Segment a virtual network, filter it with NSGs and peer it across regions

short · 30 min · Skills measured 2.2

Before you start — what this lab needs, and what it can cost

This lab runs in your own Azure subscription: an Azure free account or a pay-as-you-go subscription, with your own card on file, so every command acts on something real and billed to you. Charges are possible, so do the clean-up the same day you start; the Azure pricing calculator and each service's pricing page give current rates. It relies on the budget alert you set in lesson 1's lab, which emails you if this subscription starts to cost money. If you skipped that lab, do its first step before this one.

Work with the least privilege the lab allows. The Contributor role on the subscription (or on a resource group you already have) is enough; nothing here grants access to anyone. You never need Global Administrator for it. On a brand-new account the first user is the subscription's Owner and the directory's Global Administrator, so if that is the only identity you have, use it carefully and only for the steps written here.

Work in Azure Cloud Shell, so nothing is installed and no credentials are handled: sign in to the Azure portal, select the Cloud Shell icon in the top toolbar and choose Bash. The first time it starts, choose No storage account required (an ephemeral session), so Cloud Shell itself creates nothing billable. An ephemeral session ends after about 20 minutes without input and forgets everything in it; if that happens, open a new session and re-run any line that sets a variable (a line such as NAME=$(az ...)) before you carry on. If you have more than one subscription, first select the one you use for these labs: az account set --subscription 00000000-0000-0000-0000-000000000000, with your own subscription ID in place of the zeros.

Every command uses the region eastus. You may choose a nearer region instead, but then use that same region everywhere this lab says eastus.

This lab creates no VPN gateway, ExpressRoute circuit, public IP address or virtual machine: those are described only. Peering is charged for data that crosses it, and nothing in this lab sends any.

This lab ends with a clean-up. Do it the same day: anything left running in your subscription is billed to you.

Task

Build the network half of lesson 8's retailer example, with nothing in it to attack. You will create a virtual network with a web subnet, a database subnet and an empty GatewaySubnet; put a network security group on each tier so the web subnet accepts only HTTPS and the database subnet accepts only database traffic from the web subnet; read the default rules every NSG carries; create a second virtual network in another region and peer the two in both directions; and confirm the peering is connected. You then decide, for a set of scenarios, whether a VPN gateway, ExpressRoute, peering or a private endpoint is the right connection.

Steps

Create the lab's resource group, and a virtual network with its first subnet, web:

az group create --name az900-lab08-rg --location eastus
az network vnet create --resource-group az900-lab08-rg --name az900-lab08-vnet --location eastus --address-prefixes 10.8.0.0/16 --subnet-name web --subnet-prefixes 10.8.1.0/24

The address space 10.8.0.0/16 is private, and each subnet is a range carved out of it. 2. Add a database subnet, and the dedicated subnet a VPN gateway would need:

az network vnet subnet create --resource-group az900-lab08-rg --vnet-name az900-lab08-vnet --name db --address-prefixes 10.8.2.0/24
az network vnet subnet create --resource-group az900-lab08-rg --vnet-name az900-lab08-vnet --name GatewaySubnet --address-prefixes 10.8.255.0/27

The subnet must be named exactly GatewaySubnet. An empty subnet costs nothing, and this lab never puts a gateway in it: a gateway is charged for every hour it exists. 3. Give each tier its own network security group. The web NSG allows HTTPS (TCP 443) in from the internet and nothing else of yours; the database NSG allows TCP 1433 from the web subnet only, then denies other traffic from inside the virtual network:

az network nsg create --resource-group az900-lab08-rg --name az900-lab08-web-nsg --location eastus
az network nsg rule create --resource-group az900-lab08-rg --nsg-name az900-lab08-web-nsg --name allow-https-in --priority 100 --direction Inbound --access Allow --protocol Tcp --source-address-prefixes Internet --destination-port-ranges 443
az network nsg create --resource-group az900-lab08-rg --name az900-lab08-db-nsg --location eastus
az network nsg rule create --resource-group az900-lab08-rg --nsg-name az900-lab08-db-nsg --name allow-sql-from-web --priority 100 --direction Inbound --access Allow --protocol Tcp --source-address-prefixes 10.8.1.0/24 --destination-port-ranges 1433
az network nsg rule create --resource-group az900-lab08-rg --nsg-name az900-lab08-db-nsg --name deny-other-vnet --priority 4000 --direction Inbound --access Deny --protocol '*' --source-address-prefixes VirtualNetwork --destination-port-ranges '*'
az network vnet subnet update --resource-group az900-lab08-rg --vnet-name az900-lab08-vnet --name web --network-security-group az900-lab08-web-nsg
az network vnet subnet update --resource-group az900-lab08-rg --vnet-name az900-lab08-vnet --name db --network-security-group az900-lab08-db-nsg

