AZ-700: Designing and Implementing Azure Network Solutions

Discover how Azure network security groups control inbound and outbound traffic via rules on subnets or NICs, including priorities, default behavior, and Network Watcher logging.

Demonstrates creating an Azure network security group to filter traffic in and out of a subnet, with default inbound and outbound rules, and overriding them by adding lower-priority rules.

Learn to attach a network security group to a subnet in the Azure portal, configure NSG rules, and filter inbound and outbound traffic as it passes through the subnet.

Create a custom inbound rule in the Azure network security group to allow rdp on port 3389 tcp, from any source, with priority 200; later restrict to a specific ip.

Plan and demonstrate Azure application security groups, attach virtual machines to the groups, test port 80 connectivity, and create network security group rules to block traffic between the groups.

Create and map Azure application security groups, attach VMs, and define inbound NSG rules using ASG tags to control port 80 traffic; test connectivity with port query.

Establish Azure VNet peering to connect two virtual networks in same or different regions, secure Azure Backbone network traffic, enabling high speed, low latency communication without traversing the public internet.

This lecture demonstrates planning and implementing Azure VNet peering between two virtual networks across East US and South Central US, enabling VM-to-VM communication after peering.

Establish a VNet peering between two virtual networks in different regions to enable communication between their VMs, configure two connections, and verify connectivity via ping.

Diagram your infra before deployment to validate connectivity between two regional VNets. Deploy a VNet-to-VNet VPN with gateways, and explain VPN gateway, virtual network gateway, and ExpressRoute gateway.

Deploy VPN gateways in both virtual networks, create dedicated gateway subnets and public IP addresses, and establish a VNet-to-VNet VPN with VM connectivity tests.

Deploy two Azure VPN gateways in separate virtual networks, establish bidirectional VNet-to-VNet VPN connections, and verify VM-to-VM connectivity with ping by enabling ICMP through firewall rules.

Design and implement a site-to-site VPN between an Azure VNet and on-prem network by configuring a local network gateway, VPN gateway, and routing, then test connectivity.

Create a local network gateway in East US by entering the remote VPN device IP address, define the on-prem private IP range (10.0.0.0/16), and complete the wizard.

Demonstrates creating and configuring a site-to-site VPN connection using the virtual network gateway and local network gateway, with shared key authentication (preview key vault certificate) and default settings.

Deploy and configure routing and remote access on the on-prem windows device to act as a VPN device, enabling VPN access and LAN routing.

Create a demand dial interface for a site-to-site vpn between an on prem vpn device and Azure VNet, defining the public ip address, private ip range, and a pre-shared key.

Explore point-to-site vpn deployment to connect a remote user to an Azure vnet using private ip addresses, with labs on root and client certificates and vpn setup.

Demonstrates how to generate a self-signed root certificate and a client certificate using PowerShell, then export and secure them for authentication in a point-to-site VPN.

Configure a point-to-site vpn on the Azure gateway, set a private address pool, use IKEv2 with Azure certificate authentication, and download the vpn client.

Install the Azure point-to-site VPN client on a Windows machine, configure certificates if needed, and test connectivity to the Azure VNet by pinging the remote VM.

Explore how Azure automatically creates and maintains system routes for each subnet, enabling traffic between subnets, the internet, and on-premises networks, while you view them via effective routes.

Learn how user defined routes override Azure’s default routing, by building routing tables and routes attached to subnets, directing traffic through a network virtual appliance for inspection or blocking.

Define routing tables and routes in azure networks, including address prefixes and next hop types, and attach a routing table to multiple subnets while a subnet attaches to one.

Demonstrate configuring Azure network routes and routing tables across public, private, and DMZ subnets, promote a DMZ VM to an NVA, and test traffic through the DMZ.

Promote a DMZ virtual machine to a network virtual appliance by enabling IP forwarding and installing routing and remote access components to forward traffic and support VPN.

Learn to create a route table named GCE-PT1 in a chosen resource group and region using the Azure portal, then deploy and add routes inside the routing table.

Create a user defined route to the private subnet by setting destination 192.168.0.0/20 and a virtual appliance as the next hop, then attach the route table to the public subnet.

Attach the route table to the public subnet to route traffic via the network virtual appliance. Use tracert to verify public-to-private traffic passes through the NVA, while private-to-public remains direct.

Explore Azure service endpoints for secure, subnet-restricted connectivity from your vnet to Azure Storage, Cosmos DB, and Azure SQL Database over the Azure backbone.

