You're a great admin... on-prem. Now, become a great admin in the cloud and prove it by passing the Microsoft Certified: Azure Administrator Associate exam!
Gauge your current knowledge
Gauge your current knowledge
In Azure, standard troubleshooting tools like ping and nslookup often do not work due to security constraints. Instead, you use the nameresolver.exe tool to test name resolution from within an app service to check if it can reach its DNS server. DNS queries typically timeout after 3 seconds per server. Common failures stem from incorrect Azure Private DNS zones settings or blocked access to the Azure platform's virtual IP address, 168.63.129.16, which is essential for core services.
Hybrid connectivity relies on Azure VPN Gateway and ExpressRoute to bridge on-premises networks with Azure. Troubleshooting involves verifying the MSEE (Microsoft Enterprise Edge) is reachable and that BGP routes are propagating correctly. Key checks include ensuring Shared Keys match exactly on both sides of a VPN, confirming the gateway resource is in a Provisioned and Succeeded state, and verifying that on-premises address ranges are correctly defined in Azure route tables. Mismatched parameters or expired certificates often cause tunnel failures, which can sometimes be resolved using the Sync Network feature.
Systematic troubleshooting requires leveraging Network Watcher to analyze diagnostic data. Tools like tcpping and the PowerShell command Test-NetConnection help determine if a specific port is reachable, isolating whether the problem is at the network layer or an application. These tools are crucial for diagnosing complex issues where traffic flow is interrupted by intermediate devices or policies.
Network Security Groups (NSGs) act as distributed firewalls, filtering traffic based on a 5-tuple rule (source/destination IP, port, and protocol). For inbound traffic, rules are evaluated first at the subnet level and then at the network interface (NIC) level. For outbound traffic, the order is reversed: the NIC rules are processed first, then the subnet rules. A Deny rule at either level will drop the traffic, so you must check both sets of Effective Security Rules.
Azure Firewall provides centralized, stateful traffic protection across multiple virtual networks. Unlike NSGs, it can filter traffic using Fully Qualified Domain Names (FQDNs) and built-in threat intelligence. When implementing changes, you must understand rule priority to prevent conflicts between application and network rules, which could block legitimate traffic. Its policies are managed at a higher level and apply to all traffic flowing through the firewall.
Route Tables and User-Defined Routes (UDRs) override Azure's default system routing to control traffic paths. A common issue is forced tunneling, where a default route (0.0.0.0/0) sends all internet-bound traffic to an on-premises network or a Network Virtual Appliance (NVA). For NVAs to forward traffic correctly, IP forwarding must be enabled on their network interface. Misconfigured routes can lead to asymmetric routing, where traffic takes one path out and a different path back, causing failures.
To fix connectivity issues, use Network Watcher tools. IP Flow Verify checks if a specific packet is allowed or denied by existing rules. Next Hop shows where traffic is routed next, revealing misconfigured routes. Effective Routes displays the actual routing table for a NIC. You should also verify that Service Tags and Application Security Groups (ASGs) are correctly applied to simplify rule management and avoid human error. Regular audits of effective rules help prevent legacy configurations from creating security gaps or blocking application traffic.
Azure Network Watcher provides the Connection Monitor tool for continuous connectivity and performance monitoring between endpoints, such as from a virtual machine to another resource. You configure a monitor between a source and destination, and it analyzes results for disruptions, latency, or packet loss. This helps you identify whether an issue is intermittent or persistent and guides your troubleshooting steps.
The Packet Capture feature allows you to capture raw network traffic from a VM's network interface for deep analysis. You configure a capture session over a specified time or based on a trigger, such as a specific volume of traffic. The captured data files can then be downloaded and analyzed with tools like Wireshark to pinpoint the root cause of complex issues, such as malformed packets or unexpected protocol behavior.
Network performance monitoring involves collecting metrics like latency, throughput, and packet loss from various network components. By analyzing these trends over time, you can identify potential bottlenecks or degradation before they cause user-impacting outages. This data informs optimization efforts, such as resizing gateways or adjusting routing to improve the overall health and reliability of your Azure network.
StudyCerts
StudyCerts