My First VNet: What a Network Engineer Notices Right Away

Coming from years of racking switches and writing ACLs on physical firewalls, my first VNet felt familiar and foreign at the same time. A VNet is basically your own private address space in the cloud — but the rules for how traffic actually flows inside it are different enough to trip up anyone used to VLANs and static routing tables.

Where the on-prem instincts help

• Subnetting math is exactly the same — CIDR is CIDR.
• Network Security Groups (NSGs) behave like stateful ACLs you already understand.
• Hub-and-spoke topology maps almost 1:1 to a traditional core/distribution design.

Where they don’t

• There’s no physical cabling to trace — everything is defined, and often misconfigured, in code.
• Effective NSG rules are a merge of subnet-level and NIC-level rules, which catches people off guard.
• Service Tags replace a lot of the manual IP-range bookkeeping you’d do on-prem.

If you want to try this out hands-on without spinning up a subscription first, I used the free Azure Cloud AI Toolkit NSG tool to sanity-check my rule design before deploying anything — it’s the same free tool I keep linking back to across this series.

More posts in this series will cover load balancers, private endpoints, and the inevitable NSG troubleshooting war stories.