Virtual networks & NSGs

Subnets, NSGs/ASGs, peering, gateways.

The virtual network (VNet) is the foundation of Azure networking — your isolated private network in the cloud. Designing subnets, controlling traffic with NSGs, and connecting networks are central administrator skills.

VNets, subnets, and NSGs

A VNet is your private network within a region, which you divide into subnets to segment workloads (web tier, app tier, data tier). Traffic is controlled with Network Security Groups (NSGs) — sets of priority-ordered allow/deny rules applied to subnets or network interfaces, where the lowest priority number that matches wins and return traffic is automatically allowed (stateful). Design NSG rules to permit only necessary traffic: allow the load balancer to reach the web tier, the web tier to reach the app tier, and the app tier to reach the database, while denying everything else, especially management ports (RDP/SSH) from the internet. Application Security Groups (ASGs) let you write rules against groups of VMs by role instead of IP addresses, so rules follow workloads as they scale.

VNet 10.0.0.0/16
 ├─ subnet: web   10.0.1.0/24   NSG: allow 443 from load balancer, deny else
 ├─ subnet: app   10.0.2.0/24   NSG: allow app port from web ASG only
 └─ subnet: data  10.0.3.0/24   NSG: allow DB port from app ASG only
 
# NSG rule priority: lower number = evaluated first; first match wins.
az network nsg rule create -g net-rg --nsg-name data-nsg -n allow-app-to-db \
  --priority 100 --access Allow --protocol Tcp --destination-port-ranges 5432 \
  --source-asgs app-asg --destination-asgs db-asg

Connecting networks

Administrators connect networks in several ways. VNet peering links two VNets for low-latency private connectivity over the Azure backbone — used for hub-and-spoke topologies where a central hub VNet holds shared services (firewall, DNS) and spokes connect to it. A VPN Gateway connects an on-premises network to Azure over an encrypted IPsec tunnel across the internet, while ExpressRoute provides a private, dedicated connection for higher bandwidth and reliability. For reaching Azure PaaS services privately, Private Endpoints give the service a private IP inside your VNet. The consistent theme is keeping traffic private and segmented: workloads in private subnets, NSGs allowing only necessary flows, and private connectivity to services and other networks rather than traversing the public internet.