AZ-305T00A
Design Microsoft Azure
Infrastructure Solutions
© Copyright Microsoft Corporation. All rights reserved.
Design a network
infrastructure solution
© Copyright Microsoft Corporation. All rights reserved.
Learning Objectives
• Recommend a network architecture AZ-305: Design Infrastructure Solutions (30-35%)
solution based on workload requirements Design network solutions
• Design for Azure network connectivity Recommend a connectivity solution that
services connects Azure resources to the internet
Recommend a connectivity solution that
• Design for on-premises connectivity to
connects Azure resources to on-premises
Azure virtual networks networks
• Design for application delivery services Recommend a solution to optimize network
performance
• Design for application protection services Recommend a solution to optimize network
security
• Case study Recommend a load-balancing and routing
• Learning recap solution
© Copyright Microsoft Corporation. All rights reserved.
Virtual networks – whiteboard and discussion (notes)
© Copyright Microsoft Corporation. All rights reserved.
Recommend a network
architecture solution based
on workload requirements
© Copyright Microsoft Corporation. All rights reserved.
Defense in Depth (activity)
Provide a layered approach and multiple levels of protection.
Application Security Groups
Layers Azure Firewall
Network Security Groups
Conditional Access
Datacenter security
Container security
DDoS
Azure Information Protection
Defender for Cloud Storage
Privileged Identity Management
Azure Key Vault
Host security
© Copyright Microsoft Corporation. All rights reserved.
Defense in Depth (activity - completed)
Provide a layered approach and multiple levels of protection.
Datacenter security
Privileged Identity Management
Conditional Access
DDoS
Azure Firewall
Network Security Groups
Application Security Groups
Host security
Container security
Defender for Cloud Storage
Azure Information Protection
© Copyright Microsoft Corporation. All rights reserved.
Gather Network Requirements
Plan Virtual Networks and subnets – design considerations
• Naming
• Regions
• Subscriptions
• Segmentation
• Security
• Connectivity
• Permissions
• Policy
© Copyright Microsoft Corporation. All rights reserved.
Design for Azure network
connectivity services
© Copyright Microsoft Corporation. All rights reserved.
Design Azure Virtual networks
Azure Virtual Network is the fundamental building block for your private network in Azure. A virtual network is a virtual, isolated
portion of the Azure public network. Use VNets to communication between Azure resources, the internet and on-premises
networks.
© Copyright Microsoft Corporation. All rights reserved.
Design network topology
Segmentation is a model in which you take your networking footprint and create software
defined perimeters using tools available in Microsoft Azure.
Pattern 1: Single Virtual Network
Pattern 2: Multiple Virtual Networks with peering in between them
Pattern 3: Multiple Virtual Networks in a hub & spoke model
© Copyright Microsoft Corporation. All rights reserved.
Design Outbound Connectivity
Virtual Network NAT (network address translation) simplifies outbound-only Internet connectivity for virtual
networks. When configured on a subnet, all outbound connectivity uses your specified static public IP addresses.
NAT is fully managed and highly resilient.
Options include:
• Azure Firewall
• Load balancer
• Virtual Network NAT gateway
Choose Virtual Network NAT gateway when:
• You need on-demand outbound to internet
connectivity without pre-allocation
• You need one or more static public IP addresses
for scale
• You need configurable idle timeout
• You need TCP reset for unrecognized connections
© Copyright Microsoft Corporation. All rights reserved.
Design Routing
• When you create a virtual network for the first time without defining
any subnets, Azure creates routing entries in the routing table.
• When creating subnets inside a virtual network, Azure creates default
entries in the routing table to enable communication between subnets
within a virtual network.
• When creating a virtual network peering between two virtual
networks, a route is added for each address range within the address
space of each virtual network for which a peering is created.
Types and priority of routes:
• User Defined Routes (UDR)
• BGP routes
• System routes
© Copyright Microsoft Corporation. All rights reserved.
Design for on-premises
connectivity to Azure virtual
networks
© Copyright Microsoft Corporation. All rights reserved.
VPN connection
A VPN gateway is a type of virtual network gateway that sends encrypted traffic between an
Azure virtual network and an on-premises location.
Benefits
• Simple to configure
• Up to 10 Gbps depending on the
VPN Gateway SKU
Challenges
• Requires an on-premises VPN
device
• The SLA only covers the VPN
gateway, and not your network
connection to the gateway or
throughput
© Copyright Microsoft Corporation. All rights reserved.
Azure ExpressRoute and ExpressRoute Direct connection
ExpressRoute connections use a private, dedicated connection through a third-party
connectivity provider. This connection is private.
Benefits
• Up to 100 Gbps bandwidth - supports
dynamic scaling of bandwidth and direct
access to national clouds
• Global reach - traffic over private connection
• Up to 99.95% availability SLA across the
entire connection.
