Azure Networking

Azure 网络配置

Design and implement Azure network infrastructure including VNets, subnets, NSGs, VNet peering, private endpoints, Azure Firewall, and Application Gateway. Covers both az CLI commands and Terraform configurations for production hub-spoke topologies.

设计并实现Azure网络基础设施，包括虚拟网络（VNets）、子网、网络安全组（NSGs）、虚拟网络对等连接（VNet peering）、专用终结点、Azure防火墙和应用程序网关。涵盖用于生产环境中心辐射型拓扑的az CLI命令和Terraform配置。

When to Use

适用场景

You are designing the network foundation for Azure workloads.
You need to isolate environments with VNets and NSGs.
You are connecting on-premises networks to Azure via VPN or ExpressRoute.
You need private connectivity to PaaS services via private endpoints.
You are implementing centralized egress filtering with Azure Firewall.
You need to set up load balancing or application-layer routing with Application Gateway.

您正在为Azure工作负载设计网络基础架构。
您需要通过VNets和NSGs隔离环境。
您需要通过VPN或ExpressRoute将本地网络连接到Azure。
您需要通过专用终结点实现与PaaS服务的私有连接。
您正在使用Azure防火墙实现集中式出口过滤。
您需要通过应用程序网关设置负载均衡或应用层路由。

Prerequisites

前提条件

bash

undefined

bash

undefined

Install Azure CLI

curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash

Login and set subscription

az login az account set --subscription "my-subscription-id"

Register required providers

az provider register --namespace Microsoft.Network

Create resource group

az group create --name networking-rg --location eastus

undefined

az group create --name networking-rg --location eastus

undefined

VNet and Subnet Creation

虚拟网络与子网创建

Hub VNet

中心虚拟网络（Hub VNet）

bash

undefined

bash

undefined

Create hub VNet for shared services

az network vnet create
--resource-group networking-rg
--name hub-vnet
--address-prefix 10.0.0.0/16
--location eastus
--tags environment=prod role=hub

Add subnets to hub

az network vnet subnet create
--resource-group networking-rg
--vnet-name hub-vnet
--name AzureFirewallSubnet
--address-prefix 10.0.1.0/26

az network vnet subnet create
--resource-group networking-rg
--vnet-name hub-vnet
--name GatewaySubnet
--address-prefix 10.0.2.0/27

az network vnet subnet create
--resource-group networking-rg
--vnet-name hub-vnet
--name SharedServicesSubnet
--address-prefix 10.0.3.0/24

az network vnet subnet create
--resource-group networking-rg
--vnet-name hub-vnet
--name AzureBastionSubnet
--address-prefix 10.0.4.0/26

undefined

az network vnet subnet create
--resource-group networking-rg
--vnet-name hub-vnet
--name AzureFirewallSubnet
--address-prefix 10.0.1.0/26

az network vnet subnet create
--resource-group networking-rg
--vnet-name hub-vnet
--name GatewaySubnet
--address-prefix 10.0.2.0/27

az network vnet subnet create
--resource-group networking-rg
--vnet-name hub-vnet
--name SharedServicesSubnet
--address-prefix 10.0.3.0/24

az network vnet subnet create
--resource-group networking-rg
--vnet-name hub-vnet
--name AzureBastionSubnet
--address-prefix 10.0.4.0/26

undefined

Spoke VNet

辐射虚拟网络（Spoke VNet）

bash

undefined

bash

undefined

Create spoke VNet for application workloads

az network vnet create
--resource-group networking-rg
--name spoke-prod-vnet
--address-prefix 10.1.0.0/16
--location eastus
--tags environment=prod role=spoke

az network vnet subnet create
--resource-group networking-rg
--vnet-name spoke-prod-vnet
--name web-subnet
--address-prefix 10.1.1.0/24

az network vnet subnet create
--resource-group networking-rg
--vnet-name spoke-prod-vnet
--name app-subnet
--address-prefix 10.1.2.0/24

az network vnet subnet create
--resource-group networking-rg
--vnet-name spoke-prod-vnet
--name data-subnet
--address-prefix 10.1.3.0/24
--private-endpoint-network-policies Enabled

az network vnet create
--resource-group networking-rg
--name spoke-prod-vnet
--address-prefix 10.1.0.0/16
--location eastus
--tags environment=prod role=spoke

az network vnet subnet create
--resource-group networking-rg
--vnet-name spoke-prod-vnet
--name web-subnet
--address-prefix 10.1.1.0/24

az network vnet subnet create
--resource-group networking-rg
--vnet-name spoke-prod-vnet
--name app-subnet
--address-prefix 10.1.2.0/24

az network vnet subnet create
--resource-group networking-rg
--vnet-name spoke-prod-vnet
--name data-subnet
--address-prefix 10.1.3.0/24
--private-endpoint-network-policies Enabled

