Thoughts from the clouds
Sometimes it is difficult analyzing the routing behavior of your Azure environment: on one side you have Virtual WAN routing rules, which are defined by settings such as routing intent and hub routing preferences, and on the other you have connectivity technologies such as ExpressRoute, SD-WAN and VPN tunnels with static routing or BGP. Not … Continue reading VWAN simulator: a digital twin for Virtual WAN
Large organizations usually adopt the “subscription democratization” principle to organize their cloud resources, since that allows for a cleaner billing structure and an easier way to manage Azure Policy assignments and Role-Based Access Control. The indirect consequence of having many subscriptions is having many virtual networks (VNet) too, which need to be provided with connectivity. … Continue reading Hub and spoke limits are (almost) gone
You might have heard about the Azure SRE Agent (https://aka.ms/sreagent). It is essentially an AI agent that reacts to alerts and troubleshoots the problems that generated them, and even remediates the root cause automatically if you will allow it. It is essentially an LLM with some custom prompts, skills and tools, specifically conceived for the … Continue reading Azure SRE Agent for Networking
This probably one of the least enticing blog post titles I have ever had. I will try to explain in a few paragraphs what this is going to be about, so that you can decide whether reading further or carrying on with your life. Reliability is one of the most important non-functional requirements for any … Continue reading Private global load balancing in Azure with anycast (no BGP)
If you have been reading some of my blog posts, you probably know that I have been working on Azure networking for a while. Part of that work has consisted of helping customers to create network architectures based on their requirements. Last week I got a similar ask from a colleague for a large-scale hub-and-spoke … Continue reading Which Azure network design is cheaper?
Yesterday I got an interesting question. How does subnet peering interact with ExpressRoute? A quick look into the official docs for Subnet peering checks and limitations didn’t give any answers, and Copilot wasn’t very helpful either: So let’s dive in! What was subnet peering again? I wrote a blog post some time ago here, feel … Continue reading Subnet peering and ExpressRoute
Azure Virtual WAN is one of the networking options offered by Azure, and routing inside of Virtual WAN has become a sort of dark art with the many supported options. Some years ago Routing Intent (also known as Routing Policies) was introduced to simplify routing, but at times you need to go back to the … Continue reading Virtual WAN static routes redistribution
This post will explore the new support in Azure Application Gateway for Containers (AGC) for Web Application Firewall (WAF) as documented in https://aka.ms/agc/waf. This blog is part of a series: 1. Introduction to AGC architecture and components 2. Troubleshooting 3. Resource model expansion: end-to-end TLS 4. Overlay networking and VNet Flow Logs (this post) 5. Web Application Firewall (this post) 6. … Continue reading Application Gateway for Containers: Web Application Firewall support (5)
In my recent blog series Private Link reality bites I briefly mentioned the possibility of inspecting Service Endpoints with Azure Firewall, and many have asked for more details on that configuration. Here we go! First things first: what the heck am I talking about? Most Azure services such as Azure Storage, Azure SQL and many … Continue reading Azure Firewall and Service Endpoints
Right when VNet Flow Logs were launched I blogged about some recipes that help to extract insights out of the different information fields contained in the Flow Logs. After working with VNet Flow Logs and Traffic Analytics for a while now, I thought I could share some additional tips and tricks, this time focusing on … Continue reading VNet Flow Logs Recipes (part 2): fine-tune your security rules
