{"id":48381,"date":"2025-12-01T09:00:00","date_gmt":"2025-12-01T17:00:00","guid":{"rendered":""},"modified":"2025-12-03T09:49:58","modified_gmt":"2025-12-03T17:49:58","slug":"azure-networking-updates-on-security-reliability-and-high-availability","status":"publish","type":"post","link":"https:\/\/azure.microsoft.com\/en-us\/blog\/azure-networking-updates-on-security-reliability-and-high-availability\/","title":{"rendered":"Azure networking updates on security, reliability, and high availability"},"content":{"rendered":"\n

Enabling the next wave of cloud transformation with Azure Networking<\/h2>\n\n\n\n

The cloud landscape is evolving at an unprecedented pace, driven by the exponential growth of AI workloads and the need for seamless, secure, and high-performance connectivity. Azure Network services<\/a> stand at the forefront of this transformation, delivering the hyperscale infrastructure, intelligent services, and resilient architecture that empower organizations to innovate and scale with confidence.<\/p>\n\n\n\n

\n
Get the latest Azure Network services updates here<\/a><\/div>\n<\/div>\n\n\n\n

Azure\u2019s global network is purpose-built to meet the demands of modern AI and cloud applications. With over 60 AI regions, 500,000+ miles of fiber, and more than 4 petabits per second (Pbps) of WAN capacity, Azure\u2019s backbone is engineered for massive scale and reliability. The network has tripled its overall capacity since the end of FY24, now reaching 18 Pbps, ensuring that customers can run the most demanding AI and data workloads with uncompromising performance.<\/p>\n\n\n\n

In this blog, I am excited to share about our advancements in data center networking that provides the core infrastructure to run AI training models at massive scale, as well as our latest product announcements to strengthen the resilience, security, scale, and the capabilities needed to run cloud native workloads for optimized performance and cost.<\/p>\n\n\n\n

AI at the heart of the cloud<\/h2>\n\n\n\n

AI is not just a workload\u2014it\u2019s the engine driving the next generation of cloud systems. Azure\u2019s network fabric is optimized for AI at every layer, supporting long-lasting, high-bandwidth flows for model training, low-latency intra-datacenter fabrics for GPU clusters, and secure, lossless traffic management. Azure\u2019s architecture integrates InfiniBand and high-speed Ethernet to deliver ultra-fast, lossless data transfer between compute and storage, minimizing training times and maximizing efficiency. Azure\u2019s network is built to support workloads with distributed GPU pools across datacenters and regions using a dedicated AI WAN. Distributed GPU clusters are connected to the services running in Azure regions via a dedicated and private connection that uses Azure Private Link and hardware based VNet appliance running high performant DPUs.<\/p>\n\n\n

\"Diagram\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n

Azure Network services are designed to support users at every stage\u2014from migrating on-premises workloads to the cloud, to modernizing applications with advanced services, to building cloud-native and AI-powered solutions. Whether it\u2019s seamless VNet integration, ExpressRoute for private connectivity, or advanced container networking for Kubernetes, Azure provides the tools and services to connect, build, and secure the cloud of tomorrow.<\/p>\n\n\n\n

Resilient by default<\/h2>\n\n\n\n

Resiliency is foundational to Azure Networking\u2019s mission. We continue to execute on the goal to provide resiliency by default. In continuing with the trend of offering zone resilient SKUs of our gateways (ExpressRoute, VPN, and Application Gateway), the latest to join the list is Azure NAT Gateway. At Ignite 2025, we announced the public preview of Standard NAT Gateway V2 which offers zone redundant architecture for outbound connectivity at no additional cost. Zone Redundant NAT gateways automatically distribute traffic to available zones during an outage of a single zone. It also supports 100 Gbps of total throughput and can handle 10 million packets per second. It is IPv6 ready out of the gate and provides traffic insights with flow logs. Read the NAT Gateway blog<\/a> for more information.<\/p>\n\n\n

\"\"\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n

Pushing the boundaries on security<\/h2>\n\n\n\n

We continue to advance our platform with security as the top mission, adhering to the principles of Secure Future Initiatives. Along these lines, we are happy to announce the following capabilities in preview or GA:<\/p>\n\n\n\n

DNS Security Policy with Threat Intel<\/a>: Now generally available, this feature provides smart protection with continuous updates, monitoring, and blocking of known malicious domains.<\/p>\n\n\n

\"Threat\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n

Private Link Direct Connect<\/a>: Now in public preview, this extends Private Link connectivity to any routable private IP address, supporting disconnected VNets and external SaaS providers, with enhanced auditing and compliance support.<\/p>\n\n\n

\"\"\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n

JWT Validation in Application Gateway<\/a>: Application Gateway now supports JSON Web Token (JWT) validation in public preview, delivering native JWT validation at Layer 7<\/strong>\u202ffor web applications, APIs, and service-to-service (S2S) or machine-to-machine (M2M) communication. This feature shifts the token validation process from backend servers to the Application Gateway, improving performance and reducing complexity. This capability enables organizations to strengthen security without adding complexity, offering consistent, centralized, secure-by-default Layer 7 controls\u202fthat allow teams to build and innovate faster while maintaining a trustworthy security posture.\u200b<\/p>\n\n\n\n

Forced tunneling for VWAN Secure Hubs<\/a>: Forced Tunnel allows you to configure Azure Virtual WAN to inspect Internet-bound traffic with a security solution deployed in the Virtual WAN hub and route inspected traffic to a designed next hop instead of directly to the Internet.\u202fRoute Internet traffic to edge Firewall connected to Virtual WAN via the default route learnt from ExpressRoute, VPN or SD-WAN. Route Internet traffic to your favorite Network Virtual Appliance or SASE solution deployed in spoke\u202fVirtual Network connected to Virtual WAN.<\/p>\n\n\n\n

Providing ubiquitous scale<\/h2>\n\n\n\n

Scale is of utmost importance to customers looking to fine tune their AI models or low latency inferencing for their AI\/ML workloads. Enhanced VPN and ExpressRoute connectivity, and scalable private endpoints further strengthen the platform\u2019s reliability and future-readiness.<\/p>\n\n\n\n

ExpressRoute 400G: Azure will be supporting 400G ExpressRoute direct ports in select locations starting 2026. Users can use multiple of these ports to provide multi-terabit throughput via dedicated private connection to on-premises or remote GPU sites.<\/p>\n\n\n

\"ExpressRoute<\/figure>\n\n\n\n

High throughput VPN Gateway: We are announcing GA of 3x faster VPN gateway connectivity with support for single TCP flow of 5Gbps and a total throughput of 20 Gbps with four tunnels.<\/p>\n\n\n\n

High scale Private Link<\/a>: We are also increasing the total number of private endpoints allowed in a virtual network to 5000 and a total of 20,000 cross peered VNets.<\/p>\n\n\n\n

Advanced traffic filtering<\/a> for storage optimization in Azure Network Watcher: Targeted traffic logs help optimize storage costs, accelerate analysis, and simplify configuration and management.<\/p>\n\n\n\n

Enhancing the experience of cloud native applications<\/h2>\n\n\n\n

Elasticity and the ability to scale seamlessly are essential capabilities Azure customers who deploy containerized apps expect and rely on. AKS is an ideal platform for deploying and managing containerized applications that require high availability, scalability, and portability. Azure\u2019s Advanced Container Networking Service<\/a> is natively integrated with AKS and offered as a managed networking add-on for workloads that require high performance networking, essential security and pod level observability.<\/p>\n\n\n\n

We are happy to announce the product updates below in this space:<\/p>\n\n\n\n