List all subnets in a VNet

az network vnet subnet list
--resource-group networking-rg
--vnet-name spoke-prod-vnet
--output table

undefined

az network vnet subnet list
--resource-group networking-rg
--vnet-name spoke-prod-vnet
--output table

undefined

Network Security Groups

网络安全组（NSGs）

bash

undefined

bash

undefined

Create NSG for web tier

az network nsg create
--resource-group networking-rg
--name web-nsg
--tags tier=web

Allow HTTPS from internet

az network nsg rule create
--resource-group networking-rg
--nsg-name web-nsg
--name AllowHTTPS
--priority 100
--direction Inbound
--access Allow
--protocol Tcp
--source-address-prefixes Internet
--destination-port-ranges 443

Allow HTTP for redirect

az network nsg rule create
--resource-group networking-rg
--nsg-name web-nsg
--name AllowHTTP
--priority 110
--direction Inbound
--access Allow
--protocol Tcp
--source-address-prefixes Internet
--destination-port-ranges 80

Deny all other inbound traffic

az network nsg rule create
--resource-group networking-rg
--nsg-name web-nsg
--name DenyAllInbound
--priority 4096
--direction Inbound
--access Deny
--protocol ''
--source-address-prefixes ''
--destination-port-ranges '*'

Create NSG for app tier -- only allow from web subnet

az network nsg create
--resource-group networking-rg
--name app-nsg

az network nsg rule create
--resource-group networking-rg
--nsg-name app-nsg
--name AllowFromWeb
--priority 100
--direction Inbound
--access Allow
--protocol Tcp
--source-address-prefixes 10.1.1.0/24
--destination-port-ranges 8080

az network nsg create
--resource-group networking-rg
--name app-nsg

az network nsg rule create
--resource-group networking-rg
--nsg-name app-nsg
--name AllowFromWeb
--priority 100
--direction Inbound
--access Allow
--protocol Tcp
--source-address-prefixes 10.1.1.0/24
--destination-port-ranges 8080

Create NSG for data tier -- only allow from app subnet

az network nsg create
--resource-group networking-rg
--name data-nsg

az network nsg rule create
--resource-group networking-rg
--nsg-name data-nsg
--name AllowSQLFromApp
--priority 100
--direction Inbound
--access Allow
--protocol Tcp
--source-address-prefixes 10.1.2.0/24
--destination-port-ranges 1433

az network nsg create
--resource-group networking-rg
--name data-nsg

az network nsg rule create
--resource-group networking-rg
--nsg-name data-nsg
--name AllowSQLFromApp
--priority 100
--direction Inbound
--access Allow
--protocol Tcp
--source-address-prefixes 10.1.2.0/24
--destination-port-ranges 1433

Associate NSG with subnet

az network vnet subnet update
--resource-group networking-rg
--vnet-name spoke-prod-vnet
--name web-subnet
--network-security-group web-nsg

az network vnet subnet update
--resource-group networking-rg
--vnet-name spoke-prod-vnet
--name app-subnet
--network-security-group app-nsg

az network vnet subnet update
--resource-group networking-rg
--vnet-name spoke-prod-vnet
--name data-subnet
--network-security-group data-nsg

az network vnet subnet update
--resource-group networking-rg
--vnet-name spoke-prod-vnet
--name web-subnet
--network-security-group web-nsg

az network vnet subnet update
--resource-group networking-rg
--vnet-name spoke-prod-vnet
--name app-subnet
--network-security-group app-nsg

az network vnet subnet update
--resource-group networking-rg
--vnet-name spoke-prod-vnet
--name data-subnet
--network-security-group data-nsg

View effective NSG rules

az network nic list-effective-nsg
--resource-group networking-rg
--name myvm-nic
--output table

undefined

az network nic list-effective-nsg
--resource-group networking-rg
--name myvm-nic
--output table

undefined

VNet Peering

虚拟网络对等连接（VNet Peering）

bash

undefined

bash

undefined

Peer hub to spoke

az network vnet peering create
--resource-group networking-rg
--name hub-to-spoke-prod
--vnet-name hub-vnet
--remote-vnet spoke-prod-vnet
--allow-vnet-access
--allow-forwarded-traffic
--allow-gateway-transit

