Quick Reference Cheat Sheet

Azure CLI — Networking Essentials

# Create VNet with a subnet
az network vnet create -g RG -n MyVNet --address-prefixes 10.0.0.0/16 \
  --subnet-name Subnet1 --subnet-prefixes 10.0.1.0/24

# Create route table and add a route
az network route-table create -g RG -n MyRT
az network route-table route create -g RG --route-table-name MyRT \
  -n ToFirewall --address-prefix 0.0.0.0/0 \
  --next-hop-type VirtualAppliance --next-hop-ip-address 10.0.0.4

# Associate route table with subnet
az network vnet subnet update -g RG --vnet-name MyVNet -n Subnet1 \
  --route-table MyRT

# Disable BGP route propagation on route table
az network route-table update -g RG -n MyRT \
  --disable-bgp-route-propagation true

# Create NSG rule (allow HTTP)
az network nsg rule create -g RG --nsg-name MyNSG -n AllowHTTP \
  --priority 100 --direction Inbound --access Allow \
  --protocol Tcp --destination-port-ranges 80

# Enable Private Endpoint Network Policies on subnet
az network vnet subnet update -g RG --vnet-name MyVNet -n PrivateSubnet \
  --private-endpoint-network-policies Enabled

# Create Private DNS Zone and link to VNet
az network private-dns zone create -g RG -n privatelink.database.windows.net
az network private-dns link vnet create -g RG \
  --zone-name privatelink.database.windows.net \
  --name MyDnsLink --virtual-network MyVNet --registration-enabled false

# Check effective routes on a NIC
az network nic show-effective-route-table -g RG -n MyNicName -o table

# IP Flow Verify (Network Watcher)
az network watcher test-ip-flow --vm MyVM -g RG \
  --direction Inbound --protocol TCP \
  --local 10.0.1.4:80 --remote 1.2.3.4:60000

PowerShell — Networking Essentials

# Get effective routes on a VM NIC
Get-AzEffectiveRouteTable -NetworkInterfaceName "MyNic" `
  -ResourceGroupName "RG" | Format-Table

# Create a route table and UDR
$rt = New-AzRouteTable -Name "MyRT" -ResourceGroupName "RG" `
  -Location "uksouth" -DisableBgpRoutePropagation
Add-AzRouteConfig -Name "ToFirewall" -RouteTable $rt `
  -AddressPrefix "0.0.0.0/0" -NextHopType "VirtualAppliance" `
  -NextHopIpAddress "10.0.0.4"
Set-AzRouteTable -RouteTable $rt

# Associate route table with subnet
$vnet = Get-AzVirtualNetwork -Name "MyVNet" -ResourceGroupName "RG"
$subnet = Get-AzVirtualNetworkSubnetConfig -VirtualNetwork $vnet `
  -Name "Subnet1"
Set-AzVirtualNetworkSubnetConfig -VirtualNetwork $vnet `
  -Name "Subnet1" -AddressPrefix $subnet.AddressPrefix `
  -RouteTable $rt
Set-AzVirtualNetwork -VirtualNetwork $vnet

# Get VPN Gateway connection status
Get-AzVirtualNetworkGatewayConnection -Name "MyConn" `
  -ResourceGroupName "RG" | Select-Object Name, ConnectionStatus

# Start a packet capture (Network Watcher)
New-AzNetworkWatcherPacketCapture -NetworkWatcher $nw `
  -TargetVirtualMachineId $vm.Id -PacketCaptureName "MyCapture" `
  -StorageAccountId $storage.Id

Each VNet that needs Private Endpoint DNS resolution must have its own VNet link to the Private DNS Zone (registration-enabled: false for most zones).