Design the network path for a public .NET API on a cloud platform: from the user's browser to the database. Which components do you put in the path (DNS, CDN/WAF, load balancers, proxies, firewalls, private networking), and what does each one do?

1. Design walk-through, outside in

DNS: api.example.com CNAME to the edge endpoint; TTL 300 s; DNSSEC where supported; CAA records restricting which CAs can issue certificates.

Edge: anycast IPs terminate TLS close to users (saving round trips: Sydney users do not pay the handshake to a US origin). Cache what is cacheable (Cache-Control from the app). WAF managed rule sets plus custom rate limits by IP and by API key. Health probes per origin for failover.

Origin protection: private link from edge to regional gateway when available; otherwise restrict to the edge's published IP ranges or service tags and validate an edge-injected header or ID.

Regional gateway/ingress: path and host routing, request size limits, timeouts aligned with the app, HTTP/2 to backends, session affinity off by default.

App tier: private subnets, no public IPs, NSGs/security groups default-deny, Kubernetes NetworkPolicies (ingress from gateway namespace only; egress to DNS, data subnet and egress gateway), workload identity for credentials.

Data tier: private endpoints + private DNS zones linked to the VNet; public network access disabled; separate subnet with its own rules.

Egress: NAT gateway for predictable outbound IPs (partners can allow-list them) and enough SNAT ports; or a firewall with FQDN rules and logging for exfiltration control.

2. Latency budget example (user in Perth, origin in Sydney)

without edge: DNS 20 + TCP 50 + TLS 50 + request 50 + app 30      ≈ 200 ms cold
with edge:    DNS 20 + TCP 5  + TLS 5  + edge→origin (warm) 50 + app 30 ≈ 110 ms cold

3. Failure modes to design for

4. Observability

• Edge and WAF logs (blocked requests, cache hit ratio), gateway access logs, NSG/VPC flow logs, firewall logs.
• Propagate traceparent through all hops; correlate edge request IDs with app traces.
• Synthetic checks from several regions through the full path.

5. Everything as code

Terraform/Bicep for VNets, rules, private endpoints and DNS; Helm/Kustomize for NetworkPolicies and ingress; policy-as-code (Azure Policy, OPA) to forbid public IPs on data services.

6. Try it yourself

Sketch this design for one of your services. For each hop, write down: who terminates TLS, which IPs may connect, the timeout, the health check and where its logs go. Then try to reach the origin directly from the internet and confirm it is blocked.

// App-side pieces of the design
var builder = WebApplication.CreateBuilder(args);

// Trust edge + gateway hops for client IP and scheme
builder.Services.Configure<ForwardedHeadersOptions>(o =>
{
    o.ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto;
    o.ForwardLimit = 2;
    o.KnownProxies.Clear();
    o.KnownProxies.Add(IPAddress.Parse("10.10.1.10")); // regional gateway private IP
});

// Reject requests that did not come through the edge (defence in depth behind IP restrictions)
var expectedEdgeId = builder.Configuration["Edge:Id"]!;

var app = builder.Build();
app.UseForwardedHeaders();
app.Use(async (ctx, next) =>
{
    if (ctx.Request.Path.StartsWithSegments("/health")) { await next(); return; }
    if (ctx.Request.Headers["X-Azure-FDID"] != expectedEdgeId)   // Front Door ID header
    {
        ctx.Response.StatusCode = StatusCodes.Status403Forbidden;
        return;
    }
    await next();
});

// Cache headers the edge can honour
app.MapGet("/catalogue/{id}", (int id) => Results.Ok(GetItem(id)))
   .CacheOutput(p => p.Expire(TimeSpan.FromMinutes(5)));

app.Run();

# Terraform sketch: SQL reachable only through a private endpoint
resource "azurerm_mssql_server" "orders" {
  name                          = "sql-orders-prod"
  public_network_access_enabled = false
  # ...
}

resource "azurerm_private_endpoint" "orders_sql" {
  name      = "pe-sql-orders"
  subnet_id = azurerm_subnet.data.id
  private_service_connection {
    name                           = "sql"
    private_connection_resource_id = azurerm_mssql_server.orders.id
    subresource_names              = ["sqlServer"]
    is_manual_connection           = false
  }
  private_dns_zone_group {
    name                 = "sql"
    private_dns_zone_ids = [azurerm_private_dns_zone.sql.id]
  }
}