Peer spoke to hub

az network vnet peering create
--resource-group networking-rg
--name spoke-prod-to-hub
--vnet-name spoke-prod-vnet
--remote-vnet hub-vnet
--allow-vnet-access
--allow-forwarded-traffic
--use-remote-gateways false

Verify peering status

az network vnet peering list
--resource-group networking-rg
--vnet-name hub-vnet
--output table

undefined

az network vnet peering list
--resource-group networking-rg
--vnet-name hub-vnet
--output table

undefined

Private Endpoints

专用终结点（Private Endpoints）

bash

undefined

bash

undefined

Create private endpoint for Azure SQL

az network private-endpoint create
--resource-group networking-rg
--name sql-private-endpoint
--vnet-name spoke-prod-vnet
--subnet data-subnet
--private-connection-resource-id "/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Sql/servers/myserver"
--group-id sqlServer
--connection-name sql-connection

Create private DNS zone for SQL

az network private-dns zone create
--resource-group networking-rg
--name privatelink.database.windows.net

Link DNS zone to VNet

az network private-dns link vnet create
--resource-group networking-rg
--zone-name privatelink.database.windows.net
--name spoke-dns-link
--virtual-network spoke-prod-vnet
--registration-enabled false

Create DNS record for the private endpoint

az network private-endpoint dns-zone-group create
--resource-group networking-rg
--endpoint-name sql-private-endpoint
--name sql-dns-group
--private-dns-zone privatelink.database.windows.net
--zone-name privatelink.database.windows.net

Create private endpoint for Storage Account

az network private-endpoint create
--resource-group networking-rg
--name storage-private-endpoint
--vnet-name spoke-prod-vnet
--subnet data-subnet
--private-connection-resource-id "/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Storage/storageAccounts/mystorageacct"
--group-id blob
--connection-name storage-blob-connection

Create private endpoint for Key Vault

az network private-endpoint create
--resource-group networking-rg
--name kv-private-endpoint
--vnet-name spoke-prod-vnet
--subnet app-subnet
--private-connection-resource-id "/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.KeyVault/vaults/myvault"
--group-id vault
--connection-name kv-connection

undefined

az network private-endpoint create
--resource-group networking-rg
--name kv-private-endpoint
--vnet-name spoke-prod-vnet
--subnet app-subnet
--private-connection-resource-id "/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.KeyVault/vaults/myvault"
--group-id vault
--connection-name kv-connection

undefined

Azure Firewall

Azure防火墙

bash

undefined

bash

undefined

Create public IP for firewall

az network public-ip create
--resource-group networking-rg
--name fw-public-ip
--sku Standard
--allocation-method Static

Create Azure Firewall

az network firewall create
--resource-group networking-rg
--name hub-firewall
--location eastus
--sku AZFW_VNet
--tier Standard

Configure firewall IP

az network firewall ip-config create
--resource-group networking-rg
--firewall-name hub-firewall
--name fw-ipconfig
--public-ip-address fw-public-ip
--vnet-name hub-vnet

Get firewall private IP for route tables

FW_PRIVATE_IP=$(az network firewall show
--resource-group networking-rg
--name hub-firewall
--query "ipConfigurations[0].privateIpAddress"
--output tsv)

Create application rule allowing web traffic

az network firewall application-rule create
--resource-group networking-rg
--firewall-name hub-firewall
--collection-name AllowWeb
--name AllowGoogle
--protocols Https=443 Http=80
--source-addresses 10.1.0.0/16
--target-fqdns ".google.com" ".microsoft.com"
--action Allow
--priority 100

Create network rule for DNS

az network firewall network-rule create
--resource-group networking-rg
--firewall-name hub-firewall
--collection-name AllowDNS
--name AllowDNS
--protocols UDP
--source-addresses 10.1.0.0/16
--destination-addresses 168.63.129.16
--destination-ports 53
--action Allow
--priority 200

