Lucent Owl logo Lucent Owl

Azure Networking Component Map

Last updated:

networking azure vnet private-link load-balancing dns hybrid-connectivity

Related guides

The Data Path

Azure networking data path component map A layered diagram showing which Azure networking components can front which others, which dependencies fail silently, and which paths bypass edge protection. CLIENT GLOBAL · NO VNET, NO REGION Traffic Manager answers DNS, then steps aside any protocol · never in the path Front Door terminates · caches · WAF HTTP/HTTPS only ✗ cannot nest behind another Front Door, or chain with Azure CDN VNET · REGIONAL ENTRY POINTS Load Balancer TCP / UDP · pass-through NICs in ONE VNet App Gateway L7 routing · WAF regional · HTTP/1.1 out API Management policies · versioning internal needs fronting WORKLOADS · VMs · VMSS · App Service · AKS WHAT THEY REACH Private Endpoint NIC in your subnet 1:1 to ONE resource NAT Gateway 64,512 SNAT ports per public IP VPN / ExpressRoute to on-premises ER and VPN sites ✗ transit Private DNS Zone exact name · linked to every VNet GatewaySubnet /27+ · no NSG · no 0.0.0.0/0 UDR connection DNS query names an endpoint traffic connects direct, Traffic Manager never sees a packet origin no end-to-end gRPC REQUIRES REQUIRES a direct hit on App Gateway skips the edge WAF entirely lock it with X-Azure-FDID data path DNS only, not in the path requires, fails silently without bypass / conflict

Filter Layers

Where each Azure network filter sits and what it can see Four filtering layers on the inbound path, each labelled with what it is able to inspect. INBOUND WAF on Front Door (edge) or App Gateway (regional) · sees HTTP URI, headers, body: SQLi, XSS Azure Firewall hub perimeter · sees 5-tuple + FQDN + threat intel · TLS decrypt and IDPS on Premium NSG at the subnet sees 5-tuple only: IP, port, protocol · free · ASGs name groups of NICs for readable rules NSG at the NIC both subnet and NIC must allow · order decides only which one logs the deny Azure Firewall rule order: NAT, then Network, then Application, then threat intel · first match wins · default deny

Conflicts

Three Azure networking conflicts Non-transitive VNet peering, service endpoint routes overriding user defined routes, and two private endpoints registered in one DNS zone. PEERING IS NON-TRANSITIVE A–B peered · B–C peered A B C ✗ A cannot reach C SERVICE ENDPOINT BEATS UDR service endpoint route wins Subnet PaaS Firewall what your UDR intended ONE ZONE, TWO ENDPOINTS Endpoint A Endpoint B one zone ✗ B's registration deletes A's record one zone per service, per sub-resource

Found this useful? Share it:

Share on LinkedIn