Networking: Virtual Network and Load Balancer

Networking: Virtual Network and Load Balancer

Azure Virtual Network provides private IP connectivity for Azure resources. Subnets divide address space, network security groups filter traffic, route tables override selected paths, and peering connects virtual networks. Azure Load Balancer distributes Layer 4 TCP or UDP flows.

Core ideas

• Virtual networks are regional; peering can connect networks within or across Regions.
• Network security groups are stateful and contain priority-ordered allow or deny rules.
• A public IP exposes an Azure frontend, while private endpoints place supported services behind private addresses.
• Azure Load Balancer health probes determine which backend instances receive new flows.

Design and operating model

Allocate non-overlapping address space, separate application tiers, centralize shared egress and inspection only when justified, and minimize public IPs. Use private DNS zones for private endpoints. Select Layer 4 Load Balancer, Layer 7 Application Gateway, or global Front Door from protocol and routing requirements.

Example

az network vnet create \
  --resource-group learning-rg \
  --name learning-vnet \
  --address-prefixes 10.30.0.0/16 \
  --subnet-name app-subnet \
  --subnet-prefixes 10.30.1.0/24

az network nsg create \
  --resource-group learning-rg \
  --name app-nsg

Run examples in a disposable training subscription. Replace names, Regions, identifiers, scopes, sizes, and policies with reviewed values, and confirm current Azure CLI and service requirements before production use.

Production guidance

• Avoid broad inbound rules and audit effective routes and security rules, not just intended templates.
• Design outbound connectivity, DNS, hybrid routing, and failure domains before application deployment.
• Monitor flow, health probes, dropped traffic, gateway capacity, and cross-region transfer cost.

The chapter quiz follows the lesson and checks both service vocabulary and architecture decisions.