Sections

9. Glossary and Cheatsheet

9 min read

The ten-second lookup.

Glossary

Accelerated Networking — SR-IOV offload that bypasses the host software switch, giving lower latency and higher packet rates. On by default for supported VM sizes.

Address space — the CIDR range or ranges a VNet owns. Subnets are carved from it. Must not overlap any network you might ever peer with; this is the one irreversible decision in the topic.

Application Security Group (ASG) — a named group of NIC IP configurations usable as an NSG source or destination, so rules are written about roles ("web tier") rather than IP ranges.

Azure Bastion — managed RDP/SSH gateway, letting you reach VMs with no public IP. Needs an AzureBastionSubnet (/26).

Azure Firewall — managed stateful firewall with FQDN filtering, threat intelligence, and (in Premium) TLS inspection and IDPS. Needs an AzureFirewallSubnet (/26). Usually the largest line on an Azure network bill.

Azure Virtual WAN — Microsoft-managed hub with built-in transitive routing, branch VPN, and ExpressRoute integration. Replaces a hand-built hub VNet at scale.

BGP — the routing protocol used by VPN and ExpressRoute gateways to exchange routes with on-premises. Loses to a UDR in route selection.

Delegation — marking a subnet for a specific service (Microsoft.Web/serverFarms, Microsoft.DBforPostgreSQL/flexibleServers) so that service can inject managed resources into it.

DNS Private Resolver — managed DNS service with inbound and outbound endpoints, letting on-premises resolve Azure private names and vice versa. Replaces the old DNS-forwarder-VM pattern.

Effective routes / effective security rules — the resolved, merged view of what actually applies to a NIC, including BGP-learned routes and both NSG attachment points. Your first diagnostic.

Flow logs (VNet) — records of allowed and denied 5-tuple flows, written to a storage account. Supersede NSG flow logs, which have been retired ⚠️ verify current status.

Forced tunnelling — a UDR sending 0.0.0.0/0 to an appliance or gateway instead of the internet, so all egress is inspected. Also the classic way to black-hole your own management traffic.

GatewaySubnet — the exact, case-sensitive subnet name required for a VPN or ExpressRoute gateway. /27 recommended.

Global peering — VNet peering across regions. Same configuration as same-region peering, higher data charges.

Hub-and-spoke — the reference topology: shared services (firewall, gateway, Bastion, DNS) in a hub VNet, workloads in peered spokes, spoke-to-spoke traffic routed through the hub via UDRs.

IP forwarding (enableIPForwarding) — a NIC flag allowing a VM to receive packets not addressed to it. Required for any NVA. Its absence is why a firewall VM silently passes nothing.

NAT Gateway — subnet-attached outbound SNAT via Standard public IPs. The recommended egress method, and the fix for SNAT port exhaustion. Zonal, not zone-redundant.

Network interface (NIC) — a standalone ARM resource in one subnet, holding IP configurations and optionally an NSG and ASG memberships. Separate lifecycle from the VM.

Network Security Group (NSG) — stateful, ordered packet filter attached to a subnet and/or a NIC. Priorities 100–4096, ascending, first match wins. Six undeletable default rules.

Network Watcher — the diagnostic toolkit: IP flow verify, next hop, NSG diagnostics, connection troubleshoot, connection monitor, packet capture. Enabled per region automatically.

Non-transitive — the defining property of VNet peering. A↔H and B↔H does not give A↔B.

Peering — a bidirectional link merging two VNets into one routing domain. Both sides must exist or the state reads Initiated, not Connected.

Private DNS zone — a privatelink.* zone that must be linked to each VNet for private endpoint names to resolve privately. Links do not inherit through peering.

Private endpoint — a NIC with a private IP in your subnet, mapped to one PaaS resource and one sub-resource. Reachable from on-premises. Billed hourly.

Private Link — the service behind private endpoints.

Reserved addresses — the five Azure takes from every subnet: network, gateway (.1), two DNS mappings (.2, .3), and broadcast. A /24 gives 251 usable.

Route table / UDR — subnet-attached routes that override Azure's system routes. Next-hop types: VirtualNetworkGateway, VirtualNetwork, Internet, VirtualAppliance, None.

Service association link — an invisible marker a delegated service places on a subnet. A common reason a subnet won't delete.

Service endpoint — a route optimisation keeping PaaS traffic on Azure's backbone while still targeting the service's public IP. Free, coarse, no on-premises reach, and an exfiltration path worth closing with service endpoint policies.

Service tag — a Microsoft-maintained, auto-updating set of IP prefixes (Storage.uksouth, AzureLoadBalancer, Internet) usable in NSG, UDR, and firewall rules.

SNAT port exhaustion — running out of source ports for outbound connections to a single destination. Symptom: timeouts at peak, to one destination only.

Subnet — a CIDR block inside the VNet, and the attachment point for NSGs, route tables, NAT Gateways, service endpoints, and delegation. Spans all availability zones in the region.

System route — the routes Azure creates automatically for the VNet's own prefixes, the internet, and peered address spaces. Overridden by UDRs.

Virtual Filtering Platform (VFP) — the host-level match-action engine that actually enforces NSG rules and routes, often offloaded to hardware. The reason there's no network device to log into.

VNet (Virtual Network) — the topic. A regional, zone-spanning, software-defined private network. Free, no SKU.

VNet integration (App Service / Functions) — regional integration into a delegated subnet giving a PaaS app outbound access to the VNet. Not the same as a private endpoint, which gives inbound.

168.63.129.16 — the Azure virtual IP serving DNS, load balancer health probes, and guest agent communication. Identical in every VNet. Never block it.

