12.3 Azure Network Adapter & Azure Extended Network

Azure Network Adapter & Azure Extended Network

Organizations transitioning to hybrid cloud environments frequently encounter two distinct networking challenges: enabling rapid, secure connectivity between standalone on-premises servers and Azure Virtual Networks without deploying complex edge routing infrastructure, and migrating legacy mission-critical applications whose hardcoded IP configurations prevent traditional Layer 3 subnet re-addressing.

Microsoft addresses these challenges with two purpose-built hybrid technologies: Azure Network Adapter (ANA) for automated, server-level Point-to-Site hybrid connectivity via Windows Admin Center, and Azure Extended Network (AEN) for seamless Layer 2 broadcast domain extension across hybrid clouds using VXLAN.

---

1. Azure Network Adapter (ANA) Overview & Architecture

Azure Network Adapter is a feature integrated into Windows Admin Center (WAC) that provisions a virtual network adapter on an on-premises Windows Server instance with a single click. This virtual interface establishes a dedicated, encrypted Point-to-Site (P2S) VPN tunnel directly to an Azure Virtual Network Gateway.

+-----------------------------------------------------------------------------------+
|                        AZURE NETWORK ADAPTER ARCHITECTURE                         |
|                                                                                   |
|   [ON-PREMISES STANDALONE SERVER]                      [MICROSOFT AZURE]          |
|   +-------------------------------+                    +------------------------+ |
|   | Windows Server 2025           |                    | Azure Virtual Network  |
|   | - Physical NIC: 192.168.1.50  |                    | - Subnet: 10.50.0.0/16  | |
|   |                               |                    | - VMs, SQL, Azure Files| |
|   | [Azure Network Adapter (NIC)] |                    |                        | |
|   | - Virtual P2S Interface       | ===(P2S Tunnel)==> | [Virtual Net Gateway]  |
|   | - IP: 172.16.201.2            |  IKEv2 / OpenVPN   | - GatewaySubnet        |
|   | - Route: 10.50.0.0/16 -> Tun  |  Outbound to Azure | - P2S Address Pool:    |
|   +-------------------------------+                    |   172.16.201.0/24      |
|                                                        +------------------------+ |
+-----------------------------------------------------------------------------------+

How ANA Operates

1. Virtual Interface Provisioning: When initiated from Windows Admin Center, WAC injects and configures a virtual network interface (e.g., AzureNetworkAdapter-VNetEastUS) directly inside the Windows Server operating system networking stack.
2. Point-to-Site Tunnel Establishment: The virtual adapter initiates an outbound Point-to-Site VPN connection (using IKEv2 or OpenVPN) targeting the public IP address of the Azure Virtual Network Gateway.
3. Automated Route Injection: The server's local routing table is automatically updated with static or dynamic routes directing traffic destined for the Azure VNet address space (e.g., 10.50.0.0/16) through the virtual adapter.
4. Transport Security: Traffic traversing the public internet is fully encrypted using IPsec/IKEv2 or SSL/TLS.

---

2. Prerequisites & Deployment via Windows Admin Center

To successfully provision an Azure Network Adapter, specific hybrid cloud prerequisites must be established in advance.

+-----------------------------------------------------------------------------------+
|                    AZURE NETWORK ADAPTER PREREQUISITE PIPELINE                    |
|                                                                                   |
|   [1. AZURE REGISTRATION]     ---> Register Windows Admin Center gateway with     |
|                                    Microsoft Entra ID / Azure ARM                 |
|                                     |                                             |
|                                     v                                             |
|   [2. AZURE VNET & GATEWAY]   ---> Existing Azure VNet with Route-based Virtual   |
|                                    Network Gateway (or auto-provision via WAC)    |
|                                     |                                             |
|                                     v                                             |
|   [3. SERVER PERMISSIONS]     ---> Target on-premises server running Windows      |
|                                    Server 2019/2022/2025 managed by WAC           |
|                                     |                                             |
|                                     v                                             |
|   [4. OUTBOUND FIREWALL]      ---> Outbound connectivity allowed to Azure Gateway |
|                                    public IP endpoints (UDP 500/4500 or TCP 443)  |
+-----------------------------------------------------------------------------------+

