Dit deel is nog niet vertaald. Je ziet de Engelse tekst.
$ als gewone gebruiker# als root (of met sudo)
Vaardigheden in dit hoofdstuk
- Virtuele netwerken, peering, routes en DNS instellen
Plan the address space
A VNet has one or more private address ranges, split into subnets. Ranges must not overlap with other VNets or your office network if you want to connect them later.
az network vnet create -g rg-net -n vnet-prod -l westeurope --address-prefixes 10.20.0.0/16 \
--subnet-name snet-web --subnet-prefixes 10.20.1.0/24
az network vnet subnet create -g rg-net --vnet-name vnet-prod -n snet-app --address-prefixes 10.20.2.0/24
az network vnet subnet create -g rg-net --vnet-name vnet-prod -n AzureBastionSubnet --address-prefixes 10.20.250.0/26
az network vnet subnet list -g rg-net --vnet-name vnet-prod -o tableOnthoud
Azure keeps 5 addresses in every subnet (the first four and the last one). A /24 has 251 usable addresses.
Examentip
Some services need a subnet with a fixed name: AzureBastionSubnet (Bastion), GatewaySubnet (VPN gateway), AzureFirewallSubnet.
Use public IP addresses
A public IP is a resource of its own. Attach it to a NIC, a load balancer, a gateway or Bastion.
Connect VNets with peering
Peering connects two VNets over the Microsoft backbone, as if they were one network. It is not transitive: A↔B and B↔C does not give A↔C.
az network vnet peering create -g rg-net -n prod-to-hub --vnet-name vnet-prod --remote-vnet vnet-hub --allow-vnet-access
az network vnet peering create -g rg-net -n hub-to-prod --vnet-name vnet-hub --remote-vnet vnet-prod --allow-vnet-access
az network vnet peering list -g rg-net --vnet-name vnet-prod -o table| Option | Meaning |
|---|---|
| Global peering | VNets in different regions |
--allow-forwarded-traffic | Accept traffic forwarded by an appliance in the other VNet |
--allow-gateway-transit / --use-remote-gateways | Share one VPN gateway (hub-and-spoke) |
Make your own routes
Azure routes traffic between subnets by itself (system routes). A route table with user-defined routes (UDR) changes that — for example, send all internet traffic through a firewall.
az network route-table create -g rg-net -n rt-app
az network route-table route create -g rg-net --route-table-name rt-app -n to-internet \
--address-prefix 0.0.0.0/0 --next-hop-type VirtualAppliance --next-hop-ip-address 10.20.100.4
az network vnet subnet update -g rg-net --vnet-name vnet-prod -n snet-app --route-table rt-app
az network nic show-effective-route-table -g rg-net -n vm-app1VMNic -o table| Next hop type | Sends traffic to |
|---|---|
| VirtualAppliance | An IP of a firewall or router VM |
| VirtualNetworkGateway | The VPN gateway |
| Internet | Directly out |
| None | Drop it |
Use Azure DNS
Public DNS zones host your internet domains. Private DNS zones give names inside VNets.
az network dns zone create -g rg-net -n example.com
az network dns record-set a add-record -g rg-net -z example.com -n www -a 203.0.113.20
az network private-dns zone create -g rg-net -n internal.example.com
az network private-dns link vnet create -g rg-net -z internal.example.com -n link-prod -v vnet-prod --registration-enabled true- With auto-registration, VMs in the linked VNet get A records automatically.
- Private endpoints use special private zones like
privatelink.blob.core.windows.net.
Connect to the office
For a private link from the office: a VPN gateway (site-to-site VPN over the internet) or ExpressRoute (a private line from a provider).
| Option | Speed | Path |
|---|---|---|
| Point-to-site VPN | Per user | Laptop → Azure |
| Site-to-site VPN | Up to several Gbit/s | Office router → VPN gateway |
| ExpressRoute | Up to 100 Gbit/s | Private circuit, not over the internet |