What is Azure Virtual Network(VNet) and how does it work?

Azure Virtual Network (VNet) is a private network in the Azure cloud that is dedicated to a subscription. It lets Azure resources (like virtual machines) securely communicate with each other, with the internet, and with on-premises networks.

In simple terms:

• A VNet is a logical, private network inside Azure.
• It is isolated from other customers’ networks.
• It uses IP address ranges and subnets, similar to a traditional datacenter network.

How it works (high level):

1. A VNet is created with an IP address range (CIDR block), for example 10.0.0.0/16.
2. That range is split into subnets (for example 10.0.1.0/24 for web servers, 10.0.2.0/24 for databases).
3. Azure resources (VMs, AKS nodes, etc.) get IP addresses from these subnets and can talk to each other privately inside the VNet.
4. The VNet can be:
   • Connected to the internet (for example via public IPs, NAT gateway, or load balancer).
   • Connected to on-premises networks using VPN or ExpressRoute.
   • Peered with other VNets so resources in different VNets can communicate.

House/apartment road analogy:

• Think of Azure as a big city.
• A VNet is like a gated community or private neighborhood inside that city:
  • It has its own internal roads and house numbers (IP addresses).
  • Only residents and allowed visitors can move around inside.
• Subnets are like streets inside that gated community:
  • One street for houses (web servers), another for shops (databases), etc.
• Virtual machines and other resources are like houses on those streets, each with its own address.
• Network security groups are like security guards or gates controlling which cars/people (traffic/ports) can enter or leave certain streets.
• VNet peering is like building a private road between two gated communities, so residents can visit each other without going through the public city roads.
• VPN/ExpressRoute is like building a private tunnel or dedicated highway between an on-premises office and the Azure gated community.

How it’s different from “normal internet”:

• Normal internet is a public network: anyone can try to talk to anyone, and security is added on top (firewalls, encryption).
• A VNet is a private, isolated network:
  • Only resources inside the VNet (and explicitly connected networks) can communicate over it.
  • IP ranges are not advertised to the internet.
  • Security policies, routing, and DNS are under full control inside that private space.

For AZ-900, key points to remember:

• VNet = private, isolated network in Azure.
• Used to connect Azure resources to each other, the internet, and on-premises.
• Supports subnets, peering, VPN, ExpressRoute, and security controls like network security groups.

References:

• What is Azure Virtual Network?
• Azure Virtual Network concepts and best practices
• Azure Virtual Network frequently asked questions (FAQ)
• Azure for network engineers
• What is a virtual network (VNet)?
• Introduction to Azure security