WEBVTT
Kind: captions
Language: en

1
00:00:00.000 --> 00:00:07.694
In Lesson 1, our web app's virtual machine had a network interface connected to something called

2
00:00:07.694 --> 00:00:14.187
a virtual network. In this lesson, we'll open that up: what a virtual network is,

3
00:00:14.187 --> 00:00:21.400
how it's divided into subnets, and how traffic is allowed or blocked on its way to the VM.

4
00:00:21.800 --> 00:00:27.752
An Azure virtual network, or VNet, is a logical network for your Azure resources.

5
00:00:27.752 --> 00:00:35.027
It's isolated from other customers' networks, and inside it you decide how resources are addressed,

6
00:00:35.027 --> 00:00:42.228
how they're grouped and how traffic is filtered. Think of it as the private network you'd build in

7
00:00:42.228 --> 00:00:44.800
an office, but defined in software.

8
00:00:45.200 --> 00:00:51.439
Every VNet has an address space: a range of private IP addresses, written in CIDR notation.

9
00:00:51.439 --> 00:00:58.432
In our example, it's 10.0.0.0/16, which contains 65,536 addresses. Microsoft recommends private ranges

10
00:00:58.432 --> 00:01:05.289
like this one. Plan the range carefully, so it doesn't overlap with other networks you might connect

11
00:01:05.289 --> 00:01:05.700
later.

12
00:01:06.100 --> 00:01:12.371
We divide the address space into subnets. Here, snet-web, 10.0.1.0/24, is for our web tier,

13
00:01:12.371 --> 00:01:19.124
and snet-data, 10.0.2.0/24, leaves room for other resources later. Subnets let you group resources

14
00:01:19.124 --> 00:01:22.500
and apply different security rules to each group.

15
00:01:22.900 --> 00:01:30.845
Our VM sits in the web subnet. Its network interface receives a private IP address from the subnet's

16
00:01:30.845 --> 00:01:38.154
range: in this example, 10.0.1.4. Why not .1? Azure reserves five addresses in every subnet:

17
00:01:38.154 --> 00:01:43.000
the first four and the last. Here, that's .0 to .3, and .255.

18
00:01:43.400 --> 00:01:50.281
For users on the internet to reach the app, there has to be a way in. In our example,

19
00:01:50.281 --> 00:01:57.324
the VM's network interface has a public IP address. A request travels from the browser,

20
00:01:57.324 --> 00:02:04.610
across the internet, to that public IP, and Azure delivers it to the VM's private address.

21
00:02:04.610 --> 00:02:08.900
Other designs use a load balancer or gateway instead.

22
00:02:09.300 --> 00:02:16.888
But should every request get through? A network security group, or NSG, is a set of rules that allow

23
00:02:16.888 --> 00:02:23.034
or deny traffic. You can associate one with a subnet or with a network interface.

24
00:02:23.034 --> 00:02:30.319
Each rule matches traffic by source, destination, port and protocol, and has a priority from 100

25
00:02:30.319 --> 00:02:37.300
to 4096. Lower numbers are checked first, and once traffic matches a rule, processing stops.

26
00:02:37.700 --> 00:02:44.568
Our example NSG has a rule at priority 100 that allows HTTPS on port 443 from the internet,

27
00:02:44.568 --> 00:02:50.983
so web requests get through. An SSH connection attempt from the internet, on port 22,

28
00:02:50.983 --> 00:02:58.153
matches no allow rule. It falls through to the default rule, DenyAllInbound, at priority 65500,

29
00:02:58.153 --> 00:03:05.700
and it's denied. Default rules have the lowest priority, so your own rules are always checked first.

30
00:03:06.100 --> 00:03:12.974
Here's the key takeaway: being in Azure doesn't guarantee connectivity. Traffic flows only when the

31
00:03:12.974 --> 00:03:18.946
configuration allows it: the VNet and subnet, the network interface and its addresses,

32
00:03:18.946 --> 00:03:25.473
the NSG rules, the routes, and of course an application that's actually listening on the port.

33
00:03:25.473 --> 00:03:29.500
When something can't connect, check each of these in turn.

34
00:03:29.900 --> 00:03:37.447
To recap: a VNet is a logical, isolated network for your Azure resources. Its address space is divided

35
00:03:37.447 --> 00:03:44.699
into subnets. A VM connects to a subnet through its network interface. And network security groups

36
00:03:44.699 --> 00:03:52.172
filter traffic with prioritized allow and deny rules. In Lesson 3, our app stores the uploaded photos

37
00:03:52.172 --> 00:03:53.800
in Azure Blob Storage.