# PART 2: NETWORKING SERVICES

---

## 2.1 Azure Virtual Network (VNet)

### Overview
Your private network in Azure. Fundamental building block — all IaaS/PaaS resources connect here.

### Key Concepts
- **Address Space** — CIDR blocks (e.g., 10.0.0.0/16). Up to 65,536 IPs per VNet.
- **Subnets** — Segments within VNet. Smallest /29 (3 usable IPs).
- **NSGs** — L3/L4 firewall on subnet or NIC. Priority 100-4096 (lower = higher priority).
- **ASGs** — Logical grouping of VMs for simpler NSG rules.
- **Route Tables (UDR)** — Custom routing. Next hop: Virtual Appliance, VNet Gateway, Internet, None.
- **Service Endpoints** — Extend VNet identity to PaaS services. Traffic stays on Azure backbone.
- **Private Endpoints** — Private IP in your VNet for PaaS services. No public internet.

### VNet Peering
- Connect VNets (same region or cross-region)
- Traffic stays on Microsoft backbone
- **NOT transitive** — If A↔B and B↔C, A cannot reach C
- Gateway Transit — Peered VNet can use your VPN/ExpressRoute gateway
- Charge for ingress/egress across peering

### Interview Q&A
**Q: Is VNet peering transitive?**
A: No. Hub-spoke uses hub VNet peered with each spoke. Spokes don't communicate directly. Use Azure Firewall/NVA in hub for spoke-to-spoke.

**Q: Service Endpoint vs Private Endpoint?**
A: Service Endpoint = VNet identity extends to service, service still has public endpoint. Private Endpoint = private IP in VNet, no public endpoint. Private Endpoint preferred for zero-trust.

---

## 2.2 Azure Load Balancer

### Overview
L4 (TCP/UDP) load balancer. High-performance, low-latency.

### SKUs
| Feature | Basic | Standard |
|---|---|---|
| Backend pool | Availability Set only | Any VM, IP, cross-VNet |
| HA Ports | No | Yes (internal LB) |
| Availability Zones | No | Zone-redundant/zonal |
| SLA | None | 99.99% |

### Types
- **Public Load Balancer** — Distributes inbound internet traffic
- **Internal Load Balancer** — Distributes traffic within VNet

### Key Concepts
- **Frontend IP** — Public or private IP receiving traffic
- **Backend Pool** — VMs/NICs/IPs receiving traffic
- **Health Probes** — HTTP/TCP probes. Unhealthy = removed from rotation
- **Load Balancing Rules** — Map frontend IP:port → backend pool:port
- **NAT Rules** — Port forwarding (RDP/SSH)
- **HA Ports** — Load balance all ports (internal LB, Standard only). For NVAs.
- **Outbound Rules** — Control SNAT for outbound internet

### Interview Q&A
**Q: Load Balancer vs Application Gateway?**
A: LB = L4, any protocol, max performance. App Gateway = L7 (HTTP/HTTPS), WAF, SSL termination, URL routing. Use LB for non-HTTP; App Gateway for web apps.

---

## 2.3 Azure Application Gateway

### Overview
L7 (HTTP/HTTPS) load balancer with WAF.

### Key Features
- URL-based routing, multi-site hosting
- SSL Termination, Session Affinity (cookie-based)
- WAF — OWASP Top 10 protection (CRS 3.2+)
- Connection Draining, Header Rewrites
- Autoscaling (v2 SKU)

### SKUs
| SKU | Scaling | WAF | Zone Redundancy |
|---|---|---|---|
| Standard v1 | Manual | No | No |
| WAF v1 | Manual | Yes | No |
| Standard v2 | Auto | No | Yes |
| WAF v2 | Auto | Yes | Yes |

### Interview Q&A
**Q: App Gateway vs Front Door?**
A: App Gateway = regional L7 LB. Front Door = global L7 LB with anycast. Use App Gateway for regional; Front Door for global/multi-region. Many use Front Door → App Gateway (global + regional WAF).

