Choosing a DNS Resolver Option
Administrators must choose how to handle incoming DNS queries in Azure based on management overhead and control. One option is to deploy custom DNS servers on Azure virtual machines, which provides maximum control over DNS configurations but requires manual updating, patching, and scaling. A better option for most hybrid environments is the Azure DNS Private Resolver, which is a fully managed cloud service. This service integrates directly with your virtual network (VNet), scales automatically to handle query load, and requires no virtual machine management. Choose the managed resolver when you want to minimize maintenance while still maintaining secure, bi-directional name resolution.
Manage IP addressing in on-premises and hybrid scenarios
IP Address Allocation and Management
On-premises networks rely on DHCP servers to automatically assign IP addresses to devices as they connect to the network. When client devices sit on a different subnet than the DHCP server, a DHCP Relay Agent must be configured on the local router or Windows Server. The relay agent intercepts the client's broadcast request and forwards it directly to the DHCP server across subnet boundaries. To manage these addresses at scale, administrators use IP Address Management (IPAM) to monitor and audit IP address spaces across the entire hybrid infrastructure. IPAM integrates directly with your DHCP and DNS servers, providing a single console to track address utilization and prevent IP address conflicts.
Azure Virtual Network Address Planning
Unlike on-premises networks that use traditional DHCP servers, Azure virtual networks manage IP allocation natively through the Azure system. Virtual machines receive their IP addresses automatically from the defined subnet range using Azure DHCP. Administrators must carefully plan subnet sizing and address spaces to ensure there is no overlap between on-premises networks and Azure VNets. If IP address ranges overlap, routing traffic between the two environments will fail because routers cannot determine where the destination exists. Therefore, proper IP address planning is a critical dependency before establishing any physical hybrid connection.
Implement on-premises and hybrid network connectivity
Connecting On-Premises to Azure
To connect an on-premises data center to Azure, organizations choose between a Site-to-Site (S2S) VPN and Azure ExpressRoute. A Site-to-Site VPN sends encrypted traffic over the public internet using an Azure VPN Gateway and an on-premises VPN device. This option is cost-effective, quick to set up, and works well for smaller workloads or backup connections. In contrast, Azure ExpressRoute bypasses the public internet entirely, establishing a private, high-speed physical connection through a service provider. Choose ExpressRoute when your workloads demand high bandwidth, extremely low latency, and maximum security.
Routing and Remote Access Services
Windows Server can act as a connectivity hub using the Routing and Remote Access Service (RRAS) to connect different networks. Remote workers use RRAS to establish secure virtual private network connections directly to the corporate network from their personal devices. For web-based applications, the Web Application Proxy (WAP) role service can be deployed in a perimeter network to act as a reverse proxy. WAP pre-authenticates external users through Active Directory Federation Services (AD FS) before letting them access internal web servers. This structure ensures that unauthenticated internet traffic is blocked at the network boundary, protecting internal resources.
StudyCerts
StudyCerts