Azure
Networking
advanced
Landing Zone Network Baseline — Azure Architecture Template
Platform VNet baseline with firewall egress control, NSGs, NAT gateway, private DNS resolution and bastion access.
Why this architecture works
- All outbound traffic exits via firewall or NAT gateway, giving stable egress IPs and full inspection
- NSGs plus route tables enforce segmentation as code before the first workload lands
- DNS Private Resolver lets workloads resolve private endpoints and on-prem names without custom DNS VMs
- Bastion is the only management path — no VM ever gets a public IP
- Flow logs and firewall diagnostics land in Log Analytics from day zero for auditability
What's inside (10 resources)
Firewall PIP
public-ip
Bastion
bastion-host
Egress Firewall
firewall
Platform VNet
virtual-network
Subnet NSGs
network-security-group
Route Tables
route-table
Egress NAT
nat-gateway
DNS Resolver
dns-private-resolver
Flow Logs
network-watcher
Logs
log-analytics-workspace
From template to running infrastructure
- Open this template in the CloudForge visual designer (free account, no credit card).
- Customize resources, names, and connections on the drag-and-drop canvas — or ask Vani, the AI architect, to adapt it.
- Generate production-ready Terraform, ARM, or Bicep in one click.
- Review the plan diff and security scan, then deploy with human approval.