When Azure resources need to send traffic to the internet, they have two main paths. Azure NAT Gateway acts as a managed service that gives each virtual machine its own public IP for outbound connections, providing up to 64,512 SNAT ports per public IP and supporting up to 16 IPs total, which makes it perfect for workloads that need to make many outbound connections at once. Azure Firewall can also handle outbound traffic through source NAT, but it offers only 2,496 SNAT ports per IP, which limits how many simultaneous outbound connections it can support. Both services work well in a hub-and-spoke network design where all outbound traffic flows through a central hub, making it easier to manage and monitor what is leaving the network.
Users reaching Azure resources from the internet need public IP addresses paired with entry points. Azure Load Balancer works at Layer 4, meaning it directs TCP and UDP traffic based on IP addresses and ports without looking at the actual content of the request, and it provides high availability by spreading traffic across healthy servers. Application Gateway operates at Layer 7, so it can examine HTTP traffic, route requests based on URL paths, terminate SSL connections to offload encryption work from backend servers, and inspect requests more deeply. When Application Gateway includes a Web Application Firewall (WAF), it adds protection by blocking common attacks like SQL injection and cross-site scripting using OWASP rule sets.
Azure Firewall policies tie security controls together by enabling threat intelligence filtering that blocks traffic to known malicious addresses, FQDN filtering that restricts which domain names resources can reach, and centralized logging that sends all connection records to Azure Monitor or Microsoft Sentinel for analysis. Adding DDoS Protection to public-facing subnets provides extra defense against distributed denial-of-service attacks that try to overwhelm resources with traffic. The firewall sits between the internet and your resources, inspecting outbound traffic before it leaves and inbound traffic before it reaches your application.
The decision between NAT Gateway and Azure Firewall depends on what matters most for the workload. Choose NAT Gateway when the primary need is handling many simultaneous outbound connections because it offers far more SNAT ports and simpler pricing based on usage. Choose Azure Firewall when traffic inspection and security policies are priorities, even though it provides fewer SNAT ports and costs more for the advanced features. Consider cost by comparing NAT Gateway's straightforward port-based pricing against Firewall's inspection and policy management fees, and plan for scalability by spreading workloads across multiple subnets if a single NAT Gateway cannot provide enough ports for all outbound traffic.
Hybrid connectivity integrates traditional on-premises data centers and private clouds with Azure resources to build highly resilient architectures. Designing these systems requires a careful balance of key metrics, including bandwidth, latency, security, cost, resiliency, scalability, and compliance. Organizations choose their connectivity model based on how these factors align with their specific enterprise workloads and regulatory needs. Selecting the correct model ensures that data flows smoothly across network boundaries while meeting organizational standards.
For cost-effective connections where higher latency is acceptable, Azure VPN Gateway provides secure paths over the public internet using IPsec and IKE protocols. This service supports both site-to-site and point-to-site connections, making it highly suitable for secure remote access and hybrid applications with moderate throughput needs. To maximize availability, the gateway can configure active-active tunnels that deliver redundant paths for traffic. Additionally, route-based VPN configurations use Border Gateway Protocol (BGP) to enable dynamic routing and automated path updates across the encrypted tunnels.
When workloads demand dedicated paths with low latency and high bandwidth, Azure ExpressRoute bypasses the public internet by establishing private circuits to Azure datacenters. This private architecture separates traffic into private peering for internal resources and Microsoft peering for public cloud services. High-demand enterprise environments can deploy ExpressRoute Direct to achieve massive throughput scaling up to 100 Gbps. Routing relies on BGP, allowing engineers to control traffic flow and failover paths by adjusting parameters like connection weight, AS path prepending, or advertising more specific prefixes.
Azure Virtual WAN simplifies complex network designs by creating a unified hub-and-spoke architecture that connects branches, users, and datacenters. It acts as a global transit network, integrating VPN Gateway, ExpressRoute, and SD-WAN into a single managed operational interface. The system automates routing, BGP propagation, and built-in redundancy across full-mesh virtual hubs. It scales dynamically, supporting up to 100,000 remote user VPNs and leveraging Equal-Cost Multi-Path (ECMP) load balancing to distribute traffic evenly across multiple active tunnels.
