<< All versions
Skill v1.0.1
currentAutomated scan100/100sickn33/agentic-awesome-skills/azure-networking
+5 new
──Details
PublishedOctober 30, 2026 at 06:02 PM
Content Hashsha256:0aabef1304c2243f...
Git SHA753c5f7bb646
Bump Typepatch
──Files
Files (1 file, 13.6 KB)
SKILL.md13.6 KBactive
SKILL.md · 470 lines · 13.6 KB
name: azure-networking description: Configure Azure VNets, NSGs, and Azure Firewall. Implement hub-spoke topology and private endpoints. Use when designing Azure network infrastructure. category: devops risk: critical source: https://github.com/BagelHole/DevOps-Security-Agent-Skills source_repo: BagelHole/DevOps-Security-Agent-Skills source_type: community date_added: '2026-09-20' license: MIT license_source: https://github.com/BagelHole/DevOps-Security-Agent-Skills/blob/main/LICENSE compatibility: Requires the relevant OS/platform tooling and privileged access where noted. Docs-only; helper scripts and templates not bundled. metadata: author: devops-skills version: '1.0'
Azure Networking
Design and implement Azure network infrastructure including VNets, subnets, NSGs, VNet peering, private endpoints, Azure Firewall, and Application Gateway. Covers both az CLI commands and Terraform configurations for production hub-spoke topologies.
Examples provision billable infrastructure and alter network access. Confirm tenant/subscription/region, CIDR overlap, target resources, approved exposure and rollback before mutation; inventory existing routes/rules first. These fragments are not a complete production topology.
Prerequisites
bash
# Install Azure CLI# Prerequisite: organization-approved Azure CLI installed from a verified signed package.az version# Login and set subscriptionaz loginaz account set --subscription "my-subscription-id"# Register required providersaz provider register --namespace Microsoft.Network# Create resource groupaz group create --name networking-rg --location eastus
VNet and Subnet Creation
Hub VNet
bash
# Create hub VNet for shared servicesaz network vnet create \--resource-group networking-rg \--name hub-vnet \--address-prefix 10.0.0.0/16 \--location eastus \--tags environment=prod role=hub# Add subnets to hubaz network vnet subnet create \--resource-group networking-rg \--vnet-name hub-vnet \--name AzureFirewallSubnet \--address-prefix 10.0.1.0/26az network vnet subnet create \--resource-group networking-rg \--vnet-name hub-vnet \--name GatewaySubnet \--address-prefix 10.0.2.0/27az network vnet subnet create \--resource-group networking-rg \--vnet-name hub-vnet \--name SharedServicesSubnet \--address-prefix 10.0.3.0/24az network vnet subnet create \--resource-group networking-rg \--vnet-name hub-vnet \--name AzureBastionSubnet \--address-prefix 10.0.4.0/26
Spoke VNet
bash
# Create spoke VNet for application workloadsaz network vnet create \--resource-group networking-rg \--name spoke-prod-vnet \--address-prefix 10.1.0.0/16 \--location eastus \--tags environment=prod role=spokeaz network vnet subnet create \--resource-group networking-rg \--vnet-name spoke-prod-vnet \--name web-subnet \--address-prefix 10.1.1.0/24az network vnet subnet create \--resource-group networking-rg \--vnet-name spoke-prod-vnet \--name app-subnet \--address-prefix 10.1.2.0/24az network vnet subnet create \--resource-group networking-rg \--vnet-name spoke-prod-vnet \--name data-subnet \--address-prefix 10.1.3.0/24 \--private-endpoint-network-policies Enabled# List all subnets in a VNetaz network vnet subnet list \--resource-group networking-rg \--vnet-name spoke-prod-vnet \--output table
Network Security Groups
bash
# Create NSG for web tieraz network nsg create \--resource-group networking-rg \--name web-nsg \--tags tier=web# Allow HTTPS from internetaz network nsg rule create \--resource-group networking-rg \--nsg-name web-nsg \--name AllowHTTPS \--priority 100 \--direction Inbound \--access Allow \--protocol Tcp \--source-address-prefixes Internet \--destination-port-ranges 443# Allow HTTP for redirectaz network nsg rule create \--resource-group networking-rg \--nsg-name web-nsg \--name AllowHTTP \--priority 110 \--direction Inbound \--access Allow \--protocol Tcp \--source-address-prefixes Internet \--destination-port-ranges 80# Deny all other inbound trafficaz network nsg rule create \--resource-group networking-rg \--nsg-name web-nsg \--name DenyAllInbound \--priority 4096 \--direction Inbound \--access Deny \--protocol '*' \--source-address-prefixes '*' \--destination-port-ranges '*'# Create NSG for app tier -- only allow from web subnetaz network nsg create \--resource-group networking-rg \--name app-nsgaz network nsg rule create \--resource-group networking-rg \--nsg-name app-nsg \--name AllowFromWeb \--priority 100 \--direction Inbound \--access Allow \--protocol Tcp \--source-address-prefixes 10.1.1.0/24 \--destination-port-ranges 8080# Create NSG for data tier -- only allow from app subnetaz network nsg create \--resource-group networking-rg \--name data-nsgaz network nsg rule create \--resource-group networking-rg \--nsg-name data-nsg \--name AllowSQLFromApp \--priority 100 \--direction Inbound \--access Allow \--protocol Tcp \--source-address-prefixes 10.1.2.0/24 \--destination-port-ranges 1433# Explicit deny is required for app/data isolation: default AllowVNetInBound# otherwise permits other VNet traffic despite the narrow allow rules above.for tier in app data; doaz network nsg rule create --resource-group networking-rg \--nsg-name "${tier}-nsg" --name DenyOtherInbound --priority 4096 \--direction Inbound --access Deny --protocol '*' \--source-address-prefixes '*' --destination-port-ranges '*'done# Add required platform health/management exceptions before associating NSGs.# Associate NSG with subnetaz network vnet subnet update \--resource-group networking-rg \--vnet-name spoke-prod-vnet \--name web-subnet \--network-security-group web-nsgaz network vnet subnet update \--resource-group networking-rg \--vnet-name spoke-prod-vnet \--name app-subnet \--network-security-group app-nsgaz network vnet subnet update \--resource-group networking-rg \--vnet-name spoke-prod-vnet \--name data-subnet \--network-security-group data-nsg# View effective NSG rulesaz network nic list-effective-nsg \--resource-group networking-rg \--name myvm-nic \--output table
VNet Peering
bash
# Peer hub to spokeaz network vnet peering create \--resource-group networking-rg \--name hub-to-spoke-prod \--vnet-name hub-vnet \--remote-vnet spoke-prod-vnet \--allow-vnet-access \--allow-forwarded-traffic \--allow-gateway-transit# Peer spoke to hubaz network vnet peering create \--resource-group networking-rg \--name spoke-prod-to-hub \--vnet-name spoke-prod-vnet \--remote-vnet hub-vnet \--allow-vnet-access \--allow-forwarded-traffic \--use-remote-gateways false# Verify peering statusaz network vnet peering list \--resource-group networking-rg \--vnet-name hub-vnet \--output table
Private Endpoints
bash
# Create private endpoint for Azure SQLaz network private-endpoint create \--resource-group networking-rg \--name sql-private-endpoint \--vnet-name spoke-prod-vnet \--subnet data-subnet \--private-connection-resource-id "/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Sql/servers/myserver" \--group-id sqlServer \--connection-name sql-connection# Create private DNS zone for SQLaz network private-dns zone create \--resource-group networking-rg \--name privatelink.database.windows.net# Link DNS zone to VNetaz network private-dns link vnet create \--resource-group networking-rg \--zone-name privatelink.database.windows.net \--name spoke-dns-link \--virtual-network spoke-prod-vnet \--registration-enabled false# Create DNS record for the private endpointaz network private-endpoint dns-zone-group create \--resource-group networking-rg \--endpoint-name sql-private-endpoint \--name sql-dns-group \--private-dns-zone privatelink.database.windows.net \--zone-name privatelink.database.windows.net# Create private endpoint for Storage Accountaz network private-endpoint create \--resource-group networking-rg \--name storage-private-endpoint \--vnet-name spoke-prod-vnet \--subnet data-subnet \--private-connection-resource-id "/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Storage/storageAccounts/mystorageacct" \--group-id blob \--connection-name storage-blob-connection# Create private endpoint for Key Vaultaz network private-endpoint create \--resource-group networking-rg \--name kv-private-endpoint \--vnet-name spoke-prod-vnet \--subnet app-subnet \--private-connection-resource-id "/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.KeyVault/vaults/myvault" \--group-id vault \--connection-name kv-connection
Azure Firewall
bash