Challenges
• Can be complex to set up
• working with a third-party connectivity
provider
• Requires high-bandwidth routers on-
premises
© Copyright Microsoft Corporation. All rights reserved.
ExpressRoute with VPN failover
This options combines the previous two, using ExpressRoute in normal conditions, but failing
over to a VPN connection if there is a loss of connectivity in the ExpressRoute circuit.
Benefits
• High availability if the ExpressRoute
circuit fails, although the fallback
connection is on a lower bandwidth
network.
Challenges
• Complex to configure. You need to set
up both a VPN connection and an
ExpressRoute circuit.
• Requires redundant hardware (VPN
appliances), and a redundant Azure
VPN Gateway connection for which you
pay charges.
© Copyright Microsoft Corporation. All rights reserved.
Azure Virtual WAN
Azure Virtual WAN is a networking service that brings many networking, security, and routing functionalities together to provide a
single operational interface
• Fully managed VWAN service.
• Cost savings by using a managed
service and removing the necessity
of network virtual appliance.
• Improved security by introducing
centrally managed secured Hubs
with Azure Firewall and VWAN
• Separation of concerns between
central IT (SecOps, InfraOps) and
workloads (DevOps).
© Copyright Microsoft Corporation. All rights reserved.
Global transit network with Virtual WAN
Global transit network architecture is being adopted by enterprises to consolidate, connect,
and control the cloud-centric modern, global enterprise IT footprint
Azure Virtual WAN supports the following global transit
connectivity paths:
• Branch-to-VNet (a)
• Branch-to-branch (b)
• ExpressRoute Global Reach and Virtual WAN
• Remote User-to-VNet (c)
• Remote User-to-branch (d)
• VNet-to-VNet (e)
• Branch-to-hub-hub-to-Branch (f)
• Branch-to-hub-hub-to-VNet (g)
• VNet-to-hub-hub-to-VNet (h)
© Copyright Microsoft Corporation. All rights reserved.
Design for application
delivery services
© Copyright Microsoft Corporation. All rights reserved.
Choosing a load balancer solution
Load balancing services to distribute your workloads across multiple computing resources – Azure Front
Door, Traffic Manager, Load Balancer, and Application Gateway.
• Traffic type
• Global versus regional
• Availability
• Cost
• Features and limits
• Treat this flowchart as a starting
point
© Copyright Microsoft Corporation. All rights reserved.
Load Balancer
High-performance, low-latency load-balancing for all UDP and TCP protocols
• Layer 4 load-balancing for all UDP and TCP
protocols
• Manages inbound and outbound
connections
• Provides public and internal load-balanced
endpoints
• Uses rules to map inbound connections to
backend destinations
• Health probes manage service availability
© Copyright Microsoft Corporation. All rights reserved.
Application Gateway
Azure Application Gateway is a web traffic load balancer that enables you to manage traffic to your web applications. It is an
Application Delivery Controller (ADC) as a service, offering various layer 7 load-balancing capabilities for your applications.
When to use Application Gateway
• Layer 7 - HTTP(s) only
• Supports WAF -stateful inspection
• Traffic routing
• SSL/TLS termination
• Supports PaaS and Ips
• Regional service
© Copyright Microsoft Corporation. All rights reserved.
Traffic Manager
Azure Traffic Manager is a DNS-based traffic load balancer that enables you to distribute traffic optimally to services
across global Azure regions. Traffic Manager provides a range of traffic-routing methods to distribute traffic such as
priority, weighted, performance, geographic, multi-value, or subnet.
Choose Traffic Manager when you need:
• To increase application availability
• Improve application performance
• Combine hybrid applications
• Distribute traffic for complex deployments
© Copyright Microsoft Corporation. All rights reserved.
Azure Front Door Service
Azure Front Door Service enables you to define, manage, and monitor the global routing for your web traffic by
optimizing for best performance and instant global failover for high availability.
Choose Front Door when:
• You need to ensure that requests are sent to the
lowest latency backends (low latency)
• You have primary and secondary backends
(priority)
• You want to distribute traffic using weight
coefficients (weighted)
• You want to ensure requests from the same end
user gets sent to the same backend (affinity)
• Your traffic is HTTP(s) based and you need WAF
and/or CDN integration
© Copyright Microsoft Corporation. All rights reserved.
Content Delivery Network (CDN)
Azure CDN offers developers a global solution for rapidly delivering high-bandwidth content to users by caching
their content at strategically placed physical nodes across the world.
When to leverage a CDN:
• You want point-of-presence locations that are
close to large clusters of users.
• You want to reduce latency - both the transmission
delay and the number of router hops.
• You want custom domains, file compression,
caching, and geo-filtering.
© Copyright Microsoft Corporation. All rights reserved.
Design for application
protection services
© Copyright Microsoft Corporation. All rights reserved.
