Thursday Architecture Lesson #3

Azure Networking Architecture: VNet vs Subnet vs NSG vs Private Endpoint.

When designing an Azure solution, choosing the right compute or storage service is only part of the architecture.

A common question is:

“How should my Azure resources communicate securely?”

This is where Azure networking architecture becomes important.

Let’s break down four foundational concepts:

1️⃣ Azure Virtual Network (VNet)

A VNet is the private network boundary for your Azure resources.

Think of it as your organization’s private network inside Azure.

A VNet provides:

• Network isolation
• IP address space
• Connectivity between Azure resources
• Connectivity to on-premises environments
• A foundation for secure application architecture

Example:

VNet
├── Web Subnet
├── Application Subnet
└── Database Subnet

2️⃣ Subnet

A subnet divides a VNet into smaller network segments.

Instead of putting every resource into one network segment, we separate workloads based on their role.

For example:

VNet
│
├── Web Subnet
│ └── Web Apps / VMs
│
├── App Subnet
│ └── Application Services
│
└── Data Subnet
└── Database Services

This segmentation helps create clearer security boundaries and makes the architecture easier to manage.

3️⃣ Network Security Group (NSG)

An NSG controls network traffic using rules.

You can define rules based on:

• Source
• Destination
• Port
• Protocol
• Allow/Deny

For example:

Internet → Web Subnet → Allowed
Internet → Database Subnet → Denied

The important architectural principle is:

Do not expose resources simply because they need to communicate.

Instead, define the minimum network access required.

4️⃣ Private Endpoint

A Private Endpoint allows supported Azure services to be accessed through a private IP address within your VNet.

This is especially useful when you want services such as Azure Storage or Azure SQL Database to communicate privately without relying on public network access.

For example:

Application
↓
Private Endpoint
↓
Private IP
↓
Azure Storage / Azure SQL

Now connect the concepts:

Azure VNet
↓
├── Web Subnet
│ └── Web Tier
│
└── App Subnet
└── App Services
↓
Private Endpoint
↓
Azure Storage / Azure SQL

NSGs provide traffic control.

Subnets provide segmentation.

Private Endpoints provide private connectivity to supported Azure services.

The VNet provides the overall network boundary.

🏗️ Architecture Principle

A strong Azure architecture is not simply about connecting everything.

It is about connecting the right things, in the right way, with the minimum required access.

Think:

VNet → Network boundary
Subnet → Segmentation
NSG → Traffic control
Private Endpoint → Private service connectivity

💡 Architecture Question of the Week

Suppose you have:

• A web application
• An application/API tier
• Azure SQL Database
• Azure Storage

Would you put everything into one subnet?

Or would you design separate network segments with controlled communication between them?

That decision can significantly affect the security, scalability, and maintainability of the solution.

What would your architecture look like?