Question

[rmc515]

Question

[mattfeltonma]

Hi there! I am not planning on putting them into separate virtual networks because you can achieve traditional DMZ-like controls within a single virtual network. I'm putting together a second repository which illustrates network patterns from its most simple to most complex and the benefits and considerations of each pattern. In the pattern for separate north/south east/west stacks, it covers how you can handle routing to accomplish a DMZ-like architecture.

With that said, there are some edge use cases where you may want to separate the north/south and east/west stacks into separate virtual networks. In my opinion, there are only two reasons to do that. Reason one is you want to create separate blast radiuses forth north/south and east/west traffic. You accomplish this by putting the north/south and east/west stacks into separate vnets in separate subscriptions using the subscription as a blast radius. Reason number two is related in that you may have separate teams managing north/south and east/west. Separating the stacks into separate Vnets and separate subscriptions allows you to create separate authorization boundaries.

I'll keep this issue open and update it when I publish that new repo which will include a pattern for separating the stacks into different virtual networks.

[mattfeltonma]

This repo (https://github.com/mattfeltonma/azure-network-journey) has the separate virtual network for north/south and east/west.

Thanks!