Digital Foundations

A VNet is your private network in Azure. It provides isolation and security for your .NET resources.

1. VNet Peering

Want to connect two different VNets (e.g., a 'Shared Services' VNet and an 'App' VNet)? Use **VNet Peering**. It allows resources in different VNets to talk to each other over the Microsoft backbone network as if they were in the same network. This is the core of the 'Hub-and-Spoke' architecture.

2. Private Endpoints

This is critical for security. By default, Azure SQL and Key Vault have public internet endpoints. A **Private Endpoint** gives these services a private IP address inside your VNet. Your .NET app then talks to them over a private line, and you can disable all public access completely.

3. Architect Insight

Q: "How should I design my subnets?"

Architect Answer: "Use specialized subnets. Create a **GatewaySubnet** for your VPN/ExpressRoute, a **WebSubnet** for your Load Balancers, and a **DataSubnet** for your databases. Always use **Network Security Groups (NSGs)** at the subnet level to restrict traffic (e.g., 'Only allow WebSubnet to talk to DataSubnet on port 1433')."