What is Azure Virtual Network?
Azure Virtual Network (VNet) is the fundamental networking building block in Azure. A VNet enables creating isolated, private networks in the cloud where Azure resources like VMs, App Services, and databases can communicate securely. VNets provide full control over IP address spaces, subnets, routing, and security policies.
VNets are the foundation for nearly every Azure architecture and enable secure hybrid connections to on-premises data centers via VPN Gateway or ExpressRoute.
Key Features
- Subnet Segmentation: Divide the address space into subnets for different workloads and security zones
- Network Security Groups: Stateful firewall rules for inbound and outbound traffic at subnet and NIC level
- VNet Peering: Connect multiple VNets over the Azure backbone without additional gateways
- Service Endpoints: Direct, secure access to Azure PaaS services over the Azure backbone
- Private Endpoints: Private IP addresses for Azure services within your VNet
Typical Use Cases
Multi-Tier Applications: Separation of web, application, and database tiers into different subnets with NSG rules for isolation.
Hybrid Cloud: Connection of Azure resources with on-premises data centers via Site-to-Site VPN or ExpressRoute.
Hub-and-Spoke Topology: Central hub VNet for shared services (firewall, DNS) with spoke VNets for individual workloads.
Benefits
- Free: No cost for VNets themselves, only for additional features like gateways or peering traffic
- Full Isolation: Dedicated IP address space without overlap with other tenants
- Flexible Addressing: CIDR ranges up to /2 with any number of subnets
- Azure-native Integration: All Azure services support VNet integration
Frequently Asked Questions about Azure Virtual Network
Which IP ranges should I use?
Use RFC 1918 private ranges (10.x.x.x, 172.16.x.x, 192.168.x.x). Plan address spaces to avoid overlap with on-premises networks or other VNets.
What is the difference between Service Endpoints and Private Endpoints?
Service Endpoints route traffic to Azure services over the backbone, but the service keeps its public IP. Private Endpoints assign a private IP within your VNet to the service, so no traffic flows over public IPs.
How do I connect multiple VNets?
Use VNet Peering for direct connections without additional latency. For transitive communication between peered VNets, you need Azure Firewall, NVA, or Virtual WAN.
Can I expand a VNet after creation?
Yes, you can add address spaces to existing VNets. Overlapping ranges with peered VNets are not allowed. Subnets cannot be shrunk while in use.
How do I secure a VNet?
Use Network Security Groups for subnet-level filtering. For advanced threat protection, implement Azure Firewall or an NVA. DDoS Protection Standard protects against volumetric attacks.
Integration with innFactory
As a Microsoft Solutions Partner, innFactory supports you with Azure Virtual Network: from network architecture for hub-and-spoke topologies to hybrid connectivity design to implementing zero trust network security.
