Cloud Pro: Azure Networking: Choose, Compare and Launch

What's inside

1. Level 1: The Azure Networking Map on One PageFree
   See every Azure networking service on one page in eight groups (virtual networks, connectivity between networks, hybrid links, load balancing and delivery, DNS, private access, network security, monitoring), with current and former names and which services or tiers are retiring or closed to new customers.
2. Level 2: The Standard Connectivity ProfileFree
   Build the reusable connectivity profile that every later level uses to choose a service. It records users, sites and regions; north-south and east-west traffic; protocols; latency and bandwidth; availability and failover; hybrid links; segmentation and zero trust; internet exposure and DDoS; compliance and data paths; team skills; and the cost model.
3. Level 3: Virtual Network: Address Spaces and Subnets
   Learn the nine-part service pattern on Azure Virtual Network: address spaces, subnets, reserved addresses, subnet delegation, private subnets now that default outbound access is going away, and the VNet limits and pricing that matter.
4. Level 4: Routing: System Routes and User-Defined Routes
   Learn how Azure routes traffic by default, and how route tables with user-defined routes steer it through appliances or firewalls without causing asymmetric routing or black holes.
5. Level 5: NSGs and Application Security Groups
   Segment traffic inside and between subnets with network security groups and application security groups: rule priority, default rules, service tags and the trade-offs of putting NSGs on subnets or on network interfaces.
6. Level 6: Virtual Network Quick Start and Decision
   Finish the Virtual Network nine-part pattern: deploy a VNet with subnets, an NSG, an ASG and a route table using the Azure CLI and then Bicep or Terraform, clean it up, and record when a single VNet fits and when it does not.
7. Level 7: VNet Peering: Regional and Global
   Connect virtual networks with regional and global peering: the fact that peering is not transitive, gateway transit, forwarded traffic, address-overlap rules, per-GB peering charges and the peering limits that bite.
8. Level 8: Azure Virtual Network Manager
   Manage connectivity and security at scale with Virtual Network Manager: network groups, hub-and-spoke and mesh connectivity configurations, security admin rules that override NSGs, deployment by region and its pricing model.
9. Level 9: Azure DNS: Public Zones
   Host internet-facing domains in Azure DNS public zones: delegation, record sets, alias records that point at Azure resources, how it is priced per zone and per query, and when an external DNS provider is the better fit.
10. Level 10: Private DNS Zones and DNS Private Resolver
    Resolve private names across VNets and on-premises networks with private DNS zones, VNet links, auto-registration and DNS Private Resolver inbound and outbound endpoints with forwarding rulesets, which replace custom DNS forwarder VMs.
11. Level 11: Azure Load Balancer: Layer 4 Essentials
    Apply the nine-part pattern to the Standard Load Balancer: public and internal frontends, backend pools, health probes, zone redundancy, limits, pricing by rules and data processed, and the retirement of the Basic tier.
12. Level 12: Load Balancer: Outbound, HA Ports and Quick Start
    Go beyond the basics with outbound rules and SNAT port exhaustion, HA ports for network virtual appliances, Gateway Load Balancer and the cross-region tier, then deploy and clean up a working Load Balancer.
13. Level 13: Application Gateway v2: Layer 7 Routing
    Use Application Gateway v2 for regional HTTP(S) delivery: listeners, routing rules by path and host, TLS termination, autoscaling, pricing by capacity unit, limits that bite, the v1 retirement and where Application Gateway for Containers fits.
14. Level 14: Web Application Firewall on Application Gateway
    Protect regional web apps with WAF policies on Application Gateway: managed rule sets, custom rules, detection versus prevention mode, tuning out false positives, the cost of the WAF tier, and a full quick start with clean-up.
15. Level 15: Azure Front Door Standard and Premium
    Apply the nine-part pattern to Front Door: global anycast HTTP(S) entry, the Standard versus Premium tiers, pricing (base fee, requests and data transfer), limits, and migrating off Front Door classic and CDN classic.
16. Level 16: Front Door Quick Start: Origins, Rules and WAF
    Deploy a working Front Door profile with origin groups, health probes, caching, a rule set, a WAF policy and a private-link origin, then clean up. Use it to weigh Front Door against Application Gateway and to decide when to use both.
17. Level 17: Traffic Manager and the Load-Balancing Decision Tree
    Use Traffic Manager for DNS-based global routing (priority, weighted, performance, geographic, multivalue, subnet), learn its TTL and failover trade-offs, and combine everything so far into a decision tree for global versus regional and layer 4 versus layer 7.
18. Level 18: NAT Gateway: Predictable Outbound
    Give subnets scalable, predictable outbound internet access with NAT Gateway: static public IPs and prefixes, SNAT port allocation, idle timeouts, zone behaviour, hourly and per-GB pricing, and how it replaces default outbound access.