Deployment Workflow in Windows Admin Center:

1. Open Windows Admin Center and connect to the target standalone server.
2. In the left navigation pane under Tools, select Networks.
3. In the top toolbar, click + Add Azure Network Adapter.
4. In the configuration flyout pane, select:
   • Subscription & Region: The Azure subscription and target datacenter region.
   • Virtual Network: Select the existing target Azure VNet.
   • Gateway Configuration: If an Azure Virtual Network Gateway already exists in the VNet, WAC binds to it. If not, WAC provides an option to automatically provision a new VNet Gateway (e.g., SKU VpnGw1 or Basic) directly from the WAC interface.
   • Client Address Pool: Specify an unallocated private CIDR block (e.g., 172.16.201.0/24) used to assign IP addresses to connecting P2S adapters.
5. Click Create. WAC generates the necessary certificates, configures the gateway, instantiates the local virtual NIC, and establishes the tunnel.

Use Cases for Azure Network Adapter

• Isolated Server Hybrid Connectivity: Connecting standalone branch servers or industrial workstations to Azure without requiring a hardware Site-to-Site VPN router at the physical branch.
• Offsite Cloud Backup & Migration: Permitting standalone file servers or database hosts to stream backups directly into Azure IaaS VMs or Azure File Shares over a dedicated private tunnel.
• Rapid Dev/Test Sandbox Access: Enabling developer workstations and test servers to communicate with Azure virtual machines during temporary evaluation cycles.

---

3. Comparing Hybrid Network Connectivity Options

Choosing between Azure Network Adapter, Site-to-Site VPN, and Azure ExpressRoute depends on network scope, bandwidth requirements, and infrastructure complexity.

---

4. Azure Extended Network (AEN) Overview & Problem Statement

During large-scale data center migration initiatives, enterprises frequently encounter legacy applications with rigid IP dependencies:

• Hardcoded IP addresses embedded inside application binaries, stored procedures, or legacy configuration files.
• Client-side software distributed across thousands of unmanaged endpoints configured to communicate with fixed IP addresses.
• Licensing servers locked to specific host IP addresses or MAC addresses.

Traditional cloud migrations require "re-IPing" virtual machines into the destination Azure VNet subnet. When re-IPing is technically impossible or cost-prohibitive, Azure Extended Network (AEN) provides a Layer 2 extension overlay that allows virtual machines in Azure to retain their original on-premises IPv4 addresses while residing in the cloud.

+-----------------------------------------------------------------------------------+
|                       AZURE EXTENDED NETWORK OVERLAY FABRIC                       |
|                                                                                   |
|   [ON-PREMISES DATA CENTER]                           [MICROSOFT AZURE]           |
|   +--------------------------+                        +-------------------------+ |
|   | Physical Subnet:         |                        | Azure Virtual Network   |
|   | 192.168.1.0/24           |                        | Subnet: 10.200.0.0/16   |
|   |                          |                        |                         | |
|   | [On-Prem AEN Appliance]  |                        | [Azure AEN Appliance]   | |
|   | (Hyper-V VM)             |                        | (Azure IaaS VM)         | |
|   | - Promiscuous Mode/MAC   | ===(VXLAN Tunnel)===>  | - IP Forwarding Enabled | |
|   | - Listens on L2 Subnet   |  UDP Port 4789 Overlay | - Receives Decapsulated | |
|   +--------------------------+   over S2S VPN / ER    +-------------------------+ |
|                |                                                   |              |
|   +--------------------------+                        +-------------------------+ |
|   | On-Prem VM: Web01        |                        | Migrated VM: App01      | |
|   | IP: 192.168.1.10         | <====(Seamless L2)===> | IP: 192.168.1.15        | |
|   | (Original IP Preserved)  |     Direct L2 Traffic  | (Original IP Preserved!)| |
|   +--------------------------+                        +-------------------------+ |
+-----------------------------------------------------------------------------------+

---

5. AEN Architecture: VXLAN Overlay Mechanics

Azure Extended Network operates by deploying a pair of Virtual Appliances (NVAs) that establish a bidirectional Virtual Extensible LAN (VXLAN) overlay tunnel (RFC 7348) over an existing Layer 3 Site-to-Site VPN or ExpressRoute connection.

