Monitoring, Troubleshooting, and Cost

Effective network operations require two things: reactive diagnosis tools to resolve incidents quickly, and proactive monitoring to catch degradation before users notice. Azure provides Network Watcher for diagnostics, NSG flow logs and Traffic Analytics for visibility, and Azure Monitor for alerting on network health metrics.

Azure Network Watcher

Network Watcher is a regional service that must be enabled per subscription per region. It provides both one-shot diagnostic tools and continuous monitoring capabilities.

IP Flow Verify

Tests whether an NSG would allow or deny a specific 5-tuple flow at a given VM NIC. Returns the matching rule name.

# Does NSG allow TCP 443 inbound to this VM?
az network watcher test-ip-flow \
  --resource-group rg-app --vm vm-web-01 \
  --direction Inbound \
  --local 10.0.1.4:443 \
  --remote 0.0.0.0:60000 \
  --protocol TCP

Next Hop

Shows the effective route (next hop type and IP) for a packet leaving a VM, respecting all UDRs, BGP-learned routes, and system routes.

# What is the next hop for traffic from vm-web-01 to 8.8.8.8?
az network watcher show-next-hop \
  --resource-group rg-app --vm vm-web-01 \
  --source-ip 10.0.1.4 \
  --dest-ip 8.8.8.8
# nextHopType: VirtualAppliance → UDR forcing through Firewall

NSG Flow Logs and Traffic Analytics

NSG flow logs v2 record every flow through an NSG — allowed and denied — as JSON blobs in a Storage Account with byte and packet counts. Traffic Analytics processes these logs and writes enriched records to Log Analytics, enabling KQL-based analysis.

# Enable NSG flow logs v2 with Traffic Analytics
az network watcher flow-log create \
  --name fl-nsg-app --resource-group rg-app \
  --location eastus2 --nsg nsg-app \
  --storage-account sa-flowlogs \
  --enabled true --format JSON \
  --log-version 2 --retention 7 \
  --workspace ".../law-monitoring" \
  --traffic-analytics true \
  --interval 10

Traffic Analytics KQL Queries

// Top 10 talkers by bytes
AzureNetworkAnalytics_CL
| where SubType_s == "FlowLog"
| summarize TotalBytes = sum(BytesSent_d + BytesReceived_d) by SrcIP_s
| top 10 by TotalBytes

// Denied flows — investigate blocked traffic
AzureNetworkAnalytics_CL
| where FlowStatus_s == "D"
| project TimeGenerated, SrcIP_s, DestIP_s, DestPort_d, NSGRule_s

Azure Monitor Network Insights

Azure Monitor → Networks provides a unified topology view across all network resources. Key metrics to alert on:

Network Cost Patterns

Common Troubleshooting Scenarios

VM Cannot Reach the Internet

1. Run az network watcher test-ip-flow — confirm NSG is not denying outbound
2. Run az network watcher show-next-hop — confirm next hop is Internet (or VirtualAppliance if routed through Firewall)
3. If through Firewall: check Application/Network rule allows the destination FQDN/IP

VPN Tunnel Connected But No Traffic Passes

1. Verify BGP route exchange: az network vnet-gateway list-advertised-routes
2. Confirm on-premises side is advertising the correct prefixes
3. Check GatewaySubnet — no restrictive NSG should exist on it
4. IP Flow Verify from a VM in the connected subnet

Private Endpoint Not Resolving to Private IP

1. Check Private DNS Zone is linked to the VM's VNet
2. Check privateDnsZoneGroup is configured on the Private Endpoint
3. Verify A record exists: az network private-dns record-set a list --zone-name privatelink.blob.core.windows.net
4. Run nslookup from the VM — should see CNAME to privatelink zone, then private IP

Lab: NSG Flow Logs Setup

RG="rg-lab-ch12"; LOC="eastus2"
az group create --name "$RG" --location "$LOC"

SA_NAME="salabflowlogs$RANDOM"
az storage account create \
  --name "$SA_NAME" --resource-group "$RG" \
  --location "$LOC" --sku Standard_LRS

az network nsg create --name nsg-lab \
  --resource-group "$RG" --location "$LOC"

az network watcher configure \
  --resource-group NetworkWatcherRG \
  --locations "$LOC" --enabled true

# Enable flow log (Traffic Analytics requires Log Analytics workspace)
az network watcher flow-log create \
  --name fl-nsg-lab --resource-group "$RG" \
  --location "$LOC" --nsg nsg-lab \
  --storage-account "$SA_NAME" \
  --enabled true --log-version 2 --retention 7

az group delete --name "$RG" --yes --no-wait

Summary

Chapter: 12 of 12  |  Status: v0.1 Draft  |  2026-07-08