Manage and control traffic flow in your Azure deployment with routes | AZ-104 | Episode 12
autoenpublicupdated
Module overview
The episode focuses on Azure traffic routing, including system-defined routes, user-defined routes, service endpoints, and private endpoints.
System-defined routes provide default connectivity across known Azure network environments, while UDRs allow custom traffic shaping.
System routes and UDRs
Azure uses system-defined routes by default to route traffic among subnets, VNets, and peered VNets.
User-defined routes can augment or override default routes when custom routing behavior is needed.
UDRs are useful in hub-and-spoke designs, such as routing spoke-to-spoke traffic through a network virtual appliance in the hub.
Service endpoints
Service endpoints let a virtual network connect to Azure services over the Azure backbone instead of routing through the public Internet.
A service endpoint connects to an Azure service as a whole, such as Azure Storage, and can provide access to permitted resources across regions.
Service endpoints are configured at the subnet level, allowing selected subnets to access a service like Azure Storage.
Private endpoints
Private endpoints expose a specific Azure service instance as a private IP address within a selected VNet subnet.
Unlike service endpoints, private endpoints target one specific instance, such as one storage account or blob service.
Local resources can access the private endpoint through its private IP address, and access can be controlled with NSGs and application security groups.
Portal demonstration
The demo creates a service endpoint from a VNet subnet to Azure Storage, specifically for the data tier subnet.
The demo then creates a private endpoint for a specific storage account's blob service and projects it into the data tier subnet.
After creation, the private endpoint appears as a connected device in the virtual network with a private IP address.
Summary
Azure traffic flow can be shaped with default system routes, UDRs, service endpoints, and private endpoints.
Service endpoints provide subnet-level access to an Azure service through resource providers, while private endpoints provide private IP access to a specific service instance.
Private Link Service was mentioned as another option for grouping disconnected services, though it was not demonstrated.
Actiepunten
Explore service endpoints, private endpoints, and private link services to improve Azure networking skills.
Continue learning by watching other videos in the course or exploring Microsoft Learn.
