ANAZURE NETWORK LAB

PERSONAL ARCHITECTURE WORKBENCH / v1.0

Design the route.
Prove the flow.

A practical learning space for hybrid Azure networking—built around the questions that matter in real designs: where does a packet go, which component translates it, and how does the return path get home?

Trace a packet →Explore patterns
Reference content reviewed September 2026
REFERENCE TOPOLOGY● LEARNING MODE
ON-PREMISESEnterprise WAN
ExpressRoute
CONNECTIVITY HUBAzure FirewallDNS Private Resolver · ER Gateway
SPOKE 01Workloads
SPOKE 02AVD
Internet egressNAT Gateway
04Core domains
06Traffic paths
12Design checks
01Reusable workbook

01 / ARCHITECTURES

Patterns worth knowing

Start with the architectural intent, then inspect the packet-level consequences.

01
FW

Secured hub and spoke

Centralise inspection in Azure Firewall while keeping workload spokes isolated and independently governed.

  • UDRs steer spoke egress to the firewall
  • Peering must allow forwarded traffic
  • Return-path symmetry is non-negotiable
02
NAT

Scalable outbound

Attach NAT Gateway to AzureFirewallSubnet to give Azure Firewall predictable, scalable outbound SNAT.

  • NAT Gateway becomes the egress SNAT method
  • Public IP prefixes simplify allowlists
  • It does not perform inbound DNAT
03
ER

Resilient ExpressRoute

Design redundant circuits, gateways and BGP paths with clear primary/secondary intent and failure tests.

  • Use dual connections per circuit
  • Know how route preference is decided
  • Validate propagation and failback
04
DNS

Hybrid name resolution

Use Private DNS Resolver inbound and outbound endpoints to bridge Azure private zones and enterprise DNS.

  • Inbound endpoint receives on-prem queries
  • Outbound rulesets forward Azure queries
  • Link rulesets and zones deliberately

02 / PACKET WALKER

Trace the traffic

Select a scenario, then step through every routing, inspection and translation decision.

Spoke workload to InternetSTEP 1 OF 5
WHAT HAPPENS HERE

VERIFY

03 / DESIGN REVIEW

Make the trade-offs visible

A focused checklist for the decisions that often hide behind a tidy diagram.

Architecture review board

Choose an area to expose its most important design questions.

04 / RUNBOOKS

When the diagram says “it should work”

Use evidence in layers. Each runbook starts at the client and moves towards the control plane.

01Unexpected public source IP+
  1. Confirm the observed public IP at the destination.
  2. Check whether NAT Gateway is associated with AzureFirewallSubnet.
  3. Review firewall policy and effective route for the source subnet.
  4. Confirm you are testing a new connection; existing flows retain their translation.
02ExpressRoute path not preferred+
  1. Inspect learned routes and BGP attributes on both paths.
  2. Check Azure route selection and any more-specific prefixes.
  3. Validate circuit, connection and gateway health.
  4. Test forward and return paths independently.
03Private endpoint resolves publicly+
  1. Query the record from the affected client.
  2. Trace the conditional forwarder to the Resolver inbound endpoint.
  3. Confirm the private DNS zone contains the record.
  4. Verify the zone is linked to the VNet that performs resolution.
04Firewall SNAT port pressure+
  1. Correlate failed flows with SNAT metrics and logs.
  2. Quantify concurrent connections per destination tuple.
  3. Review public IP capacity and NAT Gateway association.
  4. Retest while observing new connection success.

PRIMARY REFERENCES

Azure Firewall + NAT Gateway ↗ExpressRoute resiliency ↗DNS Private Resolver ↗Azure route selection ↗