Creating resilient hybrid architectures requires deliberate design of BGP-based routing and failover strategies. Network architects configure active-active connections to halve the overall impact of a physical circuit or gateway failure. To enforce a primary path over a secondary one, the primary circuit can advertise more specific route prefixes. Alternatively, engineers can configure connection weights or use AS path prepending on the secondary path to make it less appealing to routing algorithms during normal operations.
Azure Monitor and Network Watcher provide the telemetry you need to pinpoint latency and throughput bottlenecks across Azure networks. Network Performance Monitor helps you track reachability to services like Microsoft 365 and captures detailed performance metrics. By analyzing network traffic patterns, you can identify hotspots before they affect applications. Establish a performance baseline using built-in tests and logs, then track deviations to find where delays or drops occur.
Traffic Analytics is a cloud-based solution that analyzes NSG Flow logs to give you deep visibility into network activity. It surfaces traffic flows between Azure, the internet, and peered networks, identifies top talkers and chatty applications without needing packet sniffers, and shows capacity utilization of VPN gateways and other services. These insights let you audit network activity, secure workloads, and optimize performance by resizing or redistributing traffic.
DNS Analytics collects and correlates DNS logs to provide security, operations, and performance insights. It identifies clients resolving to malicious domains, detects stale resource records, and monitors DNS query loads and registration failures. This service helps you maintain DNS reliability and reduce lookup latency by uncovering misconfigurations or attacks before they cause problems.
ExpressRoute Insights through Network Insights gives you a unified view of your private circuits with detailed topology and metrics dashboards. You can visualize functional dependencies across peerings and gateways, track Availability (ARP/BGP), Throughput (ingress/egress), Packet Drops, and Gateway Metrics, and navigate linked resources to drill into data in real time. These metrics help you design resilient architectures and meet stringent SLAs for throughput and availability.
When designing network solutions, compare the features and SLAs of services such as Azure CDN, Front Door, Traffic Manager, Load Balancer, and ExpressRoute to align with your performance and resilience requirements. Use an integrated deployment that leverages global load-balancing for low latency, private connectivity for consistent throughput, and edge caching to offload origin servers. By combining these services and tailoring configurations based on telemetry, you can achieve predictable latency, high availability, and optimal network performance.
Azure network security uses a layered approach, often called defense-in-depth, where different services protect at different levels of the network. This starts with the Virtual Network (VNet), which creates a private, isolated boundary for your resources. Within the VNet, you apply Network Security Groups (NSGs) directly to subnets or network interfaces to perform basic, stateful packet filtering based on IP addresses and ports. For broader perimeter security, you deploy Azure Firewall as a centralized, managed service that can enforce more complex rules across multiple VNets and inspect traffic from Layer 3 (network) up to Layer 7 (application).
Choosing and placing the right security service depends on the specific threat you need to mitigate and the workload's requirements. Use NSGs for simple, low-cost filtering right at the subnet or VM level. Deploy Azure Firewall when you need a centralized policy for an entire network, advanced threat intelligence, or intrusion detection. For any public-facing endpoint on a VNet, you should enable Azure DDoS Protection Standard to automatically detect and mitigate large-scale volumetric attacks. To protect web applications specifically, you place an Application Gateway with its Web Application Firewall (WAF) in front of your web servers to inspect HTTP/HTTPS traffic for common web exploits.
Optimizing Azure Firewall involves selecting the correct SKU and tuning its rules for performance and cost. The Basic SKU offers simple filtering, the Standard SKU adds threat intelligence feeds, and the Premium SKU provides signature-based intrusion detection and prevention. You optimize rule sets by creating explicit application rules for high-priority traffic first, enabling threat intelligence to block known malicious IPs, and managing throughput by scaling the firewall instance size or enabling autoscaling based on traffic load.
For the Application Gateway WAF, optimization starts by running it in Detection mode to establish a baseline of normal traffic without blocking. Once you understand the traffic patterns, you switch to Prevention mode to actively block identified threats. You can customize its protection by applying managed OWASP core rule sets, enabling bot protection, and creating custom rules for specific needs like geo-filtering or rate limiting. To maintain application performance, you create exclusions for trusted traffic patterns that cause false positives, ensuring the WAF protects effectively without unnecessary disruption.
