Introduction
Azure Virtual Networks (VNet) are at the core of networking in Azure. They allow Azure resources to securely communicate with each other, the internet, and on-premises networks. Let’s break down all the key terms and features related to VNets in the simplest way possible.
In recent years, Azure has also added new networking capabilities such as Azure Virtual Network Manager, NAT Gateway, DNS Private Resolver, expanded Private Endpoints, and cross-tenant VNet peering, making VNet design more powerful and easier to manage at scale.
What is an Azure Virtual Network?
A Virtual Network (VNet) is a logically isolated network in Azure where we can host and connect our resources, like virtual machines, securely.
Today, VNets can span regions through peering, support IPv4 and IPv6 dual-stack networks, and be centrally governed using Azure Virtual Network Manager.
Key Terms and Concepts
Subnet
A smaller network within a VNet.
Used to segment resources and control access.
Private IP Address
An IP address for internal communication within a VNet.
Public IP Address
An IP address to make resources accessible from the internet.
Network Security Group (NSG)
Acts like a firewall, controlling traffic to and from resources in a subnet or network interface.
Note: NSGs provide basic Layer-4 security. For advanced features like URL filtering, threat intelligence, or outbound SNAT control, Azure Firewall is used alongside NSGs.
Route Table
Defines the routing rules for network traffic within a VNet.
Peering
Connects two VNets so resources can communicate as if they’re in the same network.
Azure now also supports cross-tenant VNet peering, enabling collaboration between organizations.
VPN Gateway
Used for secure connections between an on-premises network and an Azure VNet.
Azure ExpressRoute
A private, high-speed connection between our on-premises network and Azure (no internet involved).
DNS (Domain Name System)
Resolves domain names (like mywebsite.com) to IP addresses.
For hybrid and Private Endpoint environments, Azure now provides DNS Private Resolver, a managed solution for inbound and outbound DNS forwarding.
Azure Bastion
A secure way to connect to virtual machines without exposing them to the internet.
Service Endpoints
Connect specific Azure services to our VNet securely, bypassing the internet.
Note: While still supported, Microsoft now recommends Private Endpoints for enhanced security.
Private Endpoint
A private IP for Azure services to access them securely within a VNet.
Private Endpoints are the modern, preferred method of securely connecting to Azure PaaS services.
DDoS Protection
Defends our applications from Distributed Denial of Service (DDoS) attacks.
VNet Integration
Lets App Services or Azure Functions access resources in a VNet.
NAT Gateway (New Addition)
Provides reliable outbound internet access for a VNet without exposing resources publicly.
A NAT Gateway is preferred over using VM public IPs for outbound traffic.
Azure Virtual Network Manager (AVNM)
A centralized service used to manage connectivity and security across multiple VNets globally.
AVNM enables:
- Hub-and-spoke or mesh connectivity deployments
- Centralized security admin rules
- Automated at-scale network configuration
- Consistent VNet governance
How VNets Work
We create a VNet and define a CIDR block (e.g., 10.0.0.0/16) to allocate IP addresses.
Divide the VNet into subnets to organize resources (e.g., one subnet for web servers, another for databases).
Use NSGs to control which traffic is allowed or denied.
Set up a Route Table to manage how traffic flows within and outside the VNet.
If needed, connect the VNet to other networks using Peering, VPN Gateway, or ExpressRoute.
Modern VNet designs often include NAT Gateway for outbound traffic, Private Endpoints for secure PaaS access, and DNS Private Resolver for hybrid DNS resolution.
Common Scenarios for VNets
Isolated Application Hosting
Keep applications secure by hosting them in a private VNet.
Hybrid Networking
Connect on-premises networks with Azure using VPN Gateway or ExpressRoute.
Service Integration
Access Azure services privately with Service Endpoints or Private Endpoints.
Private Endpoints are now the recommended secure approach.
Multi-Region Networking
Use VNet Peering – including cross-region and cross-tenant peering – to connect resources globally.
Enterprise Network Models (New)
Azure now commonly uses two modern VNet design patterns:
Hub-and-Spoke Architecture
- Central Hub VNet hosts shared services like Bastion, Firewall, DNS
- Spoke VNets host workloads
- Ideal for large environments
Mesh Network with AVNM
- All VNets connect directly
- Simplifies global connectivity
- Managed centrally with Azure Virtual Network Manager
Azure Virtual Network Features at a Glance
| Feature | Purpose |
|---|---|
| NSG | Controls inbound and outbound traffic. |
| Peering | Connects two VNets seamlessly. |
| VPN Gateway | Securely connects Azure VNets to on-premises networks. |
| ExpressRoute | High-speed, private connection to Azure. |
| Service Endpoints | Connects Azure services securely to a VNet. |
| Private Endpoints | Provides a private IP for Azure services. |
| DDoS Protection | Shields applications from DDoS attacks. |
| NAT Gateway (New) | Provides secure, scalable outbound internet connectivity. |
| DNS Private Resolver (New) | Enables hybrid DNS forwarding and Private Link DNS integration. |
| Azure Virtual Network Manager (New) | Centralizes governance, connectivity, and security for VNets. |
Benefits of Azure VNets
Security: Control traffic with NSGs, private IPs, and firewalls.
Scalability: Add more subnets or peer VNets as your needs grow.
Flexibility: Integrate on-premises networks, access Azure services securely, and design complex architectures.
Modern VNets also offer centralized governance, improved DNS integration, simplified outbound access with NAT Gateway, and enterprise-scale network automation through AVNM.
Conclusion
Azure Virtual Networks are the foundation of Azure networking. They enable secure, scalable, and flexible communication between resources. Whether hosting applications, building hybrid networks, or connecting globally, VNets provide all the tools you need.
With modern additions like Private Endpoints, DNS Private Resolver, NAT Gateway, and Virtual Network Manager, Azure networking is now more secure, more automated, and easier to scale than ever before.