Contact
All services Service

Network and connectivity

Review and troubleshooting for Azure and hybrid networks. We map VNets, peerings, routes, security rules and firewalls across all subscriptions, then trace a blocked connection, fix it with the smallest safe change and check it again.

Describe what you need

What you get

  • A current map of subscriptions, VNets, peerings, routes and rules, built from the deployed state, with the VPN and dedicated private links to on-premises where they exist
  • Each proposed change written up for review before it is applied: which rule or route, why, and what else it affects
  • The blocked connection fixed, with a check run after the change
  • A clean-up list of redundant, too wide or risky rules and routes, in priority order
  • Documentation of how traffic flows today

How it works

  1. 01

    Map the deployed network

    We read VNets, subnets, peerings, route tables, security groups, firewalls and private endpoints across all subscriptions from what is deployed, for example with Azure Resource Graph.

  2. 02

    Trace the connection

    We start from the connection that is needed, for example a VM reaching a database on port 1433. We trace its effective routes and rules to the point where it stops.

  3. 03

    Propose the smallest safe change

    We describe the change for review before anything is applied: which rule or route, why, and what else it affects.

  4. 04

    Verify after the change

    The same connection check runs again after the fix to show that the connection works.

  5. 05

    Document and hand over

    We document how traffic flows today and hand over the clean-up list, so the next change starts from the current state.

Problems it solves

  • ProblemConnections time out because return traffic gets lost through asymmetric routing or a user-defined route nobody remembers adding.

    SolutionWe trace the effective routes and rules for the failing connection, in both directions, and show the point where the traffic is lost.

  • ProblemHundreds of overlapping security rules make it unclear what is open, and an allow-any rule from an old incident is still active.

    SolutionWe read the effective security rules from the deployed state to show what is open, then propose the smallest safe change for review before anything is applied.

  • ProblemA service has a private endpoint, but DNS still resolves its name to the public address, and connections fail or bypass it.

    SolutionWe check and correct the private DNS setup for each VNet that uses the service. A rerun of the connection check then shows the name resolving to the private address.

  • ProblemEach project added firewall rules and none were removed, so nobody knows which ones still matter.

    SolutionWe review the firewall policies in Azure and on-premises, and produce a clean-up list of rules that are redundant, too wide or risky, in priority order.

What it covers

  • For exampleAzure Resource Graph
  • For exampleAzure Virtual Network
  • For exampleRoute tables, Network Security Groups
  • For exampleAzure Firewall
  • Private endpoints and private DNS
  • For exampleVPN Gateway, ExpressRoute
  • Connection checks before and after each fix
  • Clean-up of redundant, too wide or risky rules
Typical scope

A single blocked connection is often fixed within days. A full network review and clean-up usually runs 1–3 weeks, depending on the number of subscriptions and how many rules and routes were added as exceptions.

Next step

Send a short description of what you need and the systems involved. We reply with proposed next steps.

Describe what you need