Cheatsheet

# --- create ---------------------------------------------------------------
az network vnet create -g $RG -n vnet-prod --address-prefixes 10.20.0.0/20 \
  --subnet-name snet-app --subnet-prefixes 10.20.1.0/24

az network vnet subnet create -g $RG --vnet-name vnet-prod -n snet-db \
  --address-prefixes 10.20.2.0/24

# --- NSG rules ------------------------------------------------------------
az network nsg create -g $RG -n nsg-db
az network nsg rule create -g $RG --nsg-name nsg-db -n allow-sql-from-app \
  --priority 100 --direction Inbound --access Allow --protocol Tcp \
  --source-address-prefixes 10.20.1.0/24 --destination-port-ranges 1433
az network vnet subnet update -g $RG --vnet-name vnet-prod -n snet-db \
  --network-security-group nsg-db

# --- routing --------------------------------------------------------------
az network route-table create -g $RG -n rt-egress
az network route-table route create -g $RG --route-table-name rt-egress \
  -n default-to-firewall --address-prefix 0.0.0.0/0 \
  --next-hop-type VirtualAppliance --next-hop-ip-address 10.0.0.4
az network vnet subnet update -g $RG --vnet-name vnet-prod -n snet-app \
  --route-table rt-egress

# --- peering (BOTH sides, or it stays 'Initiated') ------------------------
az network vnet peering create -g $RG -n spoke-to-hub --vnet-name vnet-prod \
  --remote-vnet $HUB_ID --allow-vnet-access --allow-forwarded-traffic \
  --use-remote-gateways
az network vnet peering sync -g $RG -n spoke-to-hub --vnet-name vnet-prod

# --- outbound egress ------------------------------------------------------
az network nat gateway create -g $RG -n natgw --public-ip-addresses pip-natgw
az network vnet subnet update -g $RG --vnet-name vnet-prod -n snet-app --nat-gateway natgw

# --- DIAGNOSE (the four you'll actually use) ------------------------------
az network watcher test-ip-flow --vm $VM -g $RG --direction Outbound \
  --protocol TCP --local 10.20.1.4:12345 --remote 10.20.2.4:1433   # allow/deny + rule name
az network watcher show-next-hop --vm $VM -g $RG \
  --source-ip 10.20.1.4 --dest-ip 8.8.8.8                          # where does it go
az network nic list-effective-nsg --name $NIC -g $RG                # merged NSG view
az network nic show-effective-route-table --name $NIC -g $RG        # merged route view

# --- INSPECT --------------------------------------------------------------
az network vnet list -o table
az network vnet subnet list -g $RG --vnet-name vnet-prod -o table
az network vnet peering list -g $RG --vnet-name vnet-prod \
  --query "[].{name:name, state:peeringState, sync:peeringSyncLevel}" -o table
az network public-ip list --query "[?ipConfiguration==null].{n:name,rg:resourceGroup}" -o table

The three commands worth memorising: test-ip-flow (allow or deny, and which rule), show-next-hop (where the packet actually goes), and the --query "[?ipConfiguration==null]" public-IP reaper (free money).

Resource ID shapes

# The VNet
/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Network/virtualNetworks/{vnet}

# A subnet — a child resource, and the scope you grant join/action on
/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Network/virtualNetworks/{vnet}/subnets/{subnet}

# An NSG
/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Network/networkSecurityGroups/{nsg}

The subnet ID is the one to know: it's what every role assignment, policy assignment, and "resource does not exist" error message is written against.

Limits worth memorising

Limit	Approximate default	Counted at
Reserved addresses per subnet	5 (this one is exact)	Per subnet
Smallest subnet	`/29`	Per subnet
VNets	~1,000	Per subscription per region
Subnets per VNet	~3,000	Per VNet
Peerings per VNet	~500	Per VNet
Private IPs per VNet	~65,536	Per VNet
Rules per NSG	~1,000	Per NSG
Routes per route table	~400	Per route table
Standard public IPs	~1,000	Per subscription per region
VNet links per private DNS zone	~1,000	Per zone

⚠️ Every number except the reserved-address count is a default that varies by subscription type and region and changes over time — verify against current Azure docs before designing to it. The column that matters and doesn't change is the right-hand one: most Azure networking quotas are per subscription per region, which is the structural argument for one subscription per environment.

Required subnet names and sizes

Name (exact, case-sensitive)	For	Minimum
`GatewaySubnet`	VPN / ExpressRoute Gateway	`/27` recommended
`AzureFirewallSubnet`	Azure Firewall	`/26`
`AzureFirewallManagementSubnet`	Firewall forced tunnelling	`/26`
`AzureBastionSubnet`	Azure Bastion	`/26`
`RouteServerSubnet`	Azure Route Server	`/27`

⚠️ Verify current minimums against current Azure docs — several have increased over time. Leave room in the address plan for subnets you haven't decided to build yet; these have hard minimums and can't be resized once populated.

The five-second debug flowchart

Does the name resolve to the right IP? nslookup from inside the VNet. If a private endpoint resolves publicly, the Private DNS zone isn't linked to this VNet.
Connection refused, or timeout? Refused means the packet arrived and nothing was listening — the network is fine. Timeout means something dropped it silently, which is always an NSG, a route, or a firewall. Azure never sends a rejection.
Which rule dropped it? az network watcher test-ip-flow names it.
Where did the packet go? az network watcher show-next-hop.
Is it a peering? Check peeringState is Connected, then check for a UDR — peering is non-transitive, so spoke-to-spoke needs a route to the hub appliance.
Did a deploy just fail with "VNet does not exist"? That's missing subnets/join/action — an RBAC problem wearing a 404's clothing.

← Back to the Virtual Network overview · ← Previous: Interview Questions