YouTube Summarize
Open YouTube

Manage and control traffic flow in your Azure deployment with routes | AZ-104 | Episode 12

autoenpublicupdated

Module overview

  1. The session explains Azure traffic routing, including system-defined routes, user-defined routes, service endpoints, and private endpoints.
  2. System-defined routes provide default connectivity across known Azure networking environments, while UDRs let administrators customize or override routing behavior.

System routes and UDRs

  1. Azure combines standard TCP/IP routing concepts with system-defined routes to connect subnets, VNets, and peered VNets by default.
  2. User-defined routes can shape traffic between subnets and VNets and can override conflicting system-defined routes.
  3. In a hub-and-spoke design, UDRs can send traffic through a network virtual appliance in the hub so spoke VNets can communicate through controlled routing.

Service endpoints

  1. Service endpoints allow a virtual network or subnet to reach Azure services over the Azure backbone instead of routing through the public Internet.
  2. A service endpoint connects to an Azure service such as Azure Storage at the resource provider level, allowing access to permitted resources of that service globally.
  3. Service endpoints improve performance, reduce networking complexity and cost, and help avoid unnecessary public Internet exposure.

Private endpoints

  1. Private endpoints expose a specific instance of an Azure service as a private IP address inside a chosen subnet.
  2. Unlike service endpoints, which target an Azure service broadly, private endpoints target one specific resource instance.
  3. Resources can access the private endpoint using normal TCP/IP networking, and access can be controlled with NSGs and application security groups.

Azure backbone context

  1. Azure regions are connected through Microsoft’s global private network backbone, which supports features such as VNet peering and service endpoints.
  2. Global and regional VNet peering use Microsoft’s private network to improve cost, performance, and security compared with routing through public Internet gateways.
  3. Service endpoints use this backbone to reach Azure services such as Storage regardless of where the service resources are located.

Portal demonstration

  1. The demo creates a service endpoint from a VNet subnet to Azure Storage, specifically selecting the data-tier subnet.
  2. The demo then creates a private endpoint from a specific storage account, selecting blob storage and projecting it into the data-tier subnet.
  3. The private endpoint creates a network interface in the subnet and receives a private IP address that appears as a connected device in the VNet.

Wrap-up

  1. Azure traffic can be controlled with default system routes, UDRs, service endpoints, private endpoints, and private link services.
  2. Private link services can group disconnected services such as storage and SQL and expose them through supported private link capabilities.

Actiepunten

  1. Explore service endpoints, private endpoints, and private link services to improve Azure networking designs.
  2. Continue learning by watching other course videos or exploring Microsoft Learn.