19. Level 19: Private Endpoints for PaaS Services
    Reach Azure PaaS services over private IPs with private endpoints: target sub-resources, private DNS zone integration, network policies for NSGs and UDRs, hourly and per-GB pricing, and how private endpoints compare with service endpoints.
20. Level 20: Private Link Service: Publishing Your Own
    Publish your own service privately to other tenants and VNets with Private Link service behind a Standard Load Balancer: NAT IPs, approval workflows, visibility settings and limits, ending with a complete provider-and-consumer quick start.
21. Level 21: VPN Gateway: Site-to-Site Links
    Apply the nine-part pattern to VPN Gateway for site-to-site IPsec tunnels: choosing a SKU and generation, policy-based or route-based, active-active or active-standby, BGP, and the hourly, per-tunnel and egress charges.
22. Level 22: VPN Gateway: Point-to-Site Remote Access
    Set up point-to-site VPN for remote users and compare the tunnel types (OpenVPN, IKEv2, SSTP) and sign-in methods (certificates, RADIUS, Microsoft Entra ID) against zero-trust access options.
23. Level 23: ExpressRoute: Circuits, Peering and Resiliency
    Work out how ExpressRoute circuits, providers and peering locations, private and Microsoft peering, gateway SKUs, FastPath, Global Reach and ExpressRoute Direct fit together, and design for the resiliency levels Microsoft recommends.
24. Level 24: Virtual WAN: Managed Hubs and Routing
    Evaluate Virtual WAN Basic and Standard as a Microsoft-managed hub for branches, VPN users, ExpressRoute and spoke VNets, including hub routing, route tables, routing intent and the charges for hub hours, scale units and connections.
25. Level 25: Azure Firewall and Firewall Manager
    Choose between the Azure Firewall Basic, Standard and Premium tiers, build rule collections in firewall policies managed by Firewall Manager, and weigh the deployment-hour and per-GB processing costs against third-party network virtual appliances.
26. Level 26: DDoS Protection: Network and IP Protection
    Compare the free platform-level DDoS defence with the DDoS Network Protection and DDoS IP Protection tiers, covering what each detects, what telemetry and rapid-response support you get, and when the fixed monthly plan pays off.
27. Level 27: Bastion and Network Watcher
    Use Azure Bastion (Developer, Basic, Standard and Premium tiers) for secure administrative access without public IPs, and turn on Network Watcher's tools, including VNet flow logs and Traffic Analytics, while knowing what NSG flow logs are being retired in favour of.
28. Level 28: IP Address Planning at Scale
    Design a non-overlapping IPv4 (and dual-stack IPv6) address plan for regions, hubs, spokes and on-premises sites that leaves room for gateways, firewalls, Bastion and private endpoints, and manage it with Virtual Network Manager IP address management.
29. Level 29: Topologies: Hub-and-Spoke, Virtual WAN, Mesh
    Compare customer-managed hub-and-spoke, Virtual WAN, full mesh and isolated-spoke topologies on routing, inspection points, segmentation, operating effort and cost, and pick one for a given connectivity profile.
30. Level 30: Multi-Region and Resilient Network Design
    Extend the chosen topology across regions and availability zones: one hub per region, links between hubs, global load balancing with Front Door or Traffic Manager, DNS failover and hybrid path redundancy.
31. Level 31: Modelling Data Transfer and Egress Costs
    Build a cost model for a whole design: internet egress, traffic between zones, regions and continents, peering charges, per-GB processing on gateways, firewalls and private endpoints, and ExpressRoute data plans, using dated example prices.
32. Level 32: Troubleshooting and Network Observability
    Follow a repeatable troubleshooting workflow (effective routes, effective security rules, next hop, connection troubleshoot, DNS resolution, flow logs and Traffic Analytics) to find faults in routing, NSGs, firewalls, private endpoints and hybrid links.
33. Level 33: Migrating an On-Premises Network Design
    Translate an on-premises network (VLANs, firewall zones, load balancers, internal DNS, WAN links) into Azure equivalents, sequence the cutover, and avoid lift-and-shift habits that do not fit Azure, such as layer-2 assumptions and stretched subnets.
34. Level 34: The Weighted Selection Scorecard
    Turn the connectivity profile from level 2 into a weighted scorecard that scores candidate services and designs against requirements, limits, operating effort and cost, so the choice can be repeated and defended.
35. Level 35: Scoring Azure Against Another Cloud
    Score the Azure networking design against an equivalent design on another cloud, using the same scorecard and dated evidence from both providers' documentation and pricing pages, and keeping the provider-independent parts separate.
36. Level 36: Final Challenge: Decision Workshop Exam
    Run a full decision workshop on a realistic scenario using everything in the course (profile, service choices, topology, IP plan, security, costs, operations and cross-cloud comparison) and produce a one-page selection record.

Access

The first 2 levels are free with a free account. Every level, the podcast edition and the AI tutor come with All Access at £4.99/month or any Creator plan — see pricing.

Start free →