Home / Lab Collections / Building Redundant Cloud Solutions in Azure

Hands-On Azure Labs: Building Redundant Cloud Solutions

Lab 24 of 29: Deploy and Configure Azure Front Door CDN Profile

🔒 This lab is part of the Building Redundant Cloud Solutions collection. An active subscription to this collection is required on labITpro to unlock the hands-on exercises.

Unlock Access Now

Already have a subscription to this collection? Log in to access the labs.

💡 If you've arrived from a Udemy course, please review the "Course Setup" lecture for step-by-step lab access instructions.

Azure Virtual Networks — Quick Reference

Fast lookup for subnets, peering, routing, security, DNS & CLI.

VNet Fundamentals

Private address space (RFC 1918): 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
Subnets partition the VNet address space.
Each subnet reserves 5 IPs for Azure services.
VNets are region-specific.
Enable DDoS Protection Standard for critical workloads.

Example: VNet 10.0.0.0/16 → Subnet 10.0.1.0/24 (251 usable IPs)

Subnets & Routing

Route Type	Priority
System (local)	Highest
User-defined (custom)	Medium
BGP routes	Low

Assign NSGs to subnets or NICs.
Use Route Tables for traffic control.
Enable flow logs for diagnostics.

Connectivity

VNet Peering: Low-latency inter-VNet (same/different region).
VPN Gateway: Site-to-site or point-to-site.
ExpressRoute: Private, dedicated connection to Azure.
Azure Firewall: Centralized filtering & logging.

Network Security Groups (NSGs)

Stateful firewall (inbound/outbound rules).
Default: Deny all inbound, Allow all outbound.
Rules: Priority (100–4096), Source, Destination, Protocol, Port.
Apply to subnets or NICs; NIC rules override subnet rules.

Tip: Use Service Tags (e.g., AzureCloud, Internet) for simplified rules.

DNS & Name Resolution

Option	Use Case
Azure DNS (168.63.129.16)	Default internal
Custom DNS	On-premises or third-party
Private DNS Zones	Custom domains in VNet

Configure DNS servers in VNet settings.

Service Endpoints & Private Endpoints

Service Endpoints: Route PaaS traffic over Azure backbone.
Private Endpoints: Inject PaaS into VNet with private IP.
Both restrict access to authorized VNets/subnets.

Prefer Private Endpoints for production security.

VNet Peering

Connect two VNets for direct communication.
Non-transitive; gateway transit available.
No bandwidth charges for peered traffic.
Works across subscriptions & regions (global peering).

Regional peering is faster; remote peering adds slight latency.

VPN & Hybrid Connectivity

S2S VPN: On-premises to Azure site-to-site.
P2S VPN: Individual clients to Azure.
ExpressRoute: Dedicated, low-latency, high throughput.
HA: Dual gateways, zone redundancy, or multiple ExpressRoute circuits.

Monitoring & Diagnostics

Enable Network Watcher for troubleshooting.
NSG Flow Logs: Capture traffic patterns.
Connection Monitor: Track end-to-end connectivity.
Diagnostics: IP flow verify, effective routes, packet capture.

Azure Virtual Networks — Quick Reference

Fast lookup for subnets, peering, routing, security, DNS & CLI.

VNet Fundamentals

Private address space (RFC 1918): 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
Subnets partition the VNet address space.
Each subnet reserves 5 IPs for Azure services.
VNets are region-specific.
Enable DDoS Protection Standard for critical workloads.

Example: VNet 10.0.0.0/16 → Subnet 10.0.1.0/24 (251 usable IPs)

Subnets & Routing

Route Type	Priority
System (local)	Highest
User-defined (custom)	Medium
BGP routes	Low

Assign NSGs to subnets or NICs.
Use Route Tables for traffic control.
Enable flow logs for diagnostics.

Connectivity

VNet Peering: Low-latency inter-VNet (same/different region).
VPN Gateway: Site-to-site or point-to-site.
ExpressRoute: Private, dedicated connection to Azure.
Azure Firewall: Centralized filtering & logging.

Network Security Groups (NSGs)

Stateful firewall (inbound/outbound rules).
Default: Deny all inbound, Allow all outbound.
Rules: Priority (100–4096), Source, Destination, Protocol, Port.
Apply to subnets or NICs; NIC rules override subnet rules.

Tip: Use Service Tags (e.g., AzureCloud, Internet) for simplified rules.

DNS & Name Resolution

Option	Use Case
Azure DNS (168.63.129.16)	Default internal
Custom DNS	On-premises or third-party
Private DNS Zones	Custom domains in VNet

Configure DNS servers in VNet settings.