Create route table to send traffic through firewall

az network route-table create
--resource-group networking-rg
--name spoke-route-table

az network route-table route create
--resource-group networking-rg
--route-table-name spoke-route-table
--name default-to-firewall
--address-prefix 0.0.0.0/0
--next-hop-type VirtualAppliance
--next-hop-ip-address "$FW_PRIVATE_IP"

az network route-table create
--resource-group networking-rg
--name spoke-route-table

az network route-table route create
--resource-group networking-rg
--route-table-name spoke-route-table
--name default-to-firewall
--address-prefix 0.0.0.0/0
--next-hop-type VirtualAppliance
--next-hop-ip-address "$FW_PRIVATE_IP"

Associate route table with spoke subnet

az network vnet subnet update
--resource-group networking-rg
--vnet-name spoke-prod-vnet
--name app-subnet
--route-table spoke-route-table

undefined

az network vnet subnet update
--resource-group networking-rg
--vnet-name spoke-prod-vnet
--name app-subnet
--route-table spoke-route-table

undefined

Application Gateway with WAF

带WAF的应用程序网关

bash

undefined

bash

undefined

Create public IP

az network public-ip create
--resource-group networking-rg
--name appgw-public-ip
--sku Standard
--allocation-method Static

Create Application Gateway subnet

az network vnet subnet create
--resource-group networking-rg
--vnet-name spoke-prod-vnet
--name AppGatewaySubnet
--address-prefix 10.1.10.0/24

Create Application Gateway with WAF v2

az network application-gateway create
--resource-group networking-rg
--name myapp-appgw
--location eastus
--sku WAF_v2
--capacity 2
--vnet-name spoke-prod-vnet
--subnet AppGatewaySubnet
--public-ip-address appgw-public-ip
--http-settings-port 80
--http-settings-protocol Http
--frontend-port 443
--servers 10.1.2.4 10.1.2.5

Enable WAF policy

az network application-gateway waf-policy create
--resource-group networking-rg
--name myapp-waf-policy

az network application-gateway waf-policy managed-rule rule-set add
--resource-group networking-rg
--policy-name myapp-waf-policy
--type OWASP
--version 3.2

undefined

az network application-gateway waf-policy create
--resource-group networking-rg
--name myapp-waf-policy

az network application-gateway waf-policy managed-rule rule-set add
--resource-group networking-rg
--policy-name myapp-waf-policy
--type OWASP
--version 3.2

undefined

Terraform Configuration

Terraform配置

hcl

resource "azurerm_virtual_network" "hub" {
  name                = "hub-vnet"
  location            = azurerm_resource_group.networking.location
  resource_group_name = azurerm_resource_group.networking.name
  address_space       = ["10.0.0.0/16"]
  tags                = var.tags
}

resource "azurerm_subnet" "firewall" {
  name                 = "AzureFirewallSubnet"
  resource_group_name  = azurerm_resource_group.networking.name
  virtual_network_name = azurerm_virtual_network.hub.name
  address_prefixes     = ["10.0.1.0/26"]
}

resource "azurerm_virtual_network" "spoke" {
  name                = "spoke-prod-vnet"
  location            = azurerm_resource_group.networking.location
  resource_group_name = azurerm_resource_group.networking.name
  address_space       = ["10.1.0.0/16"]
  tags                = var.tags
}

resource "azurerm_subnet" "web" {
  name                 = "web-subnet"
  resource_group_name  = azurerm_resource_group.networking.name
  virtual_network_name = azurerm_virtual_network.spoke.name
  address_prefixes     = ["10.1.1.0/24"]
}

resource "azurerm_network_security_group" "web" {
  name                = "web-nsg"
  location            = azurerm_resource_group.networking.location
  resource_group_name = azurerm_resource_group.networking.name

  security_rule {
    name                       = "AllowHTTPS"
    priority                   = 100
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "443"
    source_address_prefix      = "Internet"
    destination_address_prefix = "*"
  }

  security_rule {
    name                       = "DenyAllInbound"
    priority                   = 4096
    direction                  = "Inbound"
    access                     = "Deny"
    protocol                   = "*"
    source_port_range          = "*"
    destination_port_range     = "*"
    source_address_prefix      = "*"
    destination_address_prefix = "*"
  }

  tags = var.tags
}

resource "azurerm_subnet_network_security_group_association" "web" {
  subnet_id                 = azurerm_subnet.web.id
  network_security_group_id = azurerm_network_security_group.web.id
}

resource "azurerm_virtual_network_peering" "hub_to_spoke" {
  name                      = "hub-to-spoke"
  resource_group_name       = azurerm_resource_group.networking.name
  virtual_network_name      = azurerm_virtual_network.hub.name
  remote_virtual_network_id = azurerm_virtual_network.spoke.id
  allow_forwarded_traffic   = true
  allow_gateway_transit     = true
}

