This part 5 of a 5 part series of templates to deploy a glorified 3 tier Azure network

1. https://github.com/marckean/Azure-T1-Network
   • Resource Group based template
   • Most un-trusted tier, as it has access to the internet
   • The Azure Firewall is deployed - you could use two IaaS based NVAs and a couple of load balancers, however the Azure Firewall is PaaS, it's already highly available and scalable.

2. https://github.com/marckean/Azure-T2-Network
   • Resource Group based template
   • Mid tier, best for applications. Deploy distributed applications to their own vNet with any number of subnets
   • BGP route propagation is allowed on the UDRs so that on-prem advertisements will ensure traffic destined to on-prem will route back via the ExpressRoute gateway in the Tier 3 network, then over the ExpressRoute circuit back to on-prem
     • You could use a site-to-site VPN here instead
   • A default route of 0.0.0.0/0 captures all other traffic sending this to the Azure Firewall for packet inspection and final control

3. https://github.com/marckean/Azure-T3-Network
   • Resource Group based template
   • This is known as the hub/transit vNet, which has the connection/s back to on-prem
   • Currently there is one ExpressRoute gateway deployed, however you can configure ExpressRoute and Site-to-Site VPN coexistence for HA as a backup to ExpressRoute.

4. https://github.com/marckean/Azure-T3plus-Network
   • Resource Group based template
   • This is the the most trusted and most isolated network as there's no UDRs to forward traffic to anywhere, there's access back to on-prem with the vNet peer settings Use Remote Gateways and Allow Gateway Transit turned on

5. https://github.com/marckean/vNetPeerings
   • Subscription based template
   • All the peers, plus peer settings for all the vNets e.g. Use Remote Gateways and Allow Gateway Transit

See the deployment note below for more details about deployment, either as is or customised.

For the serious security concious, this 3 tier network topology is one way to achieve super tight network security within Azure. In brief:

• the T1 vNet can't talk directly with the T3 Transit Hub vNet
• the T3 Transit Hub vNet can't talk directly with the T1 vNet

This 5 part deployment deploys the below Azure based network components only including the ExpressRoute gateway, but not the non-network components shown e.g. VMs, NICs, Load Balancers or ExpressRoute circuit itself - these are here to show what it could ultimately look like or be used for after the fact.

While you can deploy this fully functional deployment customised to suit your needs exactly, you can also deploy this environment as is to have a play and have a look at what it looks like in Azure. As part of this fully functional deployment - to ensure everything remains in-tact and works - it's recommended that the first four templates are deployed in the same order as above, however it's mandatory that the last one vNetPeerings is deployed last, as it is required that all vNets are deployed in order for peers to be created successfully.

This 5 part series of templates is fully functional with no over-lapping address ranges, UDRs have all the correct next hop IP addresses and all the template parameters are correctly set. In order to deploy this successfully, be sure to deploy the templates to following resource groups:

• Azure-T1-Network | Resource Group T1_01
• Azure-T2-Network | Resource Group T2_01
• Azure-T3-Network | Resource Group T3_01
• Azure-T3plus-Network | Resource Group T3plus_01
• vNetPeerings | Resource Group Any Resource Group

This vNet Peerings repo is to be deployed last and fills in all the relevant peers for the vNets.

If you want to deploy a customised version of this deployment in a separate environment e.g. production, you can safely modify these templates to suit your own environment and it's super easy, all you need to do is edit the parameters for each template at the time of deployment.

For this vNet Peerings repo, as there's so many parameters with this template, it would be easier to edit the parameters in the Edit Template section in the the portal. It also doesn't matter which Resource Group or Subscription you choose here, as this is specified in the template parameters and the template deploys across both subscriptions & resource groups.

Note that as this template can deploy across Resource Groups and across Subscriptions, if you're using just the one subscription, simply fill in the same subscription ID throughout the peerArray parameter array for both existingLocalVirtualNetworkSubscriptionID and existingRemoteVirtualNetworkSubscriptionID.