Service endpoints
Virtual Network (VNet) service endpoint provides secure and direct connectivity to Azure services over an
optimized route over the Azure backbone network
Key Benefits:
• Improved security for your Azure service
resources
• Optimal routing for Azure service traffic
from your virtual network
• Simple to set up with less management
overhead
© Copyright Microsoft Corporation. All rights reserved.
Azure Private Link
Azure Private Link enables you to access Azure PaaS Services (for example, Azure Storage and SQL Database) and
Azure hosted customer-owned/partner services over a private endpoint in your virtual network. Private link is used
to access PaaS services such as Azure Storage, Azure SQL, App Services and more as illustrated below.
Recommend private link or private
endpoints when:
• You need private connectivity to services on
Azure
• You need integration with on-premises and
peered networks
• You need traffic to remain on Microsoft
network, with no public internet access
© Copyright Microsoft Corporation. All rights reserved.
Network security groups
You can filter network traffic to and from Azure resources in an Azure virtual network with
a network security group.
A network security group (NSG) contains a list of Access Control List (ACL) rules that allow
or deny network traffic to subnets, NICs, or both.
NSGs contain two sets of rules: inbound and outbound. The priority for a rule must be
unique within each set.
© Copyright Microsoft Corporation. All rights reserved.
Azure Firewall
Azure firewall is a cloud-native network security service offering high-availability and scalability. Azure Firewall
provides inbound protection for non-HTTP/S protocols (for example, RDP, SSH, FTP), outbound network-level
protection for all ports and protocols, and application-level protection for outbound HTTP/S.
Use Azure Firewall to:
• Protect your network against infiltration.
• Implement hierarchical firewall policies.
• Configure spoke-to-spoke connectivity.
• Monitor incoming and outgoing traffic.
• If you require multiple firewalls.
© Copyright Microsoft Corporation. All rights reserved.
Web Application Firewall
Azure Web Application Firewall (WAF) provides centralized protection to your web applications from common web
exploits and vulnerabilities such as SQL injection, and cross site scripting. Azure WAF provides out of box protection
from OWASP top 10 vulnerabilities via managed rules.
When to use Web Application firewall:
• To prevent attacks in application code
• Centrally manage security for applications
• Deploy WAF with Azure Application
Gateway, Azure Front Door and Azure
Content Delivery Network (CDN)
© Copyright Microsoft Corporation. All rights reserved.
DDoS Protection
Azure DDoS Protection provides countermeasures against the most sophisticated DDoS threats. The service
provides enhanced DDoS mitigation capabilities for your application and resources deployed in your virtual
networks.
© Copyright Microsoft Corporation. All rights reserved.
Azure Bastion
The Azure Bastion service is a fully platform-managed PaaS service which provides secure and seamless RDP/SSH
connectivity to your virtual machines directly in the Azure portal over TLS.
Recommend Azure Bastion when you
need to:
• Secure remote connections from the Az
ure portal to Azure VMs
• Eliminate exposing RDP and SSH public
IP addresses of your Azure VMs
• Access VMs across multiple, peered
networks
© Copyright Microsoft Corporation. All rights reserved.
Just in Time (JIT) Network Access
With JIT, you can lock down the inbound traffic to your VMs, reducing exposure to attacks while providing easy
access to connect to VMs when needed.
© Copyright Microsoft Corporation. All rights reserved.
Case study and review
© Copyright Microsoft Corporation. All rights reserved.
Case Study – BI enterprise application
© Copyright Microsoft Corporation. All rights reserved.
Instructor solution - BI enterprise application
Frontend tier Middle tier Backend tier
Not on-
premises
On-premises
Perimeter network
VPN Azure Load Application Virtual Application Network ExpressRoute Azure Web App
Gateway Balancer Security Group network Gateway v2 security group Gateway Firewall Firewall
© Copyright Microsoft Corporation. All rights reserved.
Completed instructor solution - BI enterprise application
Frontend tier Middle tier Backend tier
Not on-
premises
ER
On-premises
Perimeter network
ER
VPN Azure Load Application Virtual Application Network ExpressRoute Azure Web App
Gateway Balancer Security Group network Gateway v2 security group Gateway Firewall Firewall
© Copyright Microsoft Corporation. All rights reserved.
Learning Recap – Network infrastructure solutions
Reference modules
• AZ-700 Designing and Implementing Microsoft Azure Networking
Solutions
• Architect network infrastructure in Azure
Check your
knowledge Optional exercises
questions and • Distribute your services across Azure virtual networks
review • Secure and isolate access using network security groups
© Copyright Microsoft Corporation. All rights reserved.
Instructor resources (hidden)
© Copyright Microsoft Corporation. All rights reserved.
Solution idea
Scalable web application
© Copyright Microsoft Corporation. All rights reserved.
End of presentation
© Copyright Microsoft Corporation. All rights reserved.