**Q: App Gateway to App Service?**
A: Yes, but set "Pick host name from backend target" in HTTP settings.

---

## 2.4 Azure Front Door

### Overview
Global L7 load balancer and CDN. Anycast-based routing across regions.

### Key Features
- Global routing to nearest backend
- SSL Termination at edge, WAF at edge
- URL-based routing, Session Affinity
- Caching, Health Probes
- Traffic acceleration (anycast + split TCP + Microsoft backbone)

### Front Door vs Traffic Manager
| Feature | Front Door | Traffic Manager |
|---|---|---|
| Layer | L7 (HTTP/HTTPS) | DNS-based |
| Failover speed | Seconds | Minutes (DNS TTL) |
| Caching/WAF/SSL | Yes | No |

---

## 2.5 Azure VPN Gateway

### Overview
Encrypted traffic between VNet and on-prem over public internet.

### Types
- **Policy-based** — Legacy, low bandwidth (~100 Mbps)
- **Route-based** — Modern, up to 10 Gbps, BGP support

### Connection Types
- **Site-to-Site (S2S)** — On-prem network to VNet (IPsec/IKE)
- **Point-to-Site (P2S)** — Individual client (IKEv2, SSTP, OpenVPN)
- **VNet-to-VNet** — Connect VNets via IPsec

### Key Concepts
- **GatewaySubnet** — Must be named exactly "GatewaySubnet". Min /29.
- **Local Network Gateway** — Represents on-prem VPN device
- **BGP** — Dynamic routing on route-based gateways
- **Active-Active** — Two gateway instances for higher throughput/redundancy

### Interview Q&A
**Q: VPN Gateway vs ExpressRoute?**
A: VPN = internet, encrypted, up to 10 Gbps, quick setup, cheap. ExpressRoute = private, up to 100 Gbps, consistent latency, expensive, weeks to provision.

---

## 2.6 Azure ExpressRoute

### Overview
Private, dedicated connection to Azure. Not over public internet.

### Peering Types
- **Azure Private Peering** — Access Azure VNets
- **Microsoft Peering** — Access Microsoft public services (M365, etc.)

### Key Features
- Bandwidth: 50 Mbps to 100 Gbps
- Two connections per circuit (primary + secondary) for redundancy
- **ExpressRoute Global Reach** — Connect on-prem locations via Microsoft backbone
- **ExpressRoute Direct** — 100 Gbps, dual ports at peering location
- **Standard** = regions in geopolitical area; **Premium** = all global regions

### Interview Q&A
**Q: How to achieve ExpressRoute redundancy?**
A: Each circuit has 2 connections. For full redundancy, use 2 circuits at different peering locations. VPN Gateway can serve as failover.

---

## 2.7 Azure Firewall

### Overview
Cloud-native, managed, stateful firewall. L3-L7 filtering.

### SKUs
| Feature | Standard | Premium |
|---|---|---|
| Network/Application rules | Yes | Yes |
| DNAT | Yes | Yes |
| TLS Inspection | No | Yes |
| IDPS | No | Yes |
| URL filtering / Web categories | No | Yes |

### Key Features
- **Network Rules** — L3/L4 (IP, port, protocol)
- **Application Rules** — L7 (FQDN filtering)
- **NAT Rules** — DNAT for inbound access
- **Threat Intelligence** — Block known malicious IPs
- **DNS Proxy** — Forward DNS queries, enable FQDN in network rules
- **Azure Firewall Manager** — Central policy across multiple firewalls

### Deployment
- Dedicated "AzureFirewallSubnet" (min /26)
- Hub-spoke: Firewall in hub, UDR on spokes routes through it
- Force traffic: UDR 0.0.0.0/0 → Firewall private IP

---

## 2.8 Azure DNS

### Overview
DNS hosting. 100% SLA. Ultra-fast resolution.

- **Azure DNS Zones** — Host DNS records for your domain
- **Private DNS Zones** — Internal DNS. Link to VNets. Auto-registration for VMs.
- **Alias Records** — Point to Azure resources. Auto-updates when IP changes.
- Record types: A, AAAA, CNAME, MX, NS, PTR, SOA, SRV, TXT

