CH20-03: Networking and Edge Services
Goal
Networking and edge services define how systems connect, what stays isolated, where traffic enters, and where traffic is inspected. In Azure, networking design is rarely only about IP addresses. It is about communication paths, trust boundaries, DNS, routing, edge behavior, hybrid connectivity, and operational visibility.
The durable idea is:
Networking services define intentional communication paths and protection boundaries.
The Short Version
Start by naming the path:
| Need | Common Azure Direction |
|---|---|
| Private workload network | Virtual Network and subnets. |
| Subnet or NIC traffic filtering | Network Security Groups. |
| Custom routing path | Route tables. |
| Central inspection and egress control | Azure Firewall or network virtual appliance pattern. |
| Private access to a platform service | Private Endpoint with Private DNS. |
| Hybrid private connectivity | ExpressRoute or VPN Gateway. |
| Public web ingress with regional WAF | Application Gateway with WAF. |
| Global HTTP edge | Azure Front Door. |
| Layer 4 load distribution | Azure Load Balancer. |
| DNS-based global traffic steering | Traffic Manager. |
Service Reference
| Service | Purpose | Use When | Avoid When | Common Prompt |
|---|---|---|---|---|
| Virtual Network | Private network boundary for Azure resources. | Workloads need private address space, subnet placement, peering, hybrid connectivity, or private service access. | The service is fully public and does not need private integration. | What private network does this workload live in? |
| Subnets | Segmented placement areas inside a VNet. | You need to separate tiers, apply NSGs, route traffic, or place private endpoints and platform integrations. | You use them only as naming folders without considering security and routing. | Which resources share a network boundary? |
| Network Security Groups | Stateful traffic filtering at subnet or NIC level. | You need allow and deny rules for inbound or outbound traffic near workloads. | You need centralized inspection, TLS inspection, or advanced firewall policy. | What traffic is allowed here? |
| Route tables | User-defined routing for traffic paths. | You need traffic to flow through a firewall, appliance, hub, or custom route. | You are trying to block traffic; filtering belongs in NSGs or firewall policy. | Where should packets go next? |
| Azure Firewall | Managed network firewall for centralized inspection and policy. | You need controlled egress, network/application rules, threat intelligence, or hub inspection. | A simple subnet-level allow or deny rule is enough. | Where is traffic inspected? |
| Private Endpoint | Private IP interface to a supported Azure platform service. | You want access to a platform service over private IP rather than public endpoint exposure. | You have not planned DNS, routing, and authorization. | How does the workload reach this service privately? |
| Private Link | Platform capability behind private endpoint access patterns. | You expose or consume supported services privately across network boundaries. | You expect it to replace identity or application authorization. | Should this service be reachable through a private endpoint? |
| VPN Gateway | Encrypted connectivity over the public internet. | You need site-to-site, point-to-site, or lower-cost hybrid connectivity. | You need predictable private connectivity with enterprise-grade throughput and SLA expectations. | Is internet-based encrypted hybrid connectivity enough? |
| ExpressRoute | Private connectivity between on-premises or provider networks and Azure. | You need private, predictable, enterprise hybrid connectivity. | Cost, lead time, or operational complexity outweighs the requirement. | Does this workload need private dedicated connectivity? |
| Azure DNS | Public DNS hosting for domains. | Azure should host public DNS zones. | You need private VNet name resolution; use Private DNS zones. | Who hosts public name resolution? |
| Private DNS zones | Private name resolution for VNets. | Private endpoints or internal services need private DNS resolution. | You use private IPs manually and ignore name resolution. | How do private names resolve correctly? |
| Application Gateway with WAF | Regional Layer 7 web ingress and web application firewall. | You need regional HTTP routing, TLS termination, path routing, and WAF near workloads. | You need global edge acceleration and anycast entry; consider Front Door. | Where is regional web ingress controlled? |
| Azure Front Door | Global HTTP/HTTPS edge, routing, acceleration, and WAF. | You need global entry, edge routing, performance, failover, and WAF for web applications. | You only need private regional load balancing. | Where should global users enter? |
| Azure Load Balancer | Layer 4 load distribution. | You need TCP/UDP load balancing for VMs or internal services. | You need HTTP routing, WAF, or path-based decisions. | Is this Layer 4 distribution? |
| Traffic Manager | DNS-based traffic steering. | You need simple global routing by DNS response, such as priority or performance routing. | You need proxy-based HTTP edge features, TLS termination, or WAF. | Is DNS steering enough? |
Commonly Confused Services
| Comparison | Short Answer |
|---|---|
| NSG vs route table | NSGs decide whether traffic is allowed; route tables decide where traffic goes. |
| Private Endpoint vs service firewall rule | Private Endpoint gives private IP access; firewall rules still need identity, network, and service configuration discipline. |
| Front Door vs Application Gateway | Front Door is a global HTTP edge; Application Gateway is regional Layer 7 ingress with WAF. |
| Load Balancer vs Application Gateway | Load Balancer works at Layer 4; Application Gateway works at Layer 7 HTTP. |
| Traffic Manager vs Front Door | Traffic Manager steers DNS responses; Front Door proxies HTTP traffic at the global edge. |
| VPN Gateway vs ExpressRoute | VPN uses encrypted internet connectivity; ExpressRoute provides private connectivity through a provider. |
Architecture Patterns
Networking services often appear in these patterns:
Hub-spoke networking with shared inspection, DNS, and hybrid connectivity.
Private access to platform services with Private Endpoint and Private DNS.
Global web entry with Front Door and regional workload ingress behind it.
Regional web ingress with Application Gateway and WAF.
Hybrid connectivity with ExpressRoute or VPN Gateway.
Segmented workload networks with subnets, NSGs, route tables, and firewall policy.
Cloud Comparison
AWS and GCP users will recognize familiar responsibilities: VPC/VNet boundaries, subnets, route tables, security groups or firewall rules, load balancers, private service access, DNS, and hybrid connectivity. The names differ, but the design method is familiar: define the path, the trust boundary, the inspection point, and the failure behavior.
Do not stop at "what is the equivalent?" For Azure, pay special attention to private endpoint DNS, subscription and VNet boundaries, hub-spoke routing, and where public edge services terminate traffic.
Common Mistakes
Treating VNet peering as permission for every workload to communicate freely.
Adding private endpoints without private DNS planning.
Choosing an edge service by name rather than traffic shape.
Confusing routing decisions with security filtering.
Using public ingress because it is easier, even when private access is a requirement.
Forgetting observability for network paths, DNS failures, and firewall denies.
If Someone Asks You
Which Azure networking services should I remember first?
A good answer is:
Remember the path responsibilities. VNets and subnets create private placement boundaries, NSGs filter traffic, route tables shape paths, Azure Firewall inspects centrally, Private Endpoint and Private DNS provide private access to platform services, VPN Gateway and ExpressRoute connect hybrid environments, and Front Door, Application Gateway, Load Balancer, and Traffic Manager handle different edge and traffic-management needs.
What You Should Remember
Networking choices decide what can connect, what stays isolated, and where traffic is inspected or exposed.
Questions to Check Understanding
How are NSGs and route tables different?
Why does Private Endpoint require DNS design?
How do Front Door and Application Gateway differ at a high level?