6.1.4. Utilize Network Watcher

💡 First Principle: Network Watcher provides a suite of tools for monitoring, diagnosing, and gaining insight into Azure network resources, enabling administrators to troubleshoot connectivity and performance issues without needing direct access to virtual machines.

Scenario: Your application running on an Azure Virtual Machine cannot connect to an external API. You suspect a network security group rule or a routing issue is blocking the traffic. You need to quickly diagnose this without logging into the VM. You also want to continuously log all traffic passing through your NSGs for security auditing.

What It Is: Network Watcher is a collection of network monitoring and troubleshooting tools in Azure.

Key Network Watcher Tools:

• IP flow verify: Checks if a packet is allowed or denied to/from a VM based on NSG rules.
• NSG flow logs: Records detailed logs of IP traffic through an NSG.
• Connection troubleshoot: Tests connectivity between a source VM and a destination, providing a step-by-step path analysis.
• Next hop: Determines the next hop for outbound traffic from a VM, clarifying routing behavior.
• VPN troubleshoot: Diagnoses VPN gateway issues.

Visual: Network Watcher Tools

⚠️ Common Pitfall: Trying to troubleshoot network issues by logging into VMs and using tools like ping or traceroute. These tools can be misleading in a software-defined network like Azure. Network Watcher provides a more accurate, platform-level view of network connectivity.

Key Trade-Offs:

• Detailed Logging (Flow Logs) vs. Cost: NSG Flow Logs generate a significant amount of data, which can lead to storage costs. It's important to enable them strategically on critical subnets.

Connection Monitor: Continuous Connectivity Monitoring

💡 First Principle: A one-time test tells you whether a path works right now. Only a recurring test shows you when it started failing and how latency is trending.

Scenario: Web VMs in Azure call an on-premises database. Users report slowness at unpredictable times, so you need latency and packet loss measured around the clock, with an alert when round-trip time gets too high.

What It Is: Connection monitor provides continuous, end-to-end connectivity monitoring for Azure and hybrid endpoints. It measures packet loss and latency over TCP, HTTP, and ICMP and shows the hop-by-hop path in a topology view. Connection troubleshoot returns similar information but tests the connection at a single point in time. Connection monitor (classic) is deprecated; use the current Connection monitor.

Building blocks:

• Connection monitor resource: region-specific.
• Endpoints: sources (Azure VMs, scale sets, Arc-enabled on-premises hosts) and destinations (Azure VMs, URLs, FQDNs, or IP addresses).
• Test configuration: protocol (TCP, HTTP, or ICMP), port, test frequency, and thresholds for checks failed (%) and round-trip time (ms).
• Test group: holds sources, destinations, and test configurations. A connection monitor can have several.
• Test: one source + one destination + one test configuration. For example, 3 sources x 2 destinations x 2 configurations = 12 tests.

Agents:

• Azure VMs and scale sets need the Network Watcher Agent VM extension to act as sources.
• On-premises hosts must be Azure Arc-enabled and then run the Azure Monitor Agent. The Log Analytics agent is no longer supported for this.
• Destinations don't need an extension. When you create the monitor in the portal, the required extensions are enabled for you.

Data and alerts: Results go to the Log Analytics workspace you choose at creation and to Azure Monitor metrics (ChecksFailedPercent, RoundTripTimeMs, TestResult). Create metric alerts on those metrics, either while creating the monitor or later from Azure Monitor. Test states are Pass, Fail, Warning, Indeterminate, and Not Running. If you don't set thresholds, Warning triggers at 750 ms RTT (TCP/ICMP) or 10% checks failed.

⚠️ Exam Trap: When the requirement says continuously, trend, or alert when latency exceeds, the answer is Connection monitor. When it says test now or one-time check, it's connection troubleshoot.

Reflection Question: How does configuring Network Watcher tools (e.g., IP flow verify, NSG flow logs, connection troubleshoot) fundamentally provide end-to-end network diagnostics and troubleshooting, ensuring optimal connectivity and performance across Azure environments?