Create and configure virtual networks and subnets

Virtual networks (VNets) and subnets are fundamental components when setting up an Azure environment, providing the backbone for network communication within Azure as well as between Azure and on-premises networks. As a prospective AZ-104 Microsoft Azure Administrator, understanding how to create and configure these is essential.

Creating and Configuring Azure Virtual Networks (VNets)

An Azure Virtual Network provides a private network in the cloud, with full control over IP address ranges, DNS settings, security policies, and routing. To create a VNet:

1. Sign in to the Azure portal.
2. In the search bar, type ‘Virtual Network’ and select it.
3. Click on ‘Create’ to start the configuration process.
4. Select the appropriate subscription and resource group or create a new one, if necessary.
5. Now, enter a name for your VNet and select the region.
6. Specify the IP address range for the VNet using CIDR notation like 10.1.0.0/16. Ensure the range does not overlap with other networks you need to connect with.

Advanced settings can be configured as required, including DNS servers and whether to enable or disable the Azure system route.

After validating the inputs, click ‘Create’ to deploy your VNet. The deployment can take a few minutes.

Configuring Subnets within VNets

Once a virtual network is established, you can configure subnets, which divide the network into one or more segments, improving organization, security, and efficiency.

1. Navigate to the VNet you’ve created and select ‘Subnets’ from the options.
2. Click on ‘+ Subnet’ to add a new subnet.
3. Provide a name for your subnet.
4. Define the subnet’s address range, selecting a subset of the address space defined for the VNet. For instance, 10.1.1.0/24.
5. Configure any required settings like Network Security Group (NSG) or routing table.
6. Save the configuration.

Creating a subnet effectively breaks up your address space into useable blocks, where each can have its own security and configurations. For instance, you might have separate subnets for frontend services, backend services, and a database layer, each with different access controls and policies.

Security with Network Security Groups and Route Tables

You can secure and control the flow of traffic in and out of VNets and subnets using Network Security Groups (NSGs) and Route Tables.

• NSGs contain a list of security rules that allow or deny network traffic to resources connected to Azure VNets. These can be associated with either subnets or individual VM network interfaces (NICs).
• Route Tables define how packets are forwarded within the VNet and to external destinations. Routing tables are associated with subnets and can be modified to create custom routes.

Connectivity Options

Azure VNets can also be connected to other VNets or on-premises networks using various connectivity options:

• VNet-to-VNet allows you to connect two VNets in the same or different regions.
• Site-to-Site VPN is for connecting on-premises networks to Azure over an IPsec VPN tunnel.
• ExpressRoute offers a private connection from an on-premises network to Azure VNets, bypassing the internet for greater reliability and speeds.

An Example Scenario: Deploying a Three-Tier Application

After configuring the VNets and subnets, you would then associate appropriate NSGs with each subnet, defining rules that allow traffic only on necessary ports (e.g., HTTP/HTTPS for the WebSubnet).

In this setup, clear separation of duties is maintained, and security boundaries are defined at the network level, which aligns with Azure best practices and provides a robust environment for deploying applications.

Best Practices for VNets and Subnets:

• Plan IP addressing carefully to avoid conflicts and ensure scalability.
• Secure and restrict access to subnets using NSGs.
• Use service endpoints to securely connect to Azure services.
• When connecting to on-premises networks, consider high-availability options such as redundant VPN connections or ExpressRoute.

In summary, mastery over the creation, configuration, and management of VNets and subnets is vital for Azure Administrators and the AZ-104 exam. By understanding how to implement these components in Azure, administrators can design and build secure, scalable networks tailored to the needs of any organization.