 1998 at Tieto, where he worked as a Service Desk Specialist moving via the LAN team to the Data Center team as a 3rd. Level Network Specialist. Toni joined Teleware (Cisco Learning partner) in 2004, where he spent two years teaching network technologies focusing on routing/switching and MPLS technologies. Toni joined Tieto again in 2006, where he spent the next six years as a Network Architect before joining Fujitsu. Toni works closely with customers in his current role, helping them select the right network solutions from technology and business perspectives. He is also the author of books:

- Virtual Extensible LAN – VXLAN: The Practical Guide to Understand VXLAN Solution - 2019

- LISP with VXLAN in Campus Fabric - 2020

- VXLAN Fabric with BGP EVPN Control-Plane. Design Considerations – 2020

- Object-Based Approach to Cisco ACI: The Logic Behind the Application Centric Infrastructure - 2020

- Cisco SD-WAN: A Practical Guide to Understand the Basics of Cisco Viptela Based SD-WAN Solution- 2021

- Network Virtualization: LISP, OMP, and BGP EVPN Operation and Interaction

- AWS Networking Fundamentals: A Practical Guide to Understand How to Build a Virtual Datacenter into the AWS Cloud

- Azure Networking Fundamentals: A Practical Guide to Understand How to Build a Virtual Datacenter into the Azure Cloud

The Leanpub 60-day 100% Happiness Guarantee

Within 60 days of purchase you can get a 100% refund on any Leanpub purchase, in two clicks.

See full terms

80% Royalties. Earn $16 on a $20 book.

We pay 80% royalties. That's not a typo: you earn $16 on a $20 sale. If we sell 5000 non-refunded copies of your book or course for $20, you'll earn $80,000.

(Yes, some authors have already earned much more than that on Leanpub.)

In fact, authors have earnedover $12 millionwriting, publishing and selling on Leanpub.

Learn more about writing on Leanpub

Free Updates. DRM Free.

If you buy a Leanpub book, you get free updates for as long as the author updates the book! Many authors use Leanpub to publish their books in-progress, while they are writing them. All readers get free updates, regardless of when they bought the book or how much they paid (including free).

Most Leanpub books are available in PDF (for computers) and EPUB (for phones, tablets and Kindle). The formats that a book includes are shown at the top right corner of this page.

Finally, Leanpub books don't have any DRM copy-protection nonsense, so you can easily read them on any supported device.

Learn more about Leanpub's ebook formats and where to read them

Write and Publish on Leanpub

You can use Leanpub to easily write, publish and sell in-progress and completed ebooks and online courses!

Leanpub is a powerful platform for serious authors, combining a simple, elegant writing and publishing workflow with a store focused on selling in-progress ebooks.

Leanpub is a magical typewriter for authors: just write in plain text, and to publish your ebook, just click a button. (Or, if you are producing your ebook your own way, you can even upload your own PDF and/or EPUB files and then publish with one click!) It really is that easy.

Learn more about writing on Leanpub