Design infrastructure solutions · Topic 8 of 10
Connectivity to the Internet and On Premises
AZ-305 connectivity design: public IP and outbound access with NAT Gateway, VPN Gateway and ExpressRoute options, Virtual WAN and hub and spoke topologies.
- 6 min
- Includes a diagram
- NAT Gateway gives static outbound IPs and scales SNAT. Azure Firewall filters. Default outbound access is retiring.
- VPN: site to site over the internet, active active for resilience, AZ SKUs for zone redundancy, route based with BGP.
- ExpressRoute SKUs: Local, Standard, Premium. Global Reach and FastPath need the right SKU and gateway. Two circuits in two locations for resilience.
What it is
Azure networks must connect to the internet and to on premises networks securely and reliably. For the internet you decide how resources are reached (inbound) and how they reach out (outbound). For on premises you choose VPN over the internet or ExpressRoute private circuits, and a topology, such as hub and spoke or Virtual WAN, that organises many networks.
How it works
Connecting Azure resources to the internet
| Direction | Options |
|---|---|
| Inbound | Standard public IP on a load balancer, Application Gateway or Front Door. Avoid public IPs on VMs. Use Bastion for management access. Protect with WAF and DDoS |
| Outbound | NAT Gateway for stable, scalable outbound addresses. Azure Firewall for filtered, inspected egress. A load balancer's outbound rules. A public IP on a VM (avoid) |
| Private access to PaaS | Private Link and private endpoints keep traffic on the Microsoft backbone |
Default outbound access for VMs without an explicit method is being retired, so design explicit outbound. NAT Gateway gives subnets a static, predictable set of public IPs (a public IP prefix gives a contiguous range partners can allow list), scales SNAT ports with the number of IPs (about 64,512 ports per IP, up to 16 IPs) and costs less than a firewall. It does not filter or inspect. When Azure Firewall and NAT Gateway are combined, NAT Gateway scales SNAT for the firewall subnet. Basic SKU public IPs and Basic load balancers are retired, so use Standard.
Connecting to on premises
| Option | Characteristics | Use |
|---|---|---|
| Site to site VPN (VPN Gateway) | Encrypted IPsec over the internet, quick to set up, lower cost. Throughput depends on the SKU (the AZ SKUs are zone redundant) | Branch offices, backup connectivity, moderate bandwidth |
| Point to site VPN | Individual clients to Azure | Remote users |
| ExpressRoute | Private, dedicated connection through a provider, predictable latency and higher bandwidth, not over the public internet | Mission critical, large data, compliance, consistent performance |
| ExpressRoute plus VPN | VPN as a backup path, or ExpressRoute with encryption | Resilience |
VPN Gateway design:
- Active active mode gives two gateway instances, each with its own public IP and tunnel, so a device, link or instance failure is handled automatically. It needs a route based VPN, Standard static public IPs and BGP is recommended. The cost is the same as active passive, and a plant with two ISP links and two VPN devices should use active active, zone redundant, with BGP.
- Use AZ SKUs (VpnGw1AZ and above) for zone redundancy. The Basic SKU is for development only. Use a /27 or larger GatewaySubnet.
ExpressRoute design:
| Item | Detail |
|---|---|
| SKUs | Local (reaches one or two Azure regions near the peering location, with an unlimited data plan, no Global Reach), Standard (all regions in the geopolitical area) and Premium (all regions globally, more routes and Global Reach across geopolitical regions) |
| Billing | Metered or unlimited data plans (Local is unlimited) |
| Global Reach | Links your on premises sites through Microsoft's network, using circuits in different locations |
| FastPath | Sends traffic straight to VMs, bypassing the gateway, which needs a high performance gateway SKU such as Ultra Performance or ErGw3AZ |
| ExpressRoute Direct | A dedicated 10, 100 or 400 Gbps port pair for the highest bandwidth, with active active links |
| Resilience | Use two circuits in different peering locations and zone redundant gateways, with a VPN as backup |
| Private peering | Connects to virtual networks. Microsoft peering reaches Microsoft 365 and public services |
Network topologies
Hub and spoke: a hub virtual network holds shared services (firewall, gateways, DNS, Bastion). Spoke networks hold workloads and peer to the hub. VNet peering is non transitive, so spoke to spoke traffic must flow through a hub firewall with user defined routes. You manage the hub. It suits a single region, with fewer than about 30 branches and a need for full control.
Azure Virtual WAN: a Microsoft managed hub (or several) that provides any to any connectivity between VNets, branches, VPN, ExpressRoute and point to site users, with automatic routing in the virtual hub router. It suits many branches or regions, simpler SD-WAN integration and transit. Limits: no IPv6 in the hub, no NAT Gateway in the hub, and it does not import existing user defined routes. ExpressRoute Local circuits only connect to gateways in the same region.
Other pieces: VNet peering (including global peering) for direct VNet to VNet, Azure Route Server to exchange routes with network virtual appliances using BGP, and Private DNS zones with DNS Private Resolver for hybrid name resolution.
Choosing quickly
| Requirement | Answer |
|---|---|
| Stable outbound IPs partners can allow list, low cost | NAT Gateway with a public IP prefix |
| Quick, encrypted link to a branch over the internet | Site to site VPN |
| Predictable latency, high bandwidth, private path | ExpressRoute |
| Plant with two ISPs and two VPN devices, automatic failover, zone resilience | Active active zone redundant VPN gateway with BGP |
| 200 branches across regions with minimal routing work | Virtual WAN |
| Single region, full control of the hub | Traditional hub and spoke |
| Spokes must reach each other | Route through a hub firewall with UDRs, or Virtual WAN |
A worked scenario
A bank connects 12 branches and a datacenter to Azure in two regions. Branch traffic uses Virtual WAN with site to site VPN and the datacenter uses two ExpressRoute circuits in different peering locations, with a VPN as backup. Spokes hold workloads, and outbound internet from the app subnets uses a NAT Gateway with a public IP prefix so partners can allow list the addresses.
What to remember for the exam
- NAT Gateway gives static outbound IPs and scales SNAT. Azure Firewall filters. Default outbound access is retiring.
- VPN: site to site over the internet, active active for resilience, AZ SKUs for zone redundancy, route based with BGP.
- ExpressRoute SKUs: Local, Standard, Premium. Global Reach and FastPath need the right SKU and gateway. Two circuits in two locations for resilience.
- Hub and spoke is manual and non transitive. Virtual WAN is managed and any to any, with some limits.
- Standard public IPs and Standard load balancers are required. Basic SKUs are retired.
"Private, dedicated, predictable" is ExpressRoute. "Fast, cheap, encrypted over the internet" is VPN.
How the exam asks about this
- "Partners must allow list our outbound addresses." NAT Gateway with a public IP prefix.
- "Branches and VPN devices fail without manual action." An active active VPN gateway with BGP.
- "Provide private connectivity to Azure with consistent latency." ExpressRoute.
- "Simplify connectivity for many branches across regions." Virtual WAN.
Common mistakes
Choosing ExpressRoute Local for global access. It reaches only nearby regions.
Assuming peering is transitive.
Public IPs on VMs for outbound traffic. Use NAT Gateway.
A single ExpressRoute circuit with no backup.
Check yourself
Which service gives stable outbound IP addresses at low cost?
Azure NAT Gateway.
Which VPN mode survives a gateway instance failure automatically?
Active active.
Which ExpressRoute SKU reaches all Azure regions globally?
Premium.
Topic 8 of 10 in Design infrastructure solutions
Test yourself on Design infrastructure solutions
The full Microsoft AZ-305 question bank has 755 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.