This chapter will take you through the architecture of Azure Virtual Network (VNet). Then, Azure service endpoints will be introduced, and how to work with them.

Since Azure VNet works with almost all Azure services, you will be introduced to how Azure VNet integrates with Azure services, followed by virtual network peering, which will show you how to expand your connection to other virtual networks. After that, you will learn about best practices to secure your virtual networks in Azure. Finally, you will learn how to automate all the manual tasks implemented throughout the chapter.

The following topics will be covered in this chapter:

• Understanding Azure VNet architecture...

Understanding a concept and learning how to do a specific task is very fulfilling for most people who are seeking to learn something. However, this section will take you beyond that and will introduce what is going on behind the scenes, what Microsoft uses to get its Azure networking to work properly, and so on.

Microsoft Azure mainly takes advantage of Software-Defined Networking (SDN) for the internal operations of Azure, but this is not the case for the case when the customers work with Azure as they are communicating with Azure via the internet most of the time, which is called the edge. In this part of the network, Microsoft uses physical networking.

Put simply, the concept of using virtual networks with subnets and virtual network gateways is running on the backbone of Azure. However, on the edge physical network devices, such...

Since Microsoft launched Azure, we communicate with most of the Azure services via the internet. For example, when you want to connect to Azure SQL databases, you can only connect with it via internet, but when using service endpoints you can connect it using an Azure VM taking the advantage of Microsoft backbone network.

So, what if you could communicate with Azure services using the Microsoft Azure backbone network. This would be interesting, right?

That is what virtual network service endpoints do. They create a direct connection to the service you want to communicate with via the virtual network where you have enabled service endpoints. Doing so will ensure that all the traffic between your data center and Azure service is done via the Microsoft network backbone.

At the time of writing, this feature in preview only supports Azure SQL Database and...

At the time of writing, Microsoft provides a wide variety of services, such as Azure VMs, Service Fabric, HDInsight, Redis Cache, and so on.

Can you imagine using any of these services without communicating with it to either get your tasks done or manage it yourself?

Of course you cannot, because what is the point of buying these services then? That is why you will be using virtual networks to provide a communication method to most of your services.

Azure VNet can be integrated with other services, either by assigning your Azure service to a virtual network, as is the case in Azure VMs when you want to assign the VMs you are going to build to a specific virtual network, or by extending your virtual network to a specific service by using virtual network service endpoints.

I've been working with Azure since 2012 and guess what? I can confirm that you will be using more than one virtual network for all your Azure services and when you create another virtual network, a situation may arise when you would need to let the resources in each virtual network to communicate with each other.

As you know, by default, virtual networks are isolated and cannot communicate with each other. However, with virtual network, peering it is no longer an issue.

Configuring virtual network peering is a very straightforward process. To do so, you can follow these steps:

1. Navigate to Virtual networks, and open the blade of one of the virtual networks that...

The most common question that anyone asks when they buy a service is, can it be secured? The answer to that question in this case is, absolutely yes.

Besides the security Microsoft provides for Azure from its side, there is some configuration that you can do from your side to increase the level of security to your virtual network.

For a higher level of security, you can use the following:

• NSG: It is like a firewall that controls the inbound and outbound traffic by specifying which traffic is allowed to flow to/from the NIC/subnet
• Distributed denial of service (DDoS) protection: It is used to prevent DDoS attacks and at the time of writing is in preview

NSG controls the flow of traffic by specifying...

 Finally, we have reached the point of automating the manual tasks that have been implemented so far.

Adding a service endpoint to an existing virtual network is pretty straightforward. All you need to do is run the following cmdlet:

Get-AzureRmVirtualNetwork -ResourceGroupName PacktPub -Name PSVNet | Set-AzureRmVirtualNetworkSubnetConfig -Name NSubnet  -AddressPrefix "192.168.1.0/24" -ServiceEndpoint "Microsoft.Storage" | Set-AzureRmVirtualNetwork