Enable azure service endpoints from the subnet, then restrict storage access to the azure virtual network only, and test access from a vm in the private subnet.

Demonstrates enabling a subnet service endpoint for Azure Storage, then restricting access to the private subnet and testing access via Storage Explorer from a VM.

Explore how Azure private endpoints create private IP connections in your VNet to services via Private Link, keeping traffic on the Microsoft backbone. Review DNS and security considerations before deployment.

Diagram the infra, then deploy an azure private endpoint to connect a vnet subnet to an azure storage service, creating an fqdn and private ip with a private dns zone.

Demonstrates creating and configuring an Azure private endpoint to connect a storage account's blob service to a virtual network, assign a private IP, enable private DNS, and block public access.

Discover how a DNS server resolves domain names to IP addresses, and how authoritative servers, DNS cache, and TTL shape fast, accurate name resolution.

Explore the main dns records and how they map a domain to ip addresses, including a, aaaa, mx, cname, ns, and txt records used for ownership verification and mail routing.

Explore how Azure provides a default public DNS for resources, using a location based naming convention and cloudapp.azure.com domain, enabling DNS records for web servers.

Learn the benefits of Azure public DNS, manage public DNS records from the Azure portal, and route external domains to Microsoft public DNS while domain registration remains with third-party providers.

Create DNS zones in Azure, obtain Microsoft name servers, and update GoDaddy records to delegate go cloud easily dot x y z, while verifying start of authority and NS records.

Configure custom public DNS records in Azure DNS by creating a public DNS zone, adding an A record for your web server, and testing with DNS lookup.

Explore how Azure provides a default internal DNS within a VNet, resolving machines like ABC dot internal dot cloud app dot net, not resolvable from internet, with branding limits.

Install and configure an internal DNS server on a Windows machine, promote it to a domain controller, and manage DNS records through the DNS server wizard.

Configure a custom internal DNS server in an Azure virtual network to resolve resources with your domain naming convention. Set DNS per virtual network and verify with ipconfig and ping.

Configure an Azure private DNS zone, link it to a virtual network, enable auto registration, and resolve internal resource names without managing your own DNS servers.

Distribute web traffic across back-end servers with routing rules using the Azure Application Gateway, leveraging SSL termination and a web application firewall, while it remains a fully managed, scalable service.

Discuss the planned Azure load balancer setup with a front-end IP, back-end pool, and health probes, then validate by routing traffic to two VMs hosting a dummy site.

Compare Azure load balancer SKUs, focusing on basic and standard differences, with gateway as an option. Learn how back-end pool endpoints, health probes, and public IP configurations affect deployment decisions.

Explore the differences between public and internal load balancers in Azure, including public IP versus private IP, internet exposure, and traffic distribution within a virtual network.

Deploy two Azure virtual machines and deploy dummy websites to demonstrate backend configuration for a network load balancer, with manual setup on VM1 and automated setup via a PowerShell script.

Deploy a public, regional standard load balancer in Azure, configure front-end ip and back-end pool with VMs, then add a health probe and a port 80 load balancing rule.

Verify that the Azure load balancer distributes traffic across multiple backend pool nodes by testing responses from VM1 and VM2 using private browsing to ensure session-independent results.

Explore Azure application gateway, a fully managed web traffic load balancer that distributes traffic to back end servers via routing rules and URL paths, with SSL termination.

Study path-based routing in Azure with an application gateway by deploying three IIS VMs, configuring front-end and back-end routing, and validating routing rules.

Deploy three virtual machines and install a dummy site on each, create a file and folder structure via a PowerShell script, and verify path-based routing with an Azure Application Gateway.

Demonstrates deploying an Azure application gateway, configuring front end with a public IP, creating back end pools for three VMs, and defining routing rules for default, image, and video requests.

Deploy an Azure application gateway routing rule that binds the front end to the back end pool, configuring the listener, back end target, and HTTP settings.

Demonstrates deploying an Azure application gateway with path based routing rules and listeners, routing image and video paths to dedicated back end pools while preserving a default back end.

Demonstrate multi-site hosting by configuring a routing rule on an Azure Application Gateway, directing domain requests to specific back-end VMs using local host file edits.

Demonstrates deploying a multi-site setup on an azure application gateway by creating listeners and routing rules to dedicated backends, then validating with host file DNS mappings and testing across domains.