Resources / Azure Azure Networking Component Map Last updated: September 08, 2026 📘 8 related guides Azure VNet: Network ArchitectureAzure DNS & Traffic ManagerAzure Front Door & CDNAzure Load Balancer & Application GatewayAzure API ManagementAzure ExpressRoute & VPN GatewayAzure Private Link & Virtual WANAzure Firewall and DDoS Protection networking azure vnet private-link load-balancing dns hybrid-connectivity The Data Path Azure networking data path component map A layered diagram showing which Azure networking components can front which others, how the regional entry points chain, which dependencies fail silently, and which paths bypass edge protection. CLIENT GLOBAL · NO VNET, NO REGION Traffic Manager answers DNS, then steps aside any protocol · never in the path Front Door terminates · caches · WAF HTTP/HTTPS only ✗ cannot nest behind another Front Door, or chain with Azure CDN VNET · REGIONAL ENTRY POINTS App Gateway L7 routing · WAF public or private frontend regional · HTTP/1.1 out API Management policies · versioning external or internal mode internal needs fronting Load Balancer TCP / UDP · pass-through public or internal frontend NICs in ONE VNet WORKLOADS · VMs · VMSS · App Service · AKS WHAT THEY REACH Private Endpoint NIC in your subnet 1:1 to ONE resource NAT Gateway 64,512 SNAT ports per IP outbound only · not inbound VPN / ExpressRoute to on-premises, and back ER and VPN sites ✗ transit Private DNS Zone exact name · linked to every VNet GatewaySubnet /27+ · no NSG · no 0.0.0.0/0 UDR connection DNS query can also name Front Door names any public endpoint traffic connects direct, Traffic Manager never sees a packet origin · any of these, or the workload itself must be publicly reachable · Private Link origins on Premium no end-to-end gRPC on-prem inbound REQUIRES REQUIRES a direct hit on any origin skips the edge WAF entirely lock origins with X-Azure-FDID data path DNS only, not in the path requires, fails silently without bypass / conflict Filter Layers Where each Azure network filter sits and what it can see Four filtering layers on the inbound path, each labelled with what it is able to inspect. INBOUND WAF on Front Door (edge) or App Gateway (regional) · sees HTTP URI, headers, body: SQLi, XSS Azure Firewall hub perimeter · sees 5-tuple + FQDN + threat intel · TLS decrypt and IDPS on Premium NSG at the subnet sees 5-tuple only: IP, port, protocol · free · ASGs name groups of NICs for readable rules NSG at the NIC both subnet and NIC must allow · order decides only which one logs the deny Azure Firewall rule order: NAT, then Network, then Application, then threat intel · first match wins · default deny Conflicts Three Azure networking conflicts Non-transitive VNet peering, service endpoint routes overriding user defined routes, and two private endpoints registered in one DNS zone. PEERING IS NON-TRANSITIVE A–B peered · B–C peered A B C ✗ A cannot reach C SERVICE ENDPOINT BEATS UDR service endpoint route wins Subnet PaaS Firewall what your UDR intended ONE ZONE, TWO ENDPOINTS Endpoint A Endpoint B one zone ✗ B's registration deletes A's record one zone per service, per sub-resource Found this useful? Share it: Share on LinkedIn
