Chapter 1 - Azure Virtual Network (VNet): This chapter starts by introducing Azure Geographies, Regions, and Availability Zones. Then it discusses Subscriptions and Resources Groups. After these basic Azure building block introductions, this chapter focuses on Virtual Networks (VNet). It shows how to create VNet using Azure Portal and Azure Resource Manager tool ARM. This chapter also explains how we can use tags to give informative descriptions to our resources.

Chapter 2 – Network Security Group (NSG): This chapter introduces three NSG scenarios. The first section explains the NSG to NIC association. The second section describes the NSG-Subnet association. The last part of the chapter introduces an Application Security Group (ASG), which we are using to form a logical VM group.

Chapter 3 – Internet Access with VM-Specific Public IP: We can assign a Public IP address, an Instance Level Public IP (ILPIP) to Azure resources using either the Static or Dynamic method. Each VMs has an implicit, default outbound access to the Internet because Azure assigns a default Outbound Access IP address (OPIP) dynamically. The OPIP address is not owned by customers and they may change. Microsoft recommends disabling the default outbound access. The recommended method is using a NAT Gateway or Firewall.

Chapter 4 - Virtual Network NAT Service - NAT Gateway: This chapter explains how VMs without ILPIP can use Azure Virtual Network NAT service provided by the Azure NAT Gateway for the Internet connection. NAT GW is a managed distributed service, which allows an egress-only Internet connection from VMs using either TCP or UDP transport layer protocols.

Chapter 5 – Hybrid Cloud – Site-to-Site VPN (S2S VPN): A Hybrid Cloud is a model where we split application-specific workloads across the public and private clouds. This chapter introduces Azure's hybrid cloud solution using Site-to-Site (S2S) Active-Standby VPN connection between Azure and on-prem DC. Azure S2S A/S VPN service includes five Azure resources.  

Chapter 6 – Hybrid Cloud – S2S VPN with BGP: This chapter shows how to enable dynamic routing using BGP between on-prem DC and Azure VNet.

Chapter 7 – VNet-to-VNet VPN: This chapter explains how we can use a VPN GW for allowing an Inter-VNet connection.

Chapter 8 – VNet Peering: This chapter introduces an Azure VNet Peering solution. VNet peering creates bidirectional IP connections between peered VNets. VNet peering links can be established within and across Azure regions and between VNets under the different Azure subscriptions or tenants. The unencrypted data path over peer links stays within Azure private infrastructure.

Chapter 9 – Transit VNet – Hub and Spoke: VNet Peering alone is a non-transitive solution, which only allows IP connection between peered VNets. However, we can build a design where we configure one of the VNets as a Hub VNet, which has VNet peering with Spoke VNets. Then, we set up a gateway VGW into the Hub VNet, which routes traffic between multiple Spoke VNets.

Chapter 10 – Hybrid Cloud – Routing Studies: This chapter discusses route propagations between on-prem DC and Azure Virtual Network in a Hybrid Cloud solution.

Chapter 11 – Virtual WAN Part I – S2S VPN and VNet Connection: This chapter introduces Azure Virtual WAN (vWAN) service. It offers a single deployment, management, and monitoring pane for connectivity services such as Inter-VNet, Site-to-Site VPN, and Express Route. In this chapter, we are focusing on S2S VPN and VNet connections.

Chapter 12 - Virtual WAN Part II – VNet Segmentation: VNets and VPN/ExpressRoute connections are associated with vHub’s Default Route Table, which allows both Vnet-to-Vnet and VNet-to-Remote Site IP connectivity. This chapter explains how we can isolate vnet-swe3 from vnet-swe1 and vnet-swe2 using VNet-specific vHub Route Tables (RT), still allowing VNet-to-VPN Site connection.

Chapter 13 - Virtual WAN Part III – Global Transit Network: This chapter introduces a global transit network architecture based on Azure vWAN.

Chapter 14 – Hybrid Cloud – Express Route: ExpressRoute (ER) is an Azure service that offers a logical circuit between Customer Edge (CE) router(s) and the pair of Microsoft Enterprise Edge (MSEE) devices. MSEEs are in one of the Azure selected Co-locations (Colo) - Carrier Neutral Facilities having a connection straight to the Microsoft Backbone network and ExpressRoute Provider (ERP). We can deploy an ExpressRoute circuit between Customer Edge (CE) and MSEE directly (ExpressRouteDirect) if the CE device is in Colo. If we don’t have existence in Colo, we can use ExpressRoute Provider’s infrastructure as a transport network between on-prem CE and MSEE. In this model, the ERP provides a layer 2 circuit (VLAN) between the CE-facing interface and to MSEE-facing port through its ExpressRoute Provider Edge (ERPE) devices. The ExpressRoute Provider model is the main focus of this chapter. 

Chapter 15 – Load Balancer & NAT - Ananta: This chapter introduces Azure’s cloud-scale load-balancing/NAT service Ananta. It consists of three building blocks. Ananta Manager (AM) is a highly available centralized Control Plane. Multiplexer (MUX) pool has a set of MUXs, which offer a Load Balancing service for inbound traffic. Ananta Host Agent (HA) is like a virtual switch within the Hypervisor’s VMSwitch performing NAT functions.