Azure Bastion: diagnose native client access before opening RDP or SSH
A production runbook for separating local client, SKU, tunneling, RBAC, NSG and guest-service failures when Azure Bastion native access breaks.
Read article
Tag
networking
43 articles connected to this technical signal.
Azure App Service VNet Integration: diagnose subnet exhaustion before retrying scale
A production runbook for measuring VNet Integration subnet capacity, separating address pressure from delegation and path failures, then validating resize or migration with rollback.
Read articleAzure AKS: diagnose outbound SNAT exhaustion before adding a NAT Gateway
A production runbook for separating DNS, remote dependency, network policy, conntrack and Azure SNAT pressure on AKS before changing the cluster outbound path.
Read articleAzure Network Watcher: diagnose an intermittent path before changing NSG or UDR
A production runbook for turning intermittent Azure connectivity into continuous evidence with Connection Monitor, then isolating DNS, routing, filtering and service health before changing network policy.
Read articleAzure Firewall IDPS: validate a signature before switching it to deny
A production runbook for qualifying an Azure Firewall IDPS signature in alert mode, measuring impact, canarying deny and retaining a targeted rollback.
Read articleAKS: diagnose intermittent DNS before restarting CoreDNS
A production runbook for separating pod resolver, CoreDNS, service path, upstream DNS and node-specific failures before restarting or rolling back AKS DNS.
Read articleAzure Virtual WAN: validate Routing Intent before enforcing production inspection
A production runbook for qualifying Azure Virtual WAN Routing Intent across private flows, internet egress, effective routes, Azure Firewall, canaries, validation and rollback.
Read articleAzure NSG: validate a Service Tag rule before rollout
A production runbook for qualifying an Azure NSG rule based on a Service Tag using regional scope, real prefixes, effective rules, flow tests, canary rollout and rollback.
Read articleAzure Virtual Network Manager: diagnose a Security Admin rule before changing NSGs
A production runbook for identifying an Azure Virtual Network Manager Security Admin rule, separating Allow, Always Allow and Deny, then validating or rolling back the deployment without blindly opening NSGs.
Read articleAzure Front Door: diagnose an unhealthy origin before changing routing
A production runbook to separate health probes, DNS/TLS, Private Link, backend capacity and routing before draining, failing over or rolling back.
Read articleAzure Managed Redis: contain a connection storm before scaling or failing over
A production runbook to separate client reconnects, server pressure, DNS/TLS and network saturation, then validate a fix, scaling decision or rollback.
Read articleAzure Network Watcher: migrate NSG flow logs without losing network evidence
A production runbook for inventorying NSG flow logs, enabling virtual network flow logs in parallel, validating the new KQL schema, and cutting over with an explicit rollback.
Read articleAzure Bastion: diagnose SSH or RDP failures before opening NSGs
A production runbook to separate Bastion sessions, NSGs, routing, target ports, identity and VM health before exposing SSH or RDP.
Read articleAzure Automation: diagnose a Hybrid Runbook Worker that stops picking up jobs
A production runbook for separating queueing, heartbeat, extension, network, capacity, identity and runtime failures before retrying a Hybrid Worker job.
Read articleAzure Arc: diagnose an extension failure after a proxy change
A production runbook for separating Arc connectivity, effective proxy settings, extension service failures and handler errors before reinstalling the agent or widening outbound access.
Read articleAzure Monitor Private Link: diagnose ingestion loss before reopening public access
A production runbook to isolate AMPLS, DCE, DCR, DNS, associations and Azure Monitor Agent when telemetry disappears after network hardening, then validate or roll back without broadly reopening public access.
Read articleAzure Site Recovery: test a recovery plan without touching production
A production runbook for running an Azure Site Recovery test failover in an isolated network, validating dependencies, measuring application recovery and cleaning up unambiguously.
Read articleAzure Firewall: diagnose a shadowed rule before opening traffic
A production runbook for proving which Azure Firewall rule handles a flow, separating routing from policy order, and applying a targeted fix with validation and rollback.
Read articleAzure Route Server: validate a BGP advertisement before production propagation
A production runbook for bounding a BGP change, comparing learned and advertised routes, checking effective routes, canarying one prefix, then validating or withdrawing it without destabilizing the Azure hub.
Read articleAzure DevOps: diagnose an offline self-hosted agent before recreating it
A production runbook for qualifying an Azure DevOps self-hosted agent that no longer picks up jobs by separating runner service, identity, network, disk, cache, pool, logs and rollback.
Read articleAzure Firewall: validate Threat Intelligence before blocking production
A production runbook for qualifying Azure Firewall Threat Intelligence with logs, false positives, critical flows, targeted exceptions, deny decision and rollback before enabling Deny.
