L8. Core Networking: VNet, Load Balancer, VPN Gateway, and ExpressRoute

Azure Virtual Network (VNet)

A Virtual Network (VNet) is a logically isolated network in Azure. It is the fundamental building block for your private network in Azure. Key VNet features:

• Subnets: segment a VNet into smaller address spaces; each resource is placed in a subnet
• VNet peering: connect two VNets so resources can communicate as if on the same network (works across regions as "global VNet peering")
• Network Security Groups (NSGs): filter inbound and outbound traffic to/from subnets or network interfaces using rules

Azure Load Balancer

Distributes incoming network traffic across multiple backend VMs to ensure no single VM is overwhelmed.

• Layer 4 (Transport): operates at TCP/UDP level
• Public Load Balancer: distributes internet traffic to VMs
• Internal Load Balancer: distributes traffic within a VNet

Azure Application Gateway

• Layer 7 (HTTP/HTTPS): can route based on URL path or hostname
• Includes a Web Application Firewall (WAF) for OWASP protection
• Use when you need URL-based routing or WAF capabilities

Azure VPN Gateway

Creates an encrypted tunnel (IPsec/IKE) between Azure and an on-premises network or between two Azure VNets.

• Site-to-site VPN: connects on-premises networks to Azure over the internet
• Point-to-site VPN: connects individual client devices to Azure
• Traffic travels encrypted over the public internet

Azure ExpressRoute

ExpressRoute provides a private, dedicated connection from on-premises to Azure that does NOT travel over the public internet.

• Higher reliability, lower latency, higher throughput than VPN
• Requires a connectivity provider (network service provider)
• Typically more expensive than VPN Gateway

Azure Content Delivery Network (CDN)

Caches content at edge locations worldwide to reduce latency for global users.

Exam tip: ExpressRoute = private, dedicated, not over the internet. VPN Gateway = encrypted but still over the internet.