Cloud Tech by Victor
DevOpsIntermediate

Azure Networking

How Virtual Networks, subnets, and Network Security Groups control traffic in Azure, and how VNet peering differs from a VPN gateway for connecting networks together.

Updated 2026-07-223 min read

Overview

Azure networking is built around the Virtual Network (VNet) as the isolation boundary, with subnets dividing it into segments that Network Security Groups and route tables actually attach to. Connecting networks together, VNet to VNet, or Azure to on-premises, has two distinct mechanisms with different trade-offs: peering for fast, direct Azure-to-Azure connectivity over Microsoft's backbone, and VPN gateways for encrypted tunnels to networks outside Azure. Most real-world Azure networking mistakes come from NSG rule ordering (evaluation stops at the first match) or assuming peering transits automatically, neither of which is true.

Quick Reference

ConceptPurposeKey trait
VNetIsolated network within a regionDefined by an address space (CIDR)
SubnetSegment of a VNet's address spaceWhere NSGs and route tables attach
NSGStateful traffic filteringRules evaluated in priority order, first match wins
VNet peeringDirect VNet-to-VNet connectivityFast, no gateway, doesn't transit by default
VPN gatewayEncrypted tunnel to non-Azure networksUsed for on-premises or cross-cloud connectivity

Syntax

bicep
resource vnet 'Microsoft.Network/virtualNetworks@2023-05-01' = {
  name: 'vnet-app'
  location: resourceGroup().location
  properties: {
    addressSpace: { addressPrefixes: ['10.0.0.0/16'] }
    subnets: [
      { name: 'app-subnet', properties: { addressPrefix: '10.0.1.0/24' } }
    ]
  }
}

Examples

bash
# NSG rules are evaluated in priority order, lowest number first,
# first match wins. A broad rule placed too early can shadow a
# more specific one that comes after it.
az network nsg rule create \
  --nsg-name nsg-app --resource-group rg-app \
  --name allow-https --priority 100 \
  --destination-port-ranges 443 --access Allow

Peering does not transit by default

If VNet A peers with B, and B peers with C, A cannot reach C through B unless you explicitly enable gateway transit or set up a hub-and-spoke topology with a network virtual appliance. Peering is point-to-point, not automatically routable across hops.

Visual Diagram

Common Mistakes

  • Placing a broad allow rule at a lower priority number (evaluated first) than a more specific deny rule, silently making the deny unreachable.
  • Assuming VNet peering transits automatically between more than two peered networks, then being confused when a hub-and-spoke setup doesn't route as expected without additional configuration.
  • Overlapping address spaces between VNets that later need to be peered, requiring a disruptive re-addressing to fix.
  • Attaching NSGs only at the subnet level or only at the network-interface level inconsistently across an environment, making the effective rule set hard to reason about.

Performance

  • VNet peering traffic travels over Microsoft's backbone network, typically with lower latency and higher throughput than a VPN gateway tunnel over the public internet.
  • VPN gateways have their own throughput SKU tiers, undersizing one for actual cross-network traffic volume creates a real bottleneck distinct from anything happening inside Azure itself.
  • NSG rule evaluation is effectively free at the packet level; the performance concern is entirely about correctness of rule ordering, not runtime cost.

Best Practices

  • Design non-overlapping address spaces across all VNets from the start, anticipating future peering needs rather than retrofitting them.
  • Order NSG rules deliberately from most specific to most general, and document why, since evaluation order is the actual logic.
  • Use a hub-and-spoke topology with a central VNet for shared services when more than a couple of VNets need to communicate, rather than a full peering mesh.
  • Reserve VPN gateways for genuinely external connectivity (on-premises, other clouds) and use peering for all Azure-to-Azure connectivity.

Interview questions

What is an Azure Virtual Network (VNet) and how does it relate to subnets?

A VNet is an isolated network within Azure, scoped to a subscription and region, defined by an address space (a CIDR block). Subnets divide that address space into smaller segments, and every resource with networking (a VM, an App Service with VNet integration) is deployed into a specific subnet, not directly into the VNet itself. Subnets are also where Network Security Groups and route tables actually attach, so subnet design is where most Azure network segmentation decisions get made.

What is the difference between VNet peering and a VPN gateway?

VNet peering connects two VNets directly over Microsoft's backbone network, low latency, high bandwidth, no gateway required, but both VNets need non-overlapping address spaces and peering doesn't transit by default (VNet A peered to B, and B peered to C, doesn't mean A can reach C without its own peering). A VPN gateway creates an encrypted tunnel, typically used to connect an on-premises network to Azure, or between Azure and another cloud, over the public internet rather than Azure's internal backbone. Peering is for Azure-to-Azure connectivity at the best possible performance; a VPN gateway is for connecting to networks outside Azure, or when encryption over the transport itself is a specific requirement.

How does a Network Security Group (NSG) evaluate traffic rules?

An NSG contains a prioritized list of allow/deny rules, evaluated in priority order (lowest number first) until the first rule matching the traffic's source, destination, port, and protocol is found, that rule's action wins, and no further rules are evaluated. NSGs can attach to a subnet, a network interface, or both, and are stateful, meaning an allowed inbound connection's return traffic is automatically permitted without needing a matching outbound rule. Because evaluation stops at first match, rule priority ordering is the actual logic, a broad allow rule placed before a specific deny rule silently makes that deny unreachable.

References

ShareXLinkedInReddit
Was this page helpful?
Suggest an improvement