Track 5: Azure Networking
This is track 2 of 3. It assumes you already understand general networking
concepts — IP addressing and subnetting, DNS, TCP/UDP, HTTP/TLS, routing,
firewalls, and load balancing — at a protocol level from
track 4: networking-fundamentals.
This track does not re-teach those ideas. Instead it shows how Azure
implements each one: what Azure calls it, which az network ... command
creates it, how the pieces wire together, and where the defaults will trip
you up. If a term like "stateful firewall" or "L4 vs L7 load balancing" is
fuzzy, go back to track 1 first.
Everything here runs against a real Azure subscription. You will create real resources that cost real money.
Cost warning. Most resources here (VNets, subnets, NSGs, private DNS zones) are free or nearly free, but Application Gateway and Azure Firewall bill per hour whether or not they're handling traffic — an idle Firewall or App Gateway can quietly run up tens of dollars over a weekend. Public IPs, NAT Gateways, and Load Balancers (Standard SKU) also carry small hourly charges. Delete resource groups (
az group delete) when you're done with a module's exercises. Every module that creates billable resources ends with an explicit cleanup step. Do not skip it.
Modules
| # | Module | What you'll learn | Rough time |
|---|---|---|---|
| 00 | Azure networking overview & CLI setup | Log in, pick a subscription, confirm the network CLI works, and map general-networking terms onto Azure terms |
45 min |
| 01 | Virtual networks & subnets | Create VNets and subnets, understand Azure's address-space rules and reserved IPs | 1.5 hr |
| 02 | Network Security Groups | Azure's stateful firewall: rules, priorities, default rules, and ASGs | 1.5 hr |
| 03 | Azure DNS & Private DNS | Managed public DNS zones and private zones linked to VNets, with auto-registration | 1.5 hr |
| 04 | Public IPs, Load Balancers & NAT Gateway | Standard public IPs, L4 load balancing with health probes, outbound via NAT Gateway | 2 hr |
| 05 | VNet peering & Private Endpoints | Connect VNets and reach PaaS services privately over the backbone | 1.5 hr |
| 06 | Application Gateway & WAF | L7 load balancing, path-based routing, TLS termination, and the Web Application Firewall | 2 hr |
| 07 | Azure Firewall & hub-spoke | Central egress control, route tables, and the hub-and-spoke topology | 2 hr |
| 08 | Capstone project | Build and verify a full hub-spoke design end to end, then tear it down | 3 hr |
How to work through this
Go in order — each module builds strictly on the previous ones. Attempt every quiz question in writing before revealing the answer, do the independent challenges without peeking at the solved exercises, and take the two cumulative reviews (in modules 03 and 07) closed-book. Keep an eye on the Azure Portal's Cost Management blade as you go; it's the fastest way to catch a resource you forgot to delete.
After this track, the next one is Azure Container Apps, which builds directly on the VNet integration and ingress concepts you learn here.