# Create public IP for firewallaz network public-ip create \--resource-group networking-rg \--name fw-public-ip \--sku Standard \--allocation-method Static# Create Azure Firewallaz network firewall create \--resource-group networking-rg \--name hub-firewall \--location eastus \--sku AZFW_VNet \--tier Standard# Configure firewall IPaz network firewall ip-config create \--resource-group networking-rg \--firewall-name hub-firewall \--name fw-ipconfig \--public-ip-address fw-public-ip \--vnet-name hub-vnet# Get firewall private IP for route tablesFW_PRIVATE_IP=$(az network firewall show \--resource-group networking-rg \--name hub-firewall \--query "ipConfigurations[0].privateIpAddress" \--output tsv)# Create application rule allowing web trafficaz network firewall application-rule create \--resource-group networking-rg \--firewall-name hub-firewall \--collection-name AllowWeb \--name AllowGoogle \--protocols Https=443 Http=80 \--source-addresses 10.1.0.0/16 \--target-fqdns "*.google.com" "*.microsoft.com" \--action Allow \--priority 100# Create network rule for DNSaz network firewall network-rule create \--resource-group networking-rg \--firewall-name hub-firewall \--collection-name AllowDNS \--name AllowDNS \--protocols UDP \--source-addresses 10.1.0.0/16 \--destination-addresses 168.63.129.16 \--destination-ports 53 \--action Allow \--priority 200# Create route table to send traffic through firewallaz network route-table create \--resource-group networking-rg \--name spoke-route-tableaz network route-table route create \--resource-group networking-rg \--route-table-name spoke-route-table \--name default-to-firewall \--address-prefix 0.0.0.0/0 \--next-hop-type VirtualAppliance \--next-hop-ip-address "$FW_PRIVATE_IP"# Associate route table with spoke subnetaz network vnet subnet update \--resource-group networking-rg \--vnet-name spoke-prod-vnet \--name app-subnet \--route-table spoke-route-table
The private endpoints above do not automatically disable public network access. Configure and verify resource-level public access policy, private DNS zones/links/records for each service/subresource, approval state and allowed/denied-client resolution. Peering is not transitive; gateway transit requires an actual gateway and intended spoke settings. Validate return paths and effective routes before routing through the firewall.
Application Gateway with WAF
bash
# Create public IPaz network public-ip create \--resource-group networking-rg \--name appgw-public-ip \--sku Standard \--allocation-method Static# Create Application Gateway subnetaz network vnet subnet create \--resource-group networking-rg \--vnet-name spoke-prod-vnet \--name AppGatewaySubnet \--address-prefix 10.1.10.0/24# HTTP-only illustrative gateway; port443 alone does not enable TLS.# For production configure a valid certificate/Key Vault identity, HTTPS listener,# approved TLS policy and backend TLS/health probes before exposing traffic.# Create Application Gateway with WAF v2az network application-gateway create \--resource-group networking-rg \--name myapp-appgw \--location eastus \--sku WAF_v2 \--capacity 2 \--vnet-name spoke-prod-vnet \--subnet AppGatewaySubnet \--public-ip-address appgw-public-ip \--http-settings-port 80 \--http-settings-protocol Http \--frontend-port 80 \--servers 10.1.2.4 10.1.2.5# Enable WAF policyaz network application-gateway waf-policy create \--resource-group networking-rg \--name myapp-waf-policyaz network application-gateway waf-policy managed-rule rule-set add \--resource-group networking-rg \--policy-name myapp-waf-policy \--type OWASP \--version 3.2# Attach the policy (creation alone does not apply it).az network application-gateway update --resource-group networking-rg \--name myapp-appgw --firewall-policy myapp-waf-policy
Contents
When to Use
- You are designing the network foundation for Azure workloads.
- You need to isolate environments with VNets and NSGs.
- You are connecting on-premises networks to Azure via VPN or ExpressRoute.
- You need private connectivity to PaaS services via private endpoints.
- You are implementing centralized egress filtering with Azure Firewall.
- You need to set up load balancing or application-layer routing with Application Gateway.
Limitations
- Infrastructure commands can disrupt services: confirm target host/scope and have backups/snapshots before mutating state.
- Docs-only import: upstream scripts and templates not bundled.