Service Endpoints & Private Endpoints

Service Endpoints: Route PaaS traffic over Azure backbone.
Private Endpoints: Inject PaaS into VNet with private IP.
Both restrict access to authorized VNets/subnets.

Prefer Private Endpoints for production security.

VNet Peering

Connect two VNets for direct communication.
Non-transitive; gateway transit available.
No bandwidth charges for peered traffic.
Works across subscriptions & regions (global peering).

Regional peering is faster; remote peering adds slight latency.

VPN & Hybrid Connectivity

S2S VPN: On-premises to Azure site-to-site.
P2S VPN: Individual clients to Azure.
ExpressRoute: Dedicated, low-latency, high throughput.
HA: Dual gateways, zone redundancy, or multiple ExpressRoute circuits.

Monitoring & Diagnostics

Enable Network Watcher for troubleshooting.
NSG Flow Logs: Capture traffic patterns.
Connection Monitor: Track end-to-end connectivity.
Diagnostics: IP flow verify, effective routes, packet capture.

This feature is available to labITpro Supporters only.

Azure VM Scale Sets — Quick Reference

Fast lookup for orchestration modes, autoscaling, load balancing, updates & CLI.

Core Benefits

Create & manage groups of identical or heterogeneous VMs.
Automatic scaling based on demand or schedule.
Load balance traffic across instances.
HA across fault domains & availability zones.
Pay only for VMs; no charge for scale set itself.

Scale sets can handle up to 1,000 VMs (Marketplace/Gallery images).

Orchestration Modes

Mode	Profile	Best For
Flexible	Standard Azure VMs	New workloads (default)
Uniform	Identical VMs	Legacy large-scale workloads

Flexible: Full standard VM APIs, dynamic mixing (Spot+on-demand), 1,000 VMs. Uniform: Locked after creation; up to 1,000 VMs (Marketplace) or 600 (custom images).

Orchestration Comparison

Feature	Flexible	Uniform
Standard VM APIs	Yes	No
Mix instance types	Yes	No
RBAC per VM	Yes	No
Azure Backup	Yes	No
Site Recovery	Yes	No
Fault domains	1–3	1–5

Autoscaling Metrics

Host metrics: CPU, memory, disk (no agent needed).
Guest metrics: Custom counters (Azure Diagnostics Extension).
App Insights: Application-level performance metrics.
Rules: Min/max capacity, scale-out/in thresholds, cooldown periods.

Autoscale rules use metrics from Load Balancer, Diagnostics, or App Insights.

Load Balancing

Type	Layer	Best For
Internal LB	L4	Backend pools
Public LB	L4	External traffic
App Gateway	L7	HTTP/HTTPS + WAF

Large scale sets (>100 VMs) require Load Balancer Standard SKU.

Availability & Zones

Single zone: All VMs in one availability zone.
Zone-redundant: VMs spread across 1, 2, or 3 zones in region.
Zone balance: Auto-spread VMs evenly across zones (±1 VM).
Fault domains: 1–3 per zone for best-effort resilience.

Use availability zones for datacenter-level failure protection.

Upgrade Policies (Uniform)

Policy	Rollout	Use
Automatic	Batch	App can tolerate disruption
Rolling	Controlled	Gradual, managed updates
Manual	On-demand	Full control; explicit API calls

Flexible mode uses standard VM updates; no built-in rolling.

Instance Protection

Prevent accidental scale-in or deletion of specific VMs.
Useful for running long-lived or stateful workloads.
Protected instances still receive updates & patching.
Supported in both Flexible & Uniform modes.

Application Deployment

Custom image: Preinstall app; faster provisioning.
Custom Script Extension: Download & run scripts post-deploy.
Azure VM Applications: Package & manage centrally (new).
PowerShell DSC: Desired State Configuration for consistency.

Custom images: 600 VMs max; Marketplace images: 1,000 VMs.

Planned Maintenance & Health

Azure Patch Manager: Automated guest OS patching.
Application Health Extension: Monitor app heartbeat; auto-replace unhealthy.
Health probes (Uniform): Monitor via load balancer.
Platform updates coordinated; typically brief interruption.

Scaling Limits & Quotas

Max 1,000 VMs (Flexible/Uniform on Marketplace).
Custom images: Uniform max 600 VMs, Flexible 1,000.
Large scale sets (>100): Multiple placement groups; requires managed disks.
Overprovisioning: Spin extra VMs for faster provisioning; not billed.

This feature is available to labITpro Supporters only.

Azure VM Scale Sets — Quick Reference

Fast lookup for orchestration modes, autoscaling, load balancing, updates & CLI.

