Network Connectivity: Internet & Hybrid
VNets, VPN Gateway, ExpressRoute, Virtual WAN, Private Link, and NAT Gateway — design network connectivity that securely connects Azure to the internet and on-premises networks.
Network connectivity design
Networking is the plumbing of your Azure architecture. Three connectivity questions: How do Azure resources talk to each other? How does Azure connect to on-premises? How does Azure connect to the internet?
VNets are your private networks in Azure. VPN Gateway connects Azure to on-prem over encrypted tunnels. ExpressRoute is a private, dedicated connection (no internet). Private Link keeps PaaS services off the public internet.
Azure-to-on-premises connectivity
| Factor | VPN Gateway (S2S) | ExpressRoute | Virtual WAN |
|---|---|---|---|
| Connection type | Encrypted tunnel over internet | Private dedicated connection (no internet) | Hub service managing VPN + ER + branch |
| Bandwidth | Up to 10 Gbps (VpnGw5) | 50 Mbps - 100 Gbps | Aggregated (multiple connections) |
| Latency | Variable (internet path) | Low, predictable | Low (direct routing) |
| Redundancy | Active-active gateway (2 tunnels) | Two circuits (different peering locations) | Built-in redundancy across hubs |
| Setup time | Hours | Weeks (circuit provisioning) | Hours (software-defined) |
| Cost | ~$150-3,000/mo (gateway) | ~$250-50,000/mo (circuit + gateway) | ~$0.25/hr per hub + connections |
| Best for | Small-medium orgs, dev/test, backup connection | Enterprise, high-bandwidth, low-latency, compliance | Large enterprise with many branches and Azure regions |
🏗️ Priya’s hybrid connectivity:
- Phase 1 (migration): S2S VPN — quick to set up, handles initial migration traffic
- Phase 2 (production): ExpressRoute — dedicated 1 Gbps circuit for production workloads
- VPN as backup: S2S VPN runs alongside ExpressRoute — automatic failover if ExpressRoute circuit fails
🏛️ David’s large-scale design: Government agencies with 50+ branch offices use Virtual WAN:
- Central hub per Azure region — automatically meshes with other hubs
- Branch offices connect via SD-WAN appliances
- ExpressRoute for main data centres, VPN for smaller branches
- Integrated Azure Firewall in each hub
Exam tip: ExpressRoute vs VPN — know the decision factors
Choose VPN when: Budget is limited, internet bandwidth is sufficient, setup needs to be quick, backup connection for ExpressRoute.
Choose ExpressRoute when: Compliance requires private connectivity (data never traverses internet), need guaranteed bandwidth/latency, high data volumes (100s of GB daily), SLA requirements.
Choose both when: ExpressRoute for primary traffic, VPN as automatic failover (resilience pattern).
Private connectivity to PaaS services
| Factor | Private Link (Private Endpoints) | Service Endpoints |
|---|---|---|
| How it works | Creates a private IP in YOUR VNet for the PaaS service | Optimises route to PaaS (still uses service's public IP internally) |
| Traffic path | Stays on Azure backbone via private IP | Stays on Azure backbone but uses public endpoint |
| On-prem access | Yes — reachable from on-prem via VPN/ER | No — VNet only |
| DNS | Requires Private DNS Zone for name resolution | No DNS changes needed |
| Cross-region | Yes — Private Endpoint can be in different region | No — same region only |
| NSG support | Yes | Limited |
| Cost | Per-endpoint + data processing | Free |
| Best for | Full private access (recommended for production) | Quick, free network restriction (dev/test) |
🏦 Elena’s zero-trust network: FinSecure Bank uses Private Link for every PaaS service:
- Azure SQL → Private Endpoint (no public endpoint)
- Storage accounts → Private Endpoint (public access disabled)
- Key Vault → Private Endpoint
- All accessible from on-prem via ExpressRoute + private DNS resolution
Internet connectivity
| Component | Purpose |
|---|---|
| Public IP | Direct internet access for a resource (VM, load balancer) |
| NAT Gateway | Outbound internet for subnet — predictable IP, no SNAT exhaustion |
| Azure Firewall | Centralised egress filtering — FQDN rules, threat intelligence |
| Application Gateway | Inbound L7 load balancing with WAF |
| Front Door | Global inbound edge with WAF + caching |
🚀 Marcus’s internet pattern:
- Inbound: Front Door (global edge) → Application Gateway (regional WAF) → Container Apps
- Outbound: NAT Gateway per subnet (predictable IPs for allow-listing) → Azure Firewall (FQDN filtering)
- No public IPs on any workload resource — all access through Front Door or Private Link
Knowledge check
🏦 Elena needs Azure SQL Database to be accessible only via the corporate network — no public internet access. On-premises applications must reach the database via ExpressRoute. Which connectivity approach should she recommend?
🚀 NovaSaaS has 5 product teams, each needing isolated network environments in Azure. All teams need shared access to a central monitoring stack and an ExpressRoute connection to headquarters. Traffic between product environments must be inspected by a firewall. Which network design should Marcus recommend?
🎬 Video coming soon
Next up: Securing and optimising the network — Network Security & Performance.