Thoughts from the clouds
You might have read my previous blogs about subnet peering, like this introduction to subnet peering when it was launched and the effect of subnet peering on ExpressRoute routing a bit later. Subnet peering is a technique used in today a number of designs, one of them being the Firewall-as-a-Service (FWaaS) topology in SAP RISE. … Continue reading An unexpected friendship: subnet peering and advertised gateway prefixes
You might have heard about the Azure SRE Agent (https://aka.ms/sreagent). It is essentially an AI agent that reacts to alerts and troubleshoots the problems that generated them, and even remediates the root cause automatically if you will allow it. It is essentially an LLM with some custom prompts, skills and tools, specifically conceived for the … Continue reading Azure SRE Agent for Networking
This is a continuation from my previous post Azure Route Server route maps: more than a feature, where I discussed some of the patterns not supported by route maps in Azure Route Server (ARS), such as VNet-to-VNet VPN connections and BGP peers in another hub (although these ones might be addressed by the time route … Continue reading The square design with hub-and-spoke
The AI era has brought many good things: from endless cat videos to applications vibe-coded during the lunch break, but there is also something else they have brought to the table: capacity issues in public clouds. If you are a user of public cloud, you have probably experienced this problem: the virtual machine size you … Continue reading Many-regions networking with Azure Route Server
This probably one of the least enticing blog post titles I have ever had. I will try to explain in a few paragraphs what this is going to be about, so that you can decide whether reading further or carrying on with your life. Reliability is one of the most important non-functional requirements for any … Continue reading Private global load balancing in Azure with anycast (no BGP)
Some weeks ago, Microsoft released documentation about the Virtual Network Routing Appliance (VNRA) without a lot of context, what generated a healthy confusion in the Azure Networking practitioner community. In the Azure updates page, the following was written: Azure Virtual Network routing appliance offers private connectivity for workloads across virtual networks. Using specialized hardware, it … Continue reading What is the Azure Virtual Network Routing Appliance?
Azure Networking is already a complex enough topic, and if you add to the mix the moving parts of data analytics services the results are always interesting, to say the least. On top of that, documentation is not always created to explain in detail what is actually happening or why, adding insult to injury. Consequently, … Continue reading Connecting Microsoft Fabric to on-premises databases with Private Link
If you have been reading some of my blog posts, you probably know that I have been working on Azure networking for a while. Part of that work has consisted of helping customers to create network architectures based on their requirements. Last week I got a similar ask from a colleague for a large-scale hub-and-spoke … Continue reading Which Azure network design is cheaper?
Azure Virtual WAN is one of the networking options offered by Azure, and routing inside of Virtual WAN has become a sort of dark art with the many supported options. Some years ago Routing Intent (also known as Routing Policies) was introduced to simplify routing, but at times you need to go back to the … Continue reading Virtual WAN static routes redistribution
This post will explore the new support in Azure Application Gateway for Containers (AGC) for Web Application Firewall (WAF) as documented in https://aka.ms/agc/waf. This blog is part of a series: 1. Introduction to AGC architecture and components 2. Troubleshooting 3. Resource model expansion: end-to-end TLS 4. Overlay networking and VNet Flow Logs (this post) 5. Web Application Firewall (this post) 6. … Continue reading Application Gateway for Containers: Web Application Firewall support (5)