A complete security solution integrates all these services, with their configurations aligned to meet compliance standards and budget limits. Centralized logging to services like Azure Monitor allows you to continuously evaluate the effectiveness of your NSG, Firewall, DDoS, and WAF configurations. You use this data to adjust rule sets, scale throughput, and ensure the overall network security posture remains resilient and cost-effective against evolving threats.
Azure offers four main services that move user traffic to the right resources: Azure Load Balancer, Application Gateway, Traffic Manager, and Front Door. Each service works at a different level of the networking model and handles different types of traffic. Choosing the right one depends on whether you need to balance traffic within a single region, protect a web application, or route users across the world.
Azure Load Balancer operates at Layer 4 of the networking model, which means it handles TCP and UDP traffic without looking at what the data actually says. It delivers high throughput with low latency and can distribute traffic across virtual machines within a single region. The service includes health probes that check whether each backend server is working; if a server fails its check, the load balancer stops sending traffic to it. Azure Load Balancer does not terminate SSL connections or provide session affinity beyond basic source IP tracking.
Application Gateway works at Layer 7, which means it can understand HTTP and HTTPS requests and make routing decisions based on the URL path, host header, or other application-level information. This service terminates SSL connections at the gateway, which offloads the encryption work from your backend servers and improves performance. It supports cookie-based session affinity, ensuring that a user who logs in continues talking to the same server during their session. Application Gateway also includes a Web Application Firewall that blocks common attacks like SQL injection and cross-site scripting.
Traffic Manager is a DNS-based routing service that does not proxy traffic between users and your resources. Instead, it responds to DNS queries with the IP address of the best endpoint based on routing methods like priority, weighted round-robin, performance, or geographic location. When one region fails, Traffic Manager can direct users to a backup region automatically, providing cross-region failover without maintaining active connections. Because it only handles DNS lookups, it adds minimal latency and works with any type of backend service.
Front Door is a global HTTP/HTTPS reverse proxy that terminates TLS connections at edge locations close to users. It combines traffic routing, SSL offloading, caching for static content, and Web Application Firewall protection in a single service. Front Door can accelerate both dynamic and static content by serving cached files from edge locations while forwarding application requests to the nearest healthy backend. Like Traffic Manager, it provides cross-region routing but does so by proxying requests rather than simply returning DNS records.
The decision between these services follows a clear pattern based on your requirements. Use Azure Load Balancer when you need to distribute UDP or TCP traffic at high scale within a single region and do not require SSL termination or application-layer routing. Choose Application Gateway when building a web application that needs SSL offloading, cookie-based sessions, path-based routing, or WAF protection. Select Traffic Manager for DNS-level failover across regions when you want simple, low-latency routing without proxying. Pick Front Door when you need global HTTP routing with caching, TLS termination at the edge, and built-in security at scale.
A decision tree that branches based on traffic type, geographic scope, and protocol to choose between Azure Load Balancer, Application Gateway, Traffic Manager, and Front Door.
Venture into the world of Azure Infrastructure, where design meets functionality. Harness your skills and gain mastery over complex cloud structures to ace the AZ-305 Designing Microsoft Azure Infrastructure Solutions exam!
Prepare and test your skills
Prepare and test your skills
Azure NAT Gateway provides up to 64,512 SNAT ports per public IP and is designed for handling many simultaneous outbound connections, while Azure Firewall offers only 2,496 SNAT ports per IP but includes traffic inspection and security policies. Choose NAT Gateway for high-volume outbound connections and simpler pricing, and choose Azure Firewall when security inspection and advanced policies are the priority.
Use Azure Application Gateway when you need Layer 7 (HTTP/HTTPS) routing, SSL termination, cookie-based session affinity, or Web Application Firewall (WAF) protection for your web applications. Use Azure Load Balancer for high-throughput Layer 4 (TCP/UDP) traffic distribution within a single region without application-level inspection.
Azure ExpressRoute provides dedicated private circuits with low latency and high bandwidth, bypassing the public internet, and is suitable for high-demand enterprise workloads. Azure VPN Gateway provides secure connections over the public internet using IPsec and IKE protocols, is more cost-effective, and is suitable for moderate throughput needs where higher latency is acceptable.
StudyCerts
StudyCerts