Core Benefits

Create & manage groups of identical or heterogeneous VMs.
Automatic scaling based on demand or schedule.
Load balance traffic across instances.
HA across fault domains & availability zones.
Pay only for VMs; no charge for scale set itself.

Scale sets can handle up to 1,000 VMs (Marketplace/Gallery images).

Orchestration Modes

Mode	Profile	Best For
Flexible	Standard Azure VMs	New workloads (default)
Uniform	Identical VMs	Legacy large-scale workloads

Flexible: Full standard VM APIs, dynamic mixing (Spot+on-demand), 1,000 VMs. Uniform: Locked after creation; up to 1,000 VMs (Marketplace) or 600 (custom images).

Orchestration Comparison

Feature	Flexible	Uniform
Standard VM APIs	Yes	No
Mix instance types	Yes	No
RBAC per VM	Yes	No
Azure Backup	Yes	No
Site Recovery	Yes	No
Fault domains	1–3	1–5

Autoscaling Metrics

Host metrics: CPU, memory, disk (no agent needed).
Guest metrics: Custom counters (Azure Diagnostics Extension).
App Insights: Application-level performance metrics.
Rules: Min/max capacity, scale-out/in thresholds, cooldown periods.

Autoscale rules use metrics from Load Balancer, Diagnostics, or App Insights.

Load Balancing

Type	Layer	Best For
Internal LB	L4	Backend pools
Public LB	L4	External traffic
App Gateway	L7	HTTP/HTTPS + WAF

Large scale sets (>100 VMs) require Load Balancer Standard SKU.

Availability & Zones

Single zone: All VMs in one availability zone.
Zone-redundant: VMs spread across 1, 2, or 3 zones in region.
Zone balance: Auto-spread VMs evenly across zones (±1 VM).
Fault domains: 1–3 per zone for best-effort resilience.

Use availability zones for datacenter-level failure protection.

Upgrade Policies (Uniform)

Policy	Rollout	Use
Automatic	Batch	App can tolerate disruption
Rolling	Controlled	Gradual, managed updates
Manual	On-demand	Full control; explicit API calls

Flexible mode uses standard VM updates; no built-in rolling.

Application Deployment

Custom image: Preinstall app; faster provisioning.
Custom Script Extension: Download & run scripts post-deploy.
Azure VM Applications: Package & manage centrally (new).
PowerShell DSC: Desired State Configuration for consistency.

Custom images: 600 VMs max; Marketplace images: 1,000 VMs.

Planned Maintenance & Health

Azure Patch Manager: Automated guest OS patching.
Application Health Extension: Monitor app heartbeat; auto-replace unhealthy.
Health probes (Uniform): Monitor via load balancer.
Platform updates coordinated; typically brief interruption.

This feature is available to labITpro Supporters only.

Azure VM Scale Sets — Quick Reference

Fast lookup for orchestration modes, autoscaling, load balancing, updates & CLI.

Core Benefits

Create & manage groups of identical or heterogeneous VMs.
Automatic scaling based on demand or schedule.
Load balance traffic across instances.
HA across fault domains & availability zones.
Pay only for VMs; no charge for scale set itself.

Scale sets can handle up to 1,000 VMs (Marketplace/Gallery images).

Orchestration Modes

Mode	Profile	Best For
Flexible	Standard Azure VMs	New workloads (default)
Uniform	Identical VMs	Legacy large-scale workloads

Flexible: Full standard VM APIs, dynamic mixing (Spot+on-demand), 1,000 VMs. Uniform: Locked after creation; up to 1,000 VMs (Marketplace) or 600 (custom images).

Orchestration Comparison

Feature	Flexible	Uniform
Standard VM APIs	Yes	No
Mix instance types	Yes	No
RBAC per VM	Yes	No
Azure Backup	Yes	No
Site Recovery	Yes	No
Fault domains	1–3	1–5

Autoscaling Metrics

Host metrics: CPU, memory, disk (no agent needed).
Guest metrics: Custom counters (Azure Diagnostics Extension).
App Insights: Application-level performance metrics.
Rules: Min/max capacity, scale-out/in thresholds, cooldown periods.

Autoscale rules use metrics from Load Balancer, Diagnostics, or App Insights.

Load Balancing

Type	Layer	Best For
Internal LB	L4	Backend pools
Public LB	L4	External traffic
App Gateway	L7	HTTP/HTTPS + WAF

Large scale sets (>100 VMs) require Load Balancer Standard SKU.

