Azure Networking Basics
Azure networking mirrors on-prem concepts: a VNet is your network, subnets divide it, NSGs filter traffic like stateful ACLs, and VPN Gateway / ExpressRoute connect it back to your datacentre. Here is the mapping and what differs from AWS.
The translation table
| On-prem / AWS concept | Azure equivalent |
|---|---|
| Network / VPC | VNet (Virtual Network) |
| Security group | NSG (Network Security Group) |
| NAT gateway | Azure NAT Gateway |
| DNS | Azure DNS / Private DNS zones |
| Site-to-site VPN | VPN Gateway |
| Direct Connect / leased line | ExpressRoute |
| VPC peering | VNet Peering |
| Load balancer | Azure Load Balancer / Application Gateway |
VNets, subnets and NSGs
A VNet takes a CIDR block and is divided into subnets (no availability-zone binding like AWS — subnets span zones). NSGs are stateful rule sets attachable to subnets or individual NICs — priority-ordered allow/deny rules on source/destination/port, conceptually a stateful ACL. Azure also adds Azure Firewall as a managed, centralised Layer 3–7 firewall when NSGs aren't enough.
Connecting to on-prem
VPN Gateway runs IPsec site-to-site tunnels over the internet; ExpressRoute is the dedicated private circuit (Azure's Direct Connect). VNet Peering joins VNets with low latency, and hub-and-spoke designs put shared services (firewall, VPN) in a hub VNet — a topology any enterprise network engineer will recognise.
Azure vs AWS naming — one habit to build
The concepts are identical; only names change: VPC↔VNet, Security Group↔NSG, Direct Connect↔ExpressRoute, Route 53↔Azure DNS. Learn the concept once (that's the CCNA foundation), then the vendor names are trivia. Compare with AWS networking basics.
Frequently asked questions
What is a VNet in Azure?
A Virtual Network — Azure's isolated network defined by a CIDR block and divided into subnets, equivalent to an on-prem network or an AWS VPC.
What is an NSG?
A Network Security Group — a stateful set of priority-ordered allow/deny rules filtering traffic by source, destination and port, attachable to subnets or individual NICs.
What is the difference between VPN Gateway and ExpressRoute?
VPN Gateway creates encrypted IPsec tunnels over the public internet — quick and lower cost. ExpressRoute is a dedicated private circuit with consistent latency and higher bandwidth, at higher cost.
Is Azure networking different from AWS networking?
The concepts are the same — isolated networks, subnets, stateful filtering, private circuits. Mostly the names differ (VNet vs VPC, NSG vs security group, ExpressRoute vs Direct Connect).
Related articles
Want hands-on training?
Learn this on real Cisco lab devices with placement support at Attila Technologies, Ahmedabad.