Build virtual networks, peering, routes and DNS — AZ-104 Chapter 9

$ run as a normal user# run as root (or with sudo)

Skills in this chapter

Configure virtual networks, peering, routes and DNS

Plan the address space

A VNet has one or more private address ranges, split into subnets. Ranges must not overlap with other VNets or your office network if you want to connect them later.

$az network vnet create -g rg-net -n vnet-prod -l westeurope --address-prefixes 10.20.0.0/16 \
    --subnet-name snet-web --subnet-prefixes 10.20.1.0/24
$az network vnet subnet create -g rg-net --vnet-name vnet-prod -n snet-app --address-prefixes 10.20.2.0/24
$az network vnet subnet create -g rg-net --vnet-name vnet-prod -n AzureBastionSubnet --address-prefixes 10.20.250.0/26
$az network vnet subnet list -g rg-net --vnet-name vnet-prod -o table

Remember

Azure keeps 5 addresses in every subnet (the first four and the last one). A /24 has 251 usable addresses.

Exam tip

Some services need a subnet with a fixed name: AzureBastionSubnet (Bastion), GatewaySubnet (VPN gateway), AzureFirewallSubnet.

9.2

Use public IP addresses

A public IP is a resource of its own. Attach it to a NIC, a load balancer, a gateway or Bastion.

$az network public-ip create -g rg-net -n pip-lb-web --sku Standard --zone 1 2 3 --allocation-method Static
$az network public-ip list -g rg-net -o table

SKU	Notes
Standard	Static, zone-redundant possible, closed by default (needs an NSG to allow traffic)
Basic	Retired — do not use for new deployments

9.3

Connect VNets with peering

Peering connects two VNets over the Microsoft backbone, as if they were one network. It is not transitive: A↔B and B↔C does not give A↔C.

$az network vnet peering create -g rg-net -n prod-to-hub --vnet-name vnet-prod --remote-vnet vnet-hub --allow-vnet-access
$az network vnet peering create -g rg-net -n hub-to-prod --vnet-name vnet-hub --remote-vnet vnet-prod --allow-vnet-access
$az network vnet peering list -g rg-net --vnet-name vnet-prod -o table

Option	Meaning
Global peering	VNets in different regions
`--allow-forwarded-traffic`	Accept traffic forwarded by an appliance in the other VNet
`--allow-gateway-transit` / `--use-remote-gateways`	Share one VPN gateway (hub-and-spoke)

9.4

Make your own routes

Azure routes traffic between subnets by itself (system routes). A route table with user-defined routes (UDR) changes that — for example, send all internet traffic through a firewall.

$az network route-table create -g rg-net -n rt-app
$az network route-table route create -g rg-net --route-table-name rt-app -n to-internet \
    --address-prefix 0.0.0.0/0 --next-hop-type VirtualAppliance --next-hop-ip-address 10.20.100.4
$az network vnet subnet update -g rg-net --vnet-name vnet-prod -n snet-app --route-table rt-app
$az network nic show-effective-route-table -g rg-net -n vm-app1VMNic -o table

Next hop type	Sends traffic to
VirtualAppliance	An IP of a firewall or router VM
VirtualNetworkGateway	The VPN gateway
Internet	Directly out
None	Drop it

9.5

Use Azure DNS

Public DNS zones host your internet domains. Private DNS zones give names inside VNets.

$az network dns zone create -g rg-net -n example.com
$az network dns record-set a add-record -g rg-net -z example.com -n www -a 203.0.113.20
$az network private-dns zone create -g rg-net -n internal.example.com
$az network private-dns link vnet create -g rg-net -z internal.example.com -n link-prod -v vnet-prod --registration-enabled true

With auto-registration, VMs in the linked VNet get A records automatically.
Private endpoints use special private zones like privatelink.blob.core.windows.net.

9.6

Connect to the office

For a private link from the office: a VPN gateway (site-to-site VPN over the internet) or ExpressRoute (a private line from a provider).

Option	Speed	Path
Point-to-site VPN	Per user	Laptop → Azure
Site-to-site VPN	Up to several Gbit/s	Office router → VPN gateway
ExpressRoute	Up to 100 Gbit/s	Private circuit, not over the internet

All commands in this chapter

az