A firewalled buffer network on premises that sits between the outside world and the core network. Microsoft Learn suggests ending ExpressRoute Microsoft peering there, while private peering lands on the core.
Also called demilitarised zone; perimeter network.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains DMZ in context, with comparison tables and the common traps.
Terms in this definition
- ExpressRoute
A dedicated private link between on-premises networks and Azure, using Microsoft peering or private peering.
- Microsoft peering
Routing domain on ExpressRoute that reaches public endpoints of Azure PaaS and Microsoft 365 using public IP prefixes you own. Circuits created since August 2017 advertise nothing until you attach a route filter.
- Private peering
The ExpressRoute routing domain for reaching Azure VNets from on-premises networks over private addressing. Unless IPsec or MACsec is layered on, the traffic travels unencrypted.
Related terms
- Defence in depth
Security approach that stacks several protective layers, from physical security through identity and access, perimeter, network, compute and application to data, so an attacker who gets past one is still held up by another.
- DMZ
Buffer zone between the internet and internal networks where services that outsiders can reach are hosted. When VCF Automation is exposed externally, its appliances sit in one VPC and the load balancer in a separate DMZ VPC, with routing and stateful firewalling done by the Tier-0 gateway.