Nothing sits in the web subnet, so the HTTPS rule exposes nothing; it shows how a web tier would be opened on one port only. 4. Read every rule the database NSG applies, including the defaults Azure adds to every NSG:

az network nsg rule list --resource-group az900-lab08-rg --nsg-name az900-lab08-db-nsg --include-default --query '[].{name:name, priority:priority, access:access, source:sourceAddressPrefix, port:destinationPortRange}' -o table

Rules are read from the lowest priority number up, and the first match wins. Your allow-sql-from-web (100) and deny-other-vnet (4000) come before the defaults AllowVnetInBound, AllowAzureLoadBalancerInBound and DenyAllInBound (65000 and above). So the web subnet reaches the database tier on one port, and nothing else inside the network reaches it at all: one foothold reaches little. 5. Create a second virtual network in another region, with an address space that does not overlap, and peer the two in both directions:

az network vnet create --resource-group az900-lab08-rg --name az900-lab08-vnet-west --location westus --address-prefixes 10.9.0.0/16 --subnet-name standby --subnet-prefixes 10.9.1.0/24
az network vnet peering create --resource-group az900-lab08-rg --name east-to-west --vnet-name az900-lab08-vnet --remote-vnet az900-lab08-vnet-west --allow-vnet-access
az network vnet peering create --resource-group az900-lab08-rg --name west-to-east --vnet-name az900-lab08-vnet-west --remote-vnet az900-lab08-vnet --allow-vnet-access

This is global virtual network peering: traffic between the two would travel over the Microsoft backbone, never the public internet, and needs no VPN or ExpressRoute. Peering only connects once both directions exist. If you chose another lab region, use any other region for this network. 6. Read the peering state from the first network's side:

az network vnet peering show --resource-group az900-lab08-rg --vnet-name az900-lab08-vnet --name east-to-west --query peeringState -o tsv

It prints Connected. After only the first peering it would have read Initiated. 7. Choose the connection for each scenario, then check the Notes: (a) a head office must reach this network over an encrypted tunnel across the internet; (b) a bank wants consistent latency and no internet path from its datacenter; (c) a remote employee on a laptop with no VPN device at home; (d) VMs in this network and the west network must talk privately; (e) a storage account must be reachable only from inside this network, with no internet-facing address; (f) a backup path for case (b). For (a), say which subnet from step 2 the Azure side would use.

Verify

Read the subnet count, the database NSG's association and the peering state.

az network vnet show --resource-group az900-lab08-rg --name az900-lab08-vnet --query 'length(subnets)' -o tsv

Expected output: 3.

az network nsg show --resource-group az900-lab08-rg --name az900-lab08-db-nsg --query 'length(subnets)' -o tsv

Expected output: 1.

az network vnet peering show --resource-group az900-lab08-rg --vnet-name az900-lab08-vnet-west --name west-to-east --query peeringState -o tsv

Expected output: Connected.

Cost and clean-up

Virtual networks, subnets, network security groups and peerings are not charged for existing. Peering is charged for data that crosses it, and this lab sends none. Charges are possible only if you add resources to these networks, so delete the group as soon as you have read the Verify output.

Created by this lab: the resource group az900-lab08-rg; the virtual network az900-lab08-vnet with the subnets web, db and GatewaySubnet; the virtual network az900-lab08-vnet-west with the subnet standby; the network security group az900-lab08-web-nsg with the rule allow-https-in; the network security group az900-lab08-db-nsg with the rules allow-sql-from-web and deny-other-vnet; the peerings east-to-west and west-to-east.

Delete the resource group. That deletes both networks, az900-lab08-vnet (with web, db and GatewaySubnet) and az900-lab08-vnet-west (with standby), the peerings east-to-west and west-to-east, and the NSGs az900-lab08-web-nsg and az900-lab08-db-nsg with their rules allow-https-in, allow-sql-from-web and deny-other-vnet:

az group delete --name az900-lab08-rg --yes

It takes a few minutes and returns when it has finished.

Check it is gone

az group exists --name az900-lab08-rg

Expected output: false.

Notes

Answers to step 7: (a) a site-to-site VPN through a VPN gateway, deployed into GatewaySubnet; (b) ExpressRoute, a private connection through a provider; (c) a point-to-site VPN; (d) virtual network peering, which you built in step 5; (e) a private endpoint in a subnet of this network, with the storage account's public network access then turned off (lesson 11's capstone builds one); (f) a site-to-site VPN kept as the backup path.

When you create the first virtual network in a region, Azure may also create a resource group named NetworkWatcherRG holding a Network Watcher for that region. It is a shared, subscription-wide monitoring setting rather than part of this lab, other networks you make later use it too, and simply having it enabled is not charged (its optional features, such as flow logs, are charged when you turn them on). This lab leaves it in place.

This is an independent study companion for the Microsoft Azure Fundamentals (AZ-900) exam and is not produced by or endorsed by Microsoft. Microsoft, Azure and Microsoft Entra are trademarks of the Microsoft group of companies.

This is an independent study companion for Microsoft Azure Fundamentals AZ-900 and is not produced by or endorsed by CompTIA.