This is an old revision of the document!
Azure Networking
Architecture
Routing
- By default a virtual network gets a route for 0.0.0.0/0 that goes to the Internet and route for each address range for the VNet that goes to the VNet (to allow inter-subnet routing by default).
- The first NIC in a VM gets a default gateway automatically, but additional NICs must be explicitly configured with a default route, see this documentation. #gotcha
Private Link
- By default Azure PaaS services are accessed by a public endpoint over the internet. The Private Link functionality provides a way to access these services over the Azure network.
- https://www.ciraltos.com/private-endpoints-and-dns-part-deux-azure-private-dns-zones/, handling DNS with Private Link
Firewall
- The default rules in a Network Security Group allow intra-subnet and intra-VNet traffic. It is generally recommended to add a higher priority rule to deny this traffic and then add specific rules for certain ports and protocols to allow access as needed.
- One option for network architecture is to make the default route for all subnets point to an Azure Firewall. This make the firewall the router for all intra-VNet and inter-VNet traffic.