resource "azurerm_virtual_network_peering" "spoke_to_hub" {
  name                      = "spoke-to-hub"
  resource_group_name       = azurerm_resource_group.networking.name
  virtual_network_name      = azurerm_virtual_network.spoke.name
  remote_virtual_network_id = azurerm_virtual_network.hub.id
  allow_forwarded_traffic   = true
  use_remote_gateways       = false
}

resource "azurerm_private_endpoint" "sql" {
  name                = "sql-private-endpoint"
  location            = azurerm_resource_group.networking.location
  resource_group_name = azurerm_resource_group.networking.name
  subnet_id           = azurerm_subnet.data.id

  private_service_connection {
    name                           = "sql-connection"
    private_connection_resource_id = azurerm_mssql_server.main.id
    subresource_names              = ["sqlServer"]
    is_manual_connection           = false
  }

  private_dns_zone_group {
    name                 = "sql-dns-group"
    private_dns_zone_ids = [azurerm_private_dns_zone.sql.id]
  }
}

hcl

resource "azurerm_virtual_network" "hub" {
  name                = "hub-vnet"
  location            = azurerm_resource_group.networking.location
  resource_group_name = azurerm_resource_group.networking.name
  address_space       = ["10.0.0.0/16"]
  tags                = var.tags
}

resource "azurerm_subnet" "firewall" {
  name                 = "AzureFirewallSubnet"
  resource_group_name  = azurerm_resource_group.networking.name
  virtual_network_name = azurerm_virtual_network.hub.name
  address_prefixes     = ["10.0.1.0/26"]
}

resource "azurerm_virtual_network" "spoke" {
  name                = "spoke-prod-vnet"
  location            = azurerm_resource_group.networking.location
  resource_group_name = azurerm_resource_group.networking.name
  address_space       = ["10.1.0.0/16"]
  tags                = var.tags
}

resource "azurerm_subnet" "web" {
  name                 = "web-subnet"
  resource_group_name  = azurerm_resource_group.networking.name
  virtual_network_name = azurerm_virtual_network.spoke.name
  address_prefixes     = ["10.1.1.0/24"]
}

resource "azurerm_network_security_group" "web" {
  name                = "web-nsg"
  location            = azurerm_resource_group.networking.location
  resource_group_name = azurerm_resource_group.networking.name

  security_rule {
    name                       = "AllowHTTPS"
    priority                   = 100
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "443"
    source_address_prefix      = "Internet"
    destination_address_prefix = "*"
  }

  security_rule {
    name                       = "DenyAllInbound"
    priority                   = 4096
    direction                  = "Inbound"
    access                     = "Deny"
    protocol                   = "*"
    source_port_range          = "*"
    destination_port_range     = "*"
    source_address_prefix      = "*"
    destination_address_prefix = "*"
  }

  tags = var.tags
}

resource "azurerm_subnet_network_security_group_association" "web" {
  subnet_id                 = azurerm_subnet.web.id
  network_security_group_id = azurerm_network_security_group.web.id
}

resource "azurerm_virtual_network_peering" "hub_to_spoke" {
  name                      = "hub-to-spoke"
  resource_group_name       = azurerm_resource_group.networking.name
  virtual_network_name      = azurerm_virtual_network.hub.name
  remote_virtual_network_id = azurerm_virtual_network.spoke.id
  allow_forwarded_traffic   = true
  allow_gateway_transit     = true
}

resource "azurerm_virtual_network_peering" "spoke_to_hub" {
  name                      = "spoke-to-hub"
  resource_group_name       = azurerm_resource_group.networking.name
  virtual_network_name      = azurerm_virtual_network.spoke.name
  remote_virtual_network_id = azurerm_virtual_network.hub.id
  allow_forwarded_traffic   = true
  use_remote_gateways       = false
}

resource "azurerm_private_endpoint" "sql" {
  name                = "sql-private-endpoint"
  location            = azurerm_resource_group.networking.location
  resource_group_name = azurerm_resource_group.networking.name
  subnet_id           = azurerm_subnet.data.id

  private_service_connection {
    name                           = "sql-connection"
    private_connection_resource_id = azurerm_mssql_server.main.id
    subresource_names              = ["sqlServer"]
    is_manual_connection           = false
  }

  private_dns_zone_group {
    name                 = "sql-dns-group"
    private_dns_zone_ids = [azurerm_private_dns_zone.sql.id]
  }
}

