1. The Scenario — SecureBank
| Attribute | Detail |
|---|---|
| Industry | Financial Services (retail & commercial banking) |
| On-premises DCs | 3 — New York, London, Singapore |
| Migration scope | 60% of workloads to Azure over 18 months |
| Existing estate | 200+ VMs, 15 SQL Servers, custom LOB apps |
| Latency requirement | <5 ms between app tier and DB tier |
| Availability SLA | 99.99% for customer-facing services |
| Compliance | SOX, PCI-DSS — data must not leave region |
| Hybrid connectivity | ExpressRoute from all 3 DCs |
| Security posture | Zero-trust network model, TLS inspection |
2. Decision 1 — Network Topology
Choice: Azure Virtual WAN with Secured Virtual Hubs (Azure Firewall Manager) in East US, UK South, and Southeast Asia.
Rationale
- Virtual WAN — Microsoft-managed routing; simplifies any-to-any transit across 3 regions without maintaining custom route tables.
- Secured Hubs — centralises firewall policy per region via Firewall Manager; consistent rule sets across geographies.
- Hub-Spoke per region — connectivity hub + dedicated app spokes isolate blast radius; CIDR planning uses /16 per region, /22 per spoke.
💡 CIDR Plan
East US: 10.1.0.0/16 · UK South: 10.2.0.0/16 · SE Asia: 10.3.0.0/16
Each spoke: /22 (1,024 IPs) — subnets for app (/24), data (/24), mgmt (/26), AzureFirewallSubnet (/26).
3. Decision 2 — Hybrid Connectivity
Choice: ExpressRoute with Global Reach + FastPath for latency-sensitive traffic.
- ExpressRoute Premium — each DC gets a dedicated circuit (redundant pairs); connects to the regional vWAN hub.
- Global Reach — enables DC-to-DC communication (e.g., NY ↔ London) over Microsoft backbone without hairpinning through Azure.
- FastPath — bypasses the gateway for traffic between on-prem and directly-peered VNets; critical for <5 ms app-to-DB latency.
- VPN as failover — site-to-site VPN tunnels provide last-resort connectivity if an ER circuit degrades.
4. Decision 3 — Zero-Trust Security
Choice: Azure Firewall Premium + Private Endpoints + NSG/ASG micro-segmentation.
- Azure Firewall Premium — TLS inspection, IDPS signatures, URL filtering; deployed in each secured hub.
- Private Endpoints — all PaaS services (SQL, Storage, Key Vault) accessed only via Private Link; no public endpoints.
- NSG + ASG — application security groups tag workloads (e.g., "WebTier", "AppTier"); NSG rules reference ASGs for intent-based micro-segmentation.
- DDoS Protection Standard — enabled on all VNets hosting public-facing IPs.
💡 PCI-DSS Alignment
Cardholder data environment (CDE) spokes have deny-all NSG defaults; only explicitly whitelisted ASG flows are permitted. Diagnostic logs ship to a dedicated Log Analytics workspace with 1-year retention.
5. Decision 4 — Load Balancing
Choice: Three-tier: Azure Front Door → Application Gateway → Internal Load Balancer.
- Azure Front Door — global anycast entry; WAF policy (OWASP 3.2 + bot protection); routes to nearest healthy region.
- Application Gateway v2 — regional L7 with WAF; handles path-based routing, SSL offload, and autoscaling.
- Internal Load Balancer (Standard) — distributes traffic across backend VMs/AKS nodes within a spoke; zone-redundant.
6. Decision 5 — Compute & DR
- AKS — modernised LOB apps containerised; CNI networking for VNet-native pods; node pools across 3 AZs.
- VMs in Availability Zones — legacy apps not yet refactored; deployed across zones for 99.99% VM SLA.
- VMSS — batch processing workloads; scale-in during off-hours to optimise cost.
- SQL Failover Groups — auto-failover across paired regions (East US ↔ West US 2, UK South ↔ UK West); RPO <5 s.
- Azure Site Recovery (ASR) — replicates VMs to paired region; RTO <15 min.
- Traffic Manager — DNS-based failover (priority routing) for active-passive multi-region DR.