Virtual Networks

5.1 Azure Virtual Network Architecture

Azure Virtual Network (VNet) is the foundational networking service that enables secure communication between Azure resources, on-premises systems, and the internet. A VNet provides logical isolation in the cloud, similar to a traditional on-premises network. It is divided into subnets that help organize resources and enforce security boundaries. VNets support private IP addressing, routing, network security groups, and service endpoints. By default, Azure handles routing between subnets, but custom route tables can be introduced for advanced traffic control. VNets also integrate with Azure services such as load balancers, gateways, and private endpoints to enable secure and scalable architectures.

An enterprise deploys its application across multiple subnets within a single virtual network. Frontend services reside in a public subnet, while backend services and databases are placed in private subnets. Network security groups restrict access so that only required traffic is allowed. Internal communication occurs over private IPs, preventing exposure to the internet. The architecture improves security, organization, and scalability.

Use Cases
• Secure application networking
• Isolation of workloads
• Hybrid cloud connectivity
• Private access to Azure services

5.2 Connectivity Services

Load Balancers and VPN Gateways

Azure connectivity services enable reliable communication within and outside Azure networks. Azure Load Balancers distribute incoming traffic across multiple backend resources to ensure high availability and performance. They operate at the transport layer and support both internal and public scenarios. VPN Gateways allow encrypted communication between Azure VNets and on-premises networks or other VNets using standard tunneling protocols. These services form the backbone of hybrid and scalable cloud architectures, ensuring traffic resilience and secure connectivity.

A company hosts its application on multiple virtual machines behind an Azure Load Balancer. Incoming requests are evenly distributed, ensuring no single VM is overloaded. The company also connects its on-premises data center to Azure using a VPN Gateway. Data travels securely over encrypted tunnels. Employees access cloud resources as if they were on the local network. This setup ensures performance, availability, and security.

Use Cases
• High-availability applications
• Hybrid cloud connectivity
• Secure site-to-site communication
• Traffic distribution and fault tolerance