vNet Seperation

Question

Hello, we are an organization that has too many vnets. Do we need to separate vnets based on production, development etc? Wouldn't it be just as secure to offer NSG at the subnet level and routes per subnet to a hub vnet for traffic filtering, why would an organization continue to deploy more and more spoke vnets for separation reasons? I am curious to hear everyone's thoughts as I think alot of vnets cannot be managed well.

Answer 1

Hi @FunMum , I understand that you're asking about best practices in virtual network separation.

For large enterprises, Microsoft offers the Cloud Adoption Framework to provide customers a proven starting point for the cloud journey, including the Secure methodology. Another critical component of the Cloud Adoption Framework in the Ready methodology is the Azure landing zone, which accelerates cloud adoption by providing automated implementation of complete architectures and operating environments, including security elements. Security best practices are integrated in Azure landing zones. With landing zones, you can quickly and securely migrate your first workloads with baked-in security and governance best practices.

Once you've determined the scale of Azure landing zone that's appropriate for your organization, it's important to keep in mind the following universal design principles for your virtual network:

• Ensure nonoverlapping address spaces. Make sure your virtual network address space (CIDR block) doesn't overlap with your organization's other network ranges.
• Your subnets shouldn't cover the entire address space of the virtual network. Plan ahead and reserve some address space for the future.
• It's recommended you have fewer large virtual networks rather than multiple small virtual networks to prevent management overhead.
• Secure your virtual networks by assigning Network Security Groups (NSGs) to the subnets beneath them. For more information about network security concepts, see Azure network security overview.

Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is how.