🌐 Azure Network Lab

███╗   ██╗███████╗████████╗██╗    ██╗ ██████╗ ██████╗ ██╗  ██╗
████╗  ██║██╔════╝╚══██╔══╝██║    ██║██╔═══██╗██╔══██╗██║ ██╔╝
██╔██╗ ██║█████╗     ██║   ██║ █╗ ██║██║   ██║██████╔╝█████╔╝ 
██║╚██╗██║██╔══╝     ██║   ██║███╗██║██║   ██║██╔══██╗██╔═██╗ 
██║ ╚████║███████╗   ██║   ╚███╔███╔╝╚██████╔╝██║  ██║██║  ██╗
╚═╝  ╚═══╝╚══════╝   ╚═╝    ╚══╝╚══╝  ╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═╝

                    __    ___    ____
                   / /   /   |  / __ )
                  / /   / /| | / __  |
                 / /___/ ___ |/ /_/ /
                /_____/_/  |_/_____/
          A Z U R E   N E T W O R K   L A B

            ☁️ AZURE NETWORK LAB ☁️
         ╔══════════════════════════════════╗
         ║          [ VIRTUAL WAN ]         ║
         ║     🔥 Firewall    🌐 VPN        ║
         ╚════╦══════════════════╦══════════╝
              ║                  ║
        ╔═════╩════╗       ╔═════╩════╗
        ║  SPOKE1  ║       ║  SPOKE2  ║
        ║Route Srv ║       ║  vHub    ║
        ╚══════════╝       ╚══════════╝

Learn Azure networking the right way—by building it. This Terraform project deploys a complete vWAN-centric networking environment you can explore, break, and rebuild. Covers Virtual WAN, Secured Hub, VPN connectivity, Route Server, and spoke networks following Microsoft best practices.

💡 Hands-on Learning: Deploy real enterprise network infrastructure in minutes. Perfect for AZ-700 certification prep, team training, or validating network architectures before production.

🧭 Master Control Panel (feature toggles)

The lab is driven by the deploy object in terraform.tfvars. Flip the flags to change the footprint, then run terraform plan and terraform apply.

Note: When deploy.route_server = true, Spoke1 is not connected to vHub (Azure limitation).

📋 Table of Contents

• Overview
• Documentation
• Architecture Diagram
• What Gets Deployed
• Network Topology
• Quick Start
• Feature Toggles
• Configuration Options
• Cost Estimation
• Project Structure
• License

🎯 Overview

This lab deploys a Virtual WAN-centric architecture with:

📚 Documentation

The full wiki lives in wiki/ and mirrors the style of the Azure Landing Zone lab.

• Start here: wiki/README.md
• Deep dive guide: wiki/book.md
• Architecture: wiki/architecture/overview.md
• Scenarios: wiki/scenarios/README.md
• Testing: wiki/testing/lab-testing-guide.md

🏛️ Architecture Diagram

┌─────────────────────────────────────────────────────────────────────────────┐
│                              VIRTUAL WAN                                     │
│  ┌─────────────────────────────────────────────────────────────────────────┐│
│  │                          VIRTUAL HUB (10.10.0.0/23)                     ││
│  │  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐                      ││
│  │  │   Azure     │  │  vHub VPN   │  │   Route     │                      ││
│  │  │  Firewall   │  │   Gateway   │  │   Tables    │                      ││
│  │  │  (Secured)  │  │   (BGP)     │  │             │                      ││
│  │  └──────┬──────┘  └──────┬──────┘  └─────────────┘                      ││
│  │         │                │                                               ││
│  └─────────┼────────────────┼───────────────────────────────────────────────┘│
│            │                │                                                │
└────────────┼────────────────┼────────────────────────────────────────────────┘
             │                │
    ┌────────┴────────┐       │         ┌─────────────────────────┐
    │                 │       │         │                         │
    ▼                 ▼       ▼         ▼                         │
┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐       │
│   SPOKE 1       │ │   SPOKE 2       │ │   ON-PREM       │       │
│  10.1.0.0/16    │ │  10.2.0.0/16    │ │ 192.168.0.0/16  │       │
│                 │ │                 │ │                 │       │
│ ┌─────────────┐ │ │ ┌─────────────┐ │ │ ┌─────────────┐ │       │
│ │Route Server │ │ │ │ Workload VM │ │ │ │ VPN Gateway │◄┼───────┘
│ │   (BGP)     │ │ │ └─────────────┘ │ │ │   (BGP)     │ │  S2S VPN
│ └──────┬──────┘ │ │                 │ │ └─────────────┘ │
│        │        │ │  vHub Connected │ │                 │
│ ┌──────▼──────┐ │ │                 │ │ ┌─────────────┐ │
│ │  NVA (RRAS) │ │ │                 │ │ │ NVA (RRAS)  │ │
│ │  ASN 65501  │ │ │                 │ │ └─────────────┘ │
│ └─────────────┘ │ │                 │ │                 │
│                 │ │                 │ │ ┌─────────────┐ │
│ ┌─────────────┐ │ │                 │ │ │ Workload VM │ │
│ │Workload VMs │ │ │                 │ │ └─────────────┘ │
│ │ (LB Pool)   │ │ │                 │ │                 │
│ └─────────────┘ │ │                 │ │                 │
└─────────────────┘ └─────────────────┘ └─────────────────┘
   Route Server        vHub Connected     VPN S2S to vHub
   (No vHub Conn)