The Two Virtual Appliances

1. On-Premises Virtual Appliance (Hyper-V VM):
   • Deployed onto an on-premises Hyper-V host attached to the physical Layer 2 switch/subnet whose address space is being extended.
   • Configured with MAC Address Spoofing enabled on its Hyper-V virtual network adapter to capture and inject Layer 2 frames from other virtual machines on the local vSwitch.
2. Azure Virtual Appliance (Azure IaaS VM):
   • Deployed into an Azure VNet subnet running Windows Server.
   • Configured with IP Forwarding enabled on its Azure Virtual Network Interface (NIC) to allow routing packets destined for other IP addresses.

Packet Encapsulation & Data Flow

• Step 1 (Frame Capture): When an on-premises machine (192.168.1.10) sends an ARP request or Ethernet frame to the migrated cloud server (192.168.1.15), the on-premises AEN appliance intercepts the Layer 2 Ethernet frame.
• Step 2 (VXLAN Encapsulation): The on-premises appliance encapsulates the entire Layer 2 Ethernet frame (including original MAC and IP headers) inside a UDP datagram targeting UDP port 4789.
• Step 3 (Transport): The encapsulated UDP packet is transmitted across the underlying Layer 3 Site-to-Site VPN or ExpressRoute circuit to the Azure AEN appliance.
• Step 4 (Decapsulation & Injection): The Azure AEN appliance receives the UDP packet, strips the VXLAN header, and injects the original Layer 2 Ethernet frame into the Azure virtual subnet where the target migrated VM receives it seamlessly.

---

6. AEN Deployment, Limitations & Planning Considerations

Deploying and managing Azure Extended Network is performed via the Azure Extended Network tool in Windows Admin Center.

Deployment Checklist:

• Underlying Connectivity: An active, functioning Site-to-Site VPN or ExpressRoute connection must be operational before deploying AEN.
• Hyper-V Host Configuration: MAC Address Spoofing (EnableMacAddressSpoofing = $true) must be enabled on the on-premises appliance VM NIC.
• Azure Network Interface: IP Forwarding (EnableIPForwarding = $true) must be enabled on the Azure appliance VM NIC.

# Enable MAC Address Spoofing on the On-Premises Hyper-V Appliance NIC
Set-VMNetworkAdapter `
    -VMName 'AEN-OnPrem-Appliance' `
    -MacAddressSpoofing On

# Enable IP Forwarding on the Azure Appliance VM Network Interface via Az CLI
# az network nic update --name AEN-Azure-NIC --resource-group RG-Hybrid --ip-forwarding true

Limitations & Architectural Warnings

[!CAUTION] Temporary Migration Mechanism vs Long-Term Architecture: Azure Extended Network is strictly intended as a temporary transition tool to facilitate phased workload migration without immediate re-IPing. It should never be architected as a permanent multi-year enterprise networking topology.

1. Throughput and CPU Bottlenecks: All cross-environment Layer 2 traffic must traverse the two single-instance virtual appliance VMs, creating packet serialization latency and CPU encapsulation overhead.
2. MTU Reduction (Packet Fragmentation): VXLAN encapsulation adds a 50-byte header (Outer IP + UDP + VXLAN headers) to every frame. If the standard Ethernet Maximum Transmission Unit (MTU) of 1500 bytes is exceeded, packet fragmentation occurs, degrading performance for high-throughput database workloads.
3. Broadcast & Multicast Flooding: Layer 2 broadcast traffic (e.g., frequent ARP broadcasts and NetBIOS name queries) traverses the WAN overlay tunnel, consuming bandwidth across the S2S VPN or ExpressRoute circuit.