Read articleAzure APIM self-hosted gateway: diagnose sync drift before rerouting traffic
A production runbook for qualifying an Azure API Management self-hosted gateway with configuration sync, token or Workload Identity, Kubernetes, logs, backend reachability, validation and rollback before moving traffic.
Read articleAzure Backup: validate a restore point before declaring rollback ready
A production runbook for qualifying an Azure Backup restore point with application consistency, dependencies, identity, networking, test restore, evidence, decision and rollback before cutover.
Read articleAzure Firewall: qualify a broad rule before tightening production access
A production runbook for tightening an Azure Firewall rule without breaking useful traffic, with inventory, KQL evidence, dependencies, controlled validation and rollback.
Read articleAzure Load Balancer: diagnose a health probe before changing the backend pool
A production runbook for qualifying an unhealthy Azure Load Balancer backend with probe behavior, NSGs, routing, logs, pool configuration, validation and rollback before changing the rule or redeploying.
Read articleAzure Front Door: diagnose an origin before changing WAF or routing
A production runbook for qualifying an Azure Front Door failure with origin groups, health probes, TLS, Private Link, DNS, WAF, logs, validation and rollback before changing routing.
Read articleAzure route asymmetry: diagnose before changing a UDR
A production runbook for qualifying Azure asymmetric routing with effective routes, UDRs, Azure Firewall, NAT Gateway, flow logs, validation and rollback before changing route tables.
Read articleAzure Firewall DNS proxy: diagnose egress before opening rules
A production runbook for qualifying an Azure egress failure with Firewall DNS proxy, FQDN resolution, UDRs, application rules, logs, validation and rollback before broadening traffic.
Read articleAzure Private DNS: validate a zone change before breaking private paths
A production runbook for qualifying an Azure Private DNS change with workload-side resolution, VNet links, Private Resolver, TTL, logs, application validation and rollback.
Read articleAzure Private DNS Resolver: diagnose split-brain DNS before changing zones
A production runbook for qualifying Azure hybrid DNS incidents with Private DNS Resolver, forwarding rulesets, private zones, caches, evidence, validation and rollback.
Read articleAzure NSG, UDR and Firewall: diagnose blocked traffic before adding a rule
A production runbook for qualifying blocked Azure traffic by separating NSG, UDR, Azure Firewall, DNS, effective routes, logs and rollback before opening access too broadly.
Read articleKQL snippet: qualify an Azure Firewall denial on private egress
A short query to separate application rule denial, network rule denial and DNS proxy resolution before adding an overbroad rule.
Read articleAzure snippet: check the Private DNS Resolver path before changing a zone
A short sequence to confirm private zone, VNet link, ruleset and forwarding rule before touching DNS records.
Read articleKQL snippet: isolate Application Gateway 502s to a private backend
A short query to separate unavailable backend, application failure and WAF blocking when Application Gateway returns 502s on a private path.
Read articleAzure Functions with private Storage: keep runtime, deployment, and diagnostics under control
An operational approach to securing the Azure Functions Storage account with Private Endpoint without breaking runtime behavior, deployments, DNS resolution, triggers, and operational checks.
Read articleAzure snippet: check Private Endpoint DNS resolution
A short sequence to confirm that an Azure service exposed through Private Endpoint resolves to a private address from the right network.
Read articleAzure hybrid DNS: when to use Private Resolver, on-premises forwarders and private zones
Compare the roles of Azure DNS Private Resolver, on-premises DNS forwarders, Azure private zones and forwarding rulesets to build readable hybrid name resolution.
Read articleAzure Private Endpoint: build a validation matrix before production
Prepare an Azure Private Endpoint production rollout with a validation matrix that separates DNS, routing, public access closure, TLS, application dependencies and tests from Azure and on premises.
Read articleInternal APIM and Azure Function with Private Endpoint
Design a private API flow where API Management stays internal and calls an Azure Function exposed through Private Endpoint, with private DNS, clear network boundaries and operational checks.
Read articlePublishing a business application with Azure Application Gateway, mTLS, and a dedicated WAF policy
An operational walkthrough for publishing a controlled business application behind Azure Application Gateway with dedicated HTTPS listeners, mutual TLS, a scoped WAF policy, HTTPS backends, and network validation points.
Read articleAzure VNet Integration for App Service and Functions is not a Private Endpoint
A practical note on Azure App Service and Functions VNet Integration, focused on outbound reachability, DNS, routing, NSGs, UDRs, NAT, and the design mistakes that appear when teams assume the app itself becomes privately exposed.
Read articleAzure Private Endpoints and hybrid DNS without breaking name resolution
A practical runbook-style article on Private Endpoints, private DNS zones, hybrid resolution, validation commands, and the failure patterns that create NXDOMAIN and misleading network diagnostics.
Read articleProxmox cluster design before you call it production
A runbook-style article on Proxmox VE cluster design, quorum, storage, networking, backups, and the checks that matter before presenting a cluster as a production platform.
Read article