Availability & Zones

Single zone: All VMs in one availability zone.
Zone-redundant: VMs spread across 1, 2, or 3 zones in region.
Zone balance: Auto-spread VMs evenly across zones (±1 VM).
Fault domains: 1–3 per zone for best-effort resilience.

Use availability zones for datacenter-level failure protection.

Upgrade Policies (Uniform)

Policy	Rollout	Use
Automatic	Batch	App can tolerate disruption
Rolling	Controlled	Gradual, managed updates
Manual	On-demand	Full control; explicit API calls

Flexible mode uses standard VM updates; no built-in rolling.

Application Deployment

Custom image: Preinstall app; faster provisioning.
Custom Script Extension: Download & run scripts post-deploy.
Azure VM Applications: Package & manage centrally (new).
PowerShell DSC: Desired State Configuration for consistency.

Custom images: 600 VMs max; Marketplace images: 1,000 VMs.

Planned Maintenance & Health

Azure Patch Manager: Automated guest OS patching.
Application Health Extension: Monitor app heartbeat; auto-replace unhealthy.
Health probes (Uniform): Monitor via load balancer.
Platform updates coordinated; typically brief interruption.

Azure Virtual Machines — Quick Reference

Fast lookup for sizes, storage, networking, HA, pricing & CLI.

VM Sizing (Workload Fit)

Series	Profile	Use
B	Burstable	Dev/Test
D	General	Web/App
E	Memory	DB / Analytics
F	Compute	Batch / CPU Heavy
Ls	Storage IO	NoSQL / Throughput
M	High RAM	SAP HANA
N	GPU	AI / ML / Rendering

Default starting points: D-series (general), E-series (DB workloads).

Disk Selection

Disk	Perf	When
Standard HDD	Low	Archive / Rare
Standard SSD	Medium	General Workloads
Premium SSD	High	Production Apps
Premium SSD v2	High+	Tunable Perf
Ultra Disk	Extreme	Critical DB I/O

Use multiple data disks + Storage Spaces for higher throughput.
Consider host caching (ReadOnly vs RW).

Networking

Place VMs in VNets & subnets with NSGs.
Use Azure Bastion or JIT instead of public RDP/SSH.
Load Balancer (L4) vs App Gateway (L7/WAF).
Use Private Endpoints for PaaS access.

Availability / Resilience

Availability Sets → host/rack failure protection.
Availability Zones → datacenter failure protection.
Scale Sets → autoscale by metrics.
Use Azure Backup + ASR for DR.

Security

Use Managed Identity instead of stored credentials.
Store secrets in Key Vault.
Patch via Update Manager.
Enable Defender for Cloud.

Pricing Models

Pay-as-you-go: Flexible
Reservations: 1–3 yr commit, lower cost
Spot: Very low cost, but can be evicted

Azure Virtual Machines — Quick Reference

Fast lookup for sizes, storage, networking, HA, pricing & CLI.

VM Sizing (Workload Fit)

Series	Profile	Use
B	Burstable	Dev/Test
D	General	Web/App
E	Memory	DB / Analytics
F	Compute	Batch / CPU Heavy
Ls	Storage IO	NoSQL / Throughput
M	High RAM	SAP HANA
N	GPU	AI / ML / Rendering

Default starting points: D-series (general), E-series (DB workloads).

Disk Selection

Disk	Perf	When
Standard HDD	Low	Archive / Rare
Standard SSD	Medium	General Workloads
Premium SSD	High	Production Apps
Premium SSD v2	High+	Tunable Perf
Ultra Disk	Extreme	Critical DB I/O

Use multiple data disks + Storage Spaces for higher throughput.
Consider host caching (ReadOnly vs RW).

Networking

Place VMs in VNets & subnets with NSGs.
Use Azure Bastion or JIT instead of public RDP/SSH.
Load Balancer (L4) vs App Gateway (L7/WAF).
Use Private Endpoints for PaaS access.

Availability / Resilience

Availability Sets → host/rack failure protection.
Availability Zones → datacenter failure protection.
Scale Sets → autoscale by metrics.
Use Azure Backup + ASR for DR.

Security

Use Managed Identity instead of stored credentials.
Store secrets in Key Vault.
Patch via Update Manager.
Enable Defender for Cloud.

Pricing Models

Pay-as-you-go: Flexible
Reservations: 1–3 yr commit, lower cost
Spot: Very low cost, but can be evicted

Hands-On Azure Labs: Building Redundant Cloud Solutions

Lab 24 of 29: Deploy and Configure Azure Front Door CDN Profile

Ask The Author

Azure vNets Explained

Azure Files in Under a Minute

An Introduction to Microsoft Entra ID

VMs Made Easy: A Deep Dive Into All VM Settings