A virtual machine (VM) connects to an Azure virtual network using one or more virtual network interfaces. Each network interface receives an IP address configuration to handle communication with other resources. You must choose between a dynamic IP, which Azure automatically assigns from the subnet's available range, or a static IP, which you manually assign to keep the address from changing. When configuring static IPs, it is best practice to place them in isolated subnets to avoid address conflicts with dynamically assigned resources. If you need to add or remove a network interface, the VM must first be changed to the Stopped (deallocated) state.
To control the flow of traffic, a Network Security Group (NSG) acts as a firewall by filtering inbound and outbound network traffic. You can apply an NSG to an entire subnet or directly to an individual network interface, allowing you to secure traffic at different boundaries. Each NSG contains security rules defined by properties like protocol, port ranges, source and destination IP addresses, direction, and priority. Traffic is evaluated in order of priority, where lower numbers take precedence and stop further rule evaluation once a match is found. Default rules are automatically included in every NSG to provide baseline security; these rules cannot be deleted, but they can be overridden by creating custom rules with higher priority.
An Azure Load Balancer provides high availability by distributing incoming traffic across a group of virtual machines. The load balancer receives external or internal traffic through a frontend IP configuration, which serves as the single point of contact for clients. It then forwards this traffic to a backend address pool, which contains the IP addresses of the target VMs. To ensure traffic only goes to healthy VMs, a health probe continuously monitors the status of each machine in the backend pool. Finally, load-balancing rules define exactly how the traffic arriving at the frontend is mapped and sent to the backend VMs.
A system architecture diagram showing how an Azure Load Balancer uses a frontend IP, load-balancing rules, health probes, and a backend pool to distribute incoming client traffic across healthy virtual machines.
Virtual machines in an Azure network must resolve names to communicate properly with other resources. By default, VMs use Azure's built-in DNS server for name resolution, but you can also configure a custom DNS server to match your organization's active directory environment. For secure communication that extends beyond the cloud, you can connect your on-premises network to Azure. Choose a site-to-site VPN for an encrypted connection over the public internet, or choose Azure ExpressRoute when you need a private, high-speed connection that bypasses the internet entirely.
Administrators must validate network connections and troubleshoot performance issues to maintain a reliable hybrid network. Azure Network Watcher provides diagnostic tools to monitor and analyze the health of your network resources. One of its key features, the connection monitor, allows you to check connectivity and track performance metrics between VMs and other endpoints. These diagnostics help you quickly identify network bottlenecks, latency issues, or misconfigured security rules that block traffic.
Eager to master hybrid server management? Discover how to administer Windows Server Hybrid Core Infrastructure on Azure, setting your path towards the Microsoft Certified: Azure Hybrid Infrastructure Administrator Associate certification!
Prepare and test your skills
Prepare and test your skills
A dynamic IP is automatically assigned by Azure from the subnet's available range, while a static IP is manually assigned to keep the address from changing. When configuring static IPs, it is best practice to place them in isolated subnets to avoid address conflicts with dynamically assigned resources.
The VM must first be changed to the Stopped (deallocated) state before you can add or remove a network interface.
An NSG filters inbound and outbound traffic and can be applied to a subnet or individual network interface. Traffic is evaluated in order of priority, where lower numbers take precedence and stop further rule evaluation once a match is found. Default rules are automatically included and cannot be deleted, but they can be overridden by creating custom rules with higher priority.
An Azure Load Balancer consists of a frontend IP configuration that serves as the single point of contact for clients, a backend address pool containing the IP addresses of target VMs, health probes that continuously monitor the status of each VM in the backend pool, and load-balancing rules that define how traffic is mapped from the frontend to the backend VMs.
StudyCerts
StudyCerts