Troubleshooting

故障排查

Symptom	Cause	Fix
VMs cannot reach the internet	NSG blocking outbound or missing route	Check NSG rules with `az network nic list-effective-nsg` ; verify route table
VNet peering shows `Disconnected`	Peering created in one direction only	Create peering from both sides (hub-to-spoke AND spoke-to-hub)
Private endpoint DNS not resolving	Private DNS zone not linked to VNet	Link DNS zone with `az network private-dns link vnet create`
NSG rule not taking effect	Higher-priority rule overriding	List rules with `az network nsg rule list` and check priority ordering
Application Gateway health probes failing	Backend pool servers unreachable	Verify NSG allows traffic from the AppGateway subnet
Azure Firewall blocking legitimate traffic	Missing application or network rule	Check firewall logs in Log Analytics; add appropriate rule
Cross-VNet communication failing	Peering not configured or route missing	Verify peering status and that `allow-vnet-access` is enabled
High latency between regions	Traffic routing through unexpected path	Use `az network watcher next-hop` to diagnose routing

症状	原因	解决方法
虚拟机无法访问互联网	NSG阻止出站流量或缺少路由规则	使用 `az network nic list-effective-nsg` 检查NSG规则；验证路由表
虚拟网络对等连接显示 `Disconnected`	仅在单向创建了对等连接	在双向创建对等连接（中心到辐射以及辐射到中心）
专用终结点DNS无法解析	专用DNS区域未链接到虚拟网络	使用 `az network private-dns link vnet create` 链接DNS区域
NSG规则未生效	更高优先级的规则覆盖了当前规则	使用 `az network nsg rule list` 列出规则并检查优先级顺序
应用程序网关健康探测失败	后端池服务器无法访问	验证NSG是否允许来自应用程序网关子网的流量
Azure防火墙阻止合法流量	缺少应用程序或网络规则	在日志分析中检查防火墙日志；添加相应规则
跨虚拟网络通信失败	未配置对等连接或缺少路由	验证对等连接状态以及 `allow-vnet-access` 是否已启用
区域间延迟过高	流量通过意外路径路由	使用 `az network watcher next-hop` 诊断路由情况

azure-networking

Original

Translation

Azure Networking

Azure 网络配置

When to Use

适用场景

Prerequisites

前提条件

Install Azure CLI

Install Azure CLI

Login and set subscription

Login and set subscription

Register required providers

Register required providers

Create resource group

Create resource group

VNet and Subnet Creation

虚拟网络与子网创建

Hub VNet

中心虚拟网络（Hub VNet）

Create hub VNet for shared services

Create hub VNet for shared services

Add subnets to hub

Add subnets to hub

Spoke VNet

辐射虚拟网络（Spoke VNet）

Create spoke VNet for application workloads

Create spoke VNet for application workloads

List all subnets in a VNet

List all subnets in a VNet

Network Security Groups

网络安全组（NSGs）

Create NSG for web tier

Create NSG for web tier

Allow HTTPS from internet

Allow HTTPS from internet

Allow HTTP for redirect

Allow HTTP for redirect

Deny all other inbound traffic

Deny all other inbound traffic

Create NSG for app tier -- only allow from web subnet

Create NSG for app tier -- only allow from web subnet

Create NSG for data tier -- only allow from app subnet

Create NSG for data tier -- only allow from app subnet

Associate NSG with subnet

Associate NSG with subnet

View effective NSG rules

View effective NSG rules

VNet Peering

虚拟网络对等连接（VNet Peering）

Peer hub to spoke

Peer hub to spoke

Peer spoke to hub

Peer spoke to hub

Verify peering status

Verify peering status

Private Endpoints

专用终结点（Private Endpoints）

Create private endpoint for Azure SQL

Create private endpoint for Azure SQL

Create private DNS zone for SQL

Create private DNS zone for SQL

Link DNS zone to VNet

Link DNS zone to VNet

Create DNS record for the private endpoint

Create DNS record for the private endpoint

Create private endpoint for Storage Account

Create private endpoint for Storage Account

Create private endpoint for Key Vault

Create private endpoint for Key Vault

Azure Firewall

Azure防火墙

Create public IP for firewall

Create public IP for firewall

Create Azure Firewall

Create Azure Firewall

Configure firewall IP

Configure firewall IP

Get firewall private IP for route tables