👨🏻 Brother Talk — Phase 06, Off the Record

No slides, no exam objectives. This is me, your brother, telling you the things about Azure networking that people only admit after the incident is over and the second coffee is poured. Read it once now, and again the week before your interview.

Listen. Let me save you a year of confusion with one sentence: in Azure networking, it's always DNS. I'm only half joking. You will spend hours staring at NSG rules and firewall logs and route tables, and the answer — over and over — will be that a Private DNS zone was never linked to the VNet, so the name resolved to the public IP and nothing on the data path was ever wrong. The first thing you do on any Private Link ticket is nslookup from the actual VM. If it returns a public IP, you're done diagnosing — go link the zone. The people who look senior aren't smarter; they just check DNS first instead of last.

Here's the mindset shift that matters most. You don't "set up" an Azure network — you build a program that decides each packet's fate, and then you debug the program. There's no cable. The NSG is a sorted list of rules with a first-match-wins loop. The route table is a longest- prefix-match function. Private DNS is a conditional lookup. Once you see them as the three small algorithms they are — the exact three you build in this lab — the network stops being spooky. A dropped packet isn't bad luck; it's a function returning Deny, or a route returning the wrong next hop, or a name resolving to the wrong IP. You can trace it. That's the whole game, and it's why this lab makes you implement the functions instead of clicking blades.

Let me give you the three things I wish someone had told me.

One: lower priority number wins, and it will burn you in an interview if you flinch on it. Everyone's instinct is "higher priority = more important." In NSGs it's backwards — priority 100 is evaluated before priority 4000, and the first match wins, so a Deny at 100 silently shadows your Allow at 200. Say it out loud until it's reflexive: lower number, evaluated first, first match wins. When an interviewer hands you a rule set and asks "what happens to this packet," sorting by priority ascending and reading top-down is the entire answer, and doing it calmly is the whole signal.

Two: the 0.0.0.0/0 UDR to a firewall is the most powerful and most dangerous line you'll ever write. It's the backbone of every secure landing zone — force every spoke's egress through the hub firewall for inspection. It's also how you take down an entire spoke at 2 a.m. when the firewall's down, or when you forgot a return route and traffic blackholes. Respect it. When you add force-tunnelling, you always ask "what happens to the firewall's own traffic, and what's my break-glass route if this appliance dies?" Power and blast radius are the same wire here.

Three: subnet math is a one-way door, so do it on paper before anything exists. You can grow a VNet, but you cannot easily resize a subnet full of resources, and two VNets with overlapping CIDRs can never peer — which means a lazy 10.0.0.0/16 today is a re-IP project in eighteen months. The platform team owns one non-overlapping address plan for the whole estate and hands app teams a subnet, not a choice. Memorize the 2^(32−p) − 5 and the /29 floor not because it's on the exam, but because the person who can size the address plan in their head in the design meeting is the person who gets trusted with the network.

Now, the honest career framing. Networking is the layer that makes you indispensable, because almost nobody on an app team understands it and almost every nasty production incident touches it. Identity (Phase 03–05) gets the glory; networking gets the pager. When the app team is panicking because "the service can't reach storage," and you calmly run one nslookup, see the public IP, and say "your Private DNS zone isn't linked to this spoke — here's the one command to fix it," you've just done in ninety seconds what a room full of senior engineers couldn't do in an hour. That moment — being the person who can see the invisible network — is how you become the escalation point. And the escalation point is the principal.

One more thing, the thing nobody says: the network is where security and reliability stop being slogans and become arithmetic. "Is this private?" isn't a vibe — it's "does the name resolve to a private IP from this VNet, yes or no." "Will the firewall outage take us down?" isn't a worry — it's "every spoke has a 0.0.0.0/0 UDR to one firewall, so yes, unless it's zone-redundant with break-glass routes." When you can turn those fears into yes/no questions with a command that answers them, you're not the networking person anymore. You're the person the room gets quiet for. That's learnable, and it starts with the four functions in this lab.

Go build the network engine. Then come find me in Phase 07 — that's where the packets you just learned to route start carrying container images, and we make AKS and ACR click.

— your brother 👨🏻