---

## 2.9 Azure Private Link & Private Endpoint

### Overview
Access PaaS services over private IP in your VNet. Zero public internet exposure.

### Private Endpoint
- Network interface with private IP in VNet
- Maps to Azure resource (Storage, SQL, Cosmos DB, Key Vault, App Service, etc.)
- 100+ services supported
- Works across tenants

### Private Link Service
- Expose your own service (behind Standard LB) via Private Link
- Consumers access via private endpoints in their VNets
- For SaaS providers offering private connectivity

### Interview Q&A
**Q: Private Endpoint vs Service Endpoint?**
A: Service Endpoint = traffic on Azure backbone but service has public endpoint. Private Endpoint = private IP, no public endpoint. Private Endpoint is zero-trust choice.

---

## 2.10 Network Security Groups (NSGs)

### Overview
L3/L4 firewall on subnet or NIC.

### Rule Properties
- Priority: 100-4096 (lower = higher priority)
- Direction: Inbound/Outbound
- Source/Destination: IP, CIDR, Service Tag, ASG
- Protocol: TCP, UDP, ICMP, Any
- Action: Allow or Deny

### Default Rules
- Allow VNet inbound/outbound
- Allow Azure Load Balancer inbound
- Deny all other inbound
- Allow all outbound

### Service Tags
VirtualNetwork, AzureLoadBalancer, Internet, Storage, Sql, AppService, AzureCloud

### Flow Logs
Log all traffic to Storage Account. Feed into Traffic Analytics for visualization.

### Interview Q&A
**Q: NSG on both subnet and NIC — evaluation order?**
A: Inbound: Subnet first, then NIC. Outbound: NIC first, then Subnet. Both must allow; either deny = blocked.

---

## 2.11 Azure Traffic Manager

### Overview
DNS-based global traffic routing.

### Routing Methods
| Method | How It Works |
|---|---|
| **Priority** | Primary then failover |
| **Weighted** | Distribute by weight (e.g., 80/20) |
| **Performance** | Route to closest (lowest latency) |
| **Geographic** | Route by user location |
| **Subnet** | Route specific IP ranges to specific endpoints |
| **Multi-value** | Return multiple endpoints |

### Limitation
DNS-based = failover depends on DNS TTL (not instant). For HTTP, prefer Front Door.

---

## 2.12 Azure Virtual WAN

### Overview
Unified global networking for branch connectivity.

- **Hub** — Microsoft-managed VNet with gateways
- **Spokes** — VNets connected to hub
- **Branches** — On-prem via VPN/ExpressRoute
- Inter-hub routing, integrated Azure Firewall, SD-WAN partner integration

---

## 2.13 Azure Bastion

### Overview
Managed RDP/SSH access to VMs without public IPs. Deploys in AzureBastionSubnet.

- No public IP on VMs needed
- RDP/SSH over TLS in browser
- No agent on VMs
- Standard and Premium SKUs

---

## 2.14 Azure CDN

### Overview
Content delivery network. Cache content at edge locations worldwide.

- Providers: Microsoft, Akamai, Verizon
- Static content caching, dynamic site acceleration
- Custom domains, SSL
- Integration with Storage, App Service, Cloud Services

---

## 2.15 NAT Gateway

### Overview
Outbound NAT for SNAT. Fixed public IP(s) for outbound connections from VNet.

- Predictable public IP for outbound
- Up to 50 Gbps throughput
- No SNAT port exhaustion issues (unlike Load Balancer outbound)
- Associate with subnet

---

## 2.16 Network Watcher

### Overview
Network monitoring and diagnostics.

- **IP Flow Verify** — Check if traffic allowed/denied by NSG
- **Next Hop** — Determine next hop for a packet
- **NSG Flow Logs** — Log traffic to Storage Account
- **Connection Troubleshoot** — Test connectivity between endpoints
- **Packet Capture** — Capture VM network traffic
- **Topology** — Visualize network topology
- **Traffic Analytics** — Analyze NSG flow logs