📦 What Gets Deployed

Core Infrastructure

Virtual Networks

Virtual Machines

Optional Components

🌐 Network Topology

Address Space Allocation

🚀 Quick Start

Prerequisites

• Azure subscription with Owner or Contributor rights
• Terraform 1.9 or later
• Azure CLI signed in (az login)

Deploy

# Clone the repository
git clone https://github.com/Jamonygr/azure-network-lab.git
cd azure-network-lab

# Copy and edit variables
cp terraform.tfvars.example terraform.tfvars
# Edit terraform.tfvars with your values

# Initialize and deploy
terraform init
terraform plan -out=tfplan
terraform apply tfplan

Destroy

terraform destroy -auto-approve

🎛️ Feature Toggles

Control what gets deployed to optimize costs:

# terraform.tfvars

# Feature Toggles
deploy = {
  vwan          = true   # Virtual WAN
  vhub_firewall = true   # Azure Firewall in vHub (~$912/mo)
  vpn           = false  # VPN Gateways (vHub + OnPrem)
  route_server  = true   # Azure Route Server (~$360/mo)

  dns_resolver      = true   # DNS Private Resolver (~$180/mo)
  private_dns_zones = true   # Private DNS Zones
  bastion           = false  # Azure Bastion (~$140/mo)

  application_gateway = false # WAF v2 (~$250/mo)
  load_balancer       = true  # Internal Load Balancer
  nat_gateway         = true  # NAT Gateway (~$45/mo)

  private_endpoint = true   # Storage Account + Private Endpoint

  spoke1_vms = true   # VMs in Spoke1 VNet
  spoke2_vms = true   # VMs in Spoke2 VNet
  onprem_vms = false  # VMs in OnPrem VNet
  nvas       = true   # Network Virtual Appliances (RRAS/BGP)
}

Note: When deploy.route_server = true, Spoke1 does NOT connect to vHub (Azure limitation: VNet cannot have both Route Server and vHub remote gateway).

⚙️ Configuration Options

Essential Variables

# terraform.tfvars

# Required
subscription_id = "your-subscription-id"
admin_username  = "azureadmin"
admin_password  = "YourSecureP@ssw0rd!"
vpn_shared_key  = "YourVPNSharedKey123!"

# Optional
ctx = {
  project  = "az700-lab"
  location = "eastus2"
  tags = {
    Environment = "lab"
    Project     = "az700"
  }
}
vm_size = "Standard_B2s"

Network Configuration

# Address Spaces
vhub_address_prefix  = "10.10.0.0/23"
spoke1_address_space = ["10.1.0.0/16"]
spoke2_address_space = ["10.2.0.0/16"]
onprem_address_space = ["192.168.0.0/16"]

💰 Cost Estimation

Monthly Cost by Component

Cost Profiles

📁 Project Structure

azure-network-lab/
├── README.md                  # This documentation
├── LICENSE                    # MIT License
├── main.tf                    # Root orchestration (lab only)
├── variables.tf               # Input variables
├── outputs.tf                 # Output values
├── locals.tf                  # Computed locals
├── moved.tf                  # State move declarations
├── providers.tf               # Provider configuration
├── terraform.tfvars           # Your configuration (gitignored)
├── terraform.tfvars.example   # Example configuration
├── wiki/                      # Documentation wiki
│
└── modules/                   # Reusable modules
    ├── application-gateway/
    ├── bastion/
    ├── dns-private-resolver/
    ├── load-balancer/
    ├── local-network-gateway/
    ├── log-analytics/
    ├── nat-gateway/
    ├── nsg/
    ├── private-dns-zone/
    ├── private-endpoint/
    ├── resource-group/
    ├── route-server/
    ├── storage-account/
    ├── tags/
    ├── vhub/
    ├── vhub-connection/
    ├── vhub-firewall/
    ├── vhub-vpn-gateway/
    ├── vm-windows/
    ├── vm-windows-nva/
    ├── vnet/
    ├── vnet-peering/
    ├── vpn-connection/
    ├── vpn-gateway/
    ├── vpn-site/
    └── vwan/

Deployment Phases

🧪 Lab Scenarios

This environment supports the following AZ-700 exam topics:

📄 License

This project is licensed under the MIT License - see the LICENSE file for details.

🙏 Acknowledgments

• Microsoft Cloud Adoption Framework
• Azure Virtual WAN
• AZ-700 Exam Guide
• Terraform Azure Provider

Built with ❤️ for learning Azure networking

Last Updated: December 2024