From azure
Provision and sync Azure networking resources — Virtual WAN Hubs, Spoke VNets, subnets, VNet peering, NSGs, Azure Firewall rules, and Private DNS zones — from a networking-design.md and naming-convention.md. Uses the Azure MCP server. Use when applying or updating Azure networking after running design-networking.
How this skill is triggered — by the user, by Claude, or both
Slash command
/azure:manage-azure-networkingThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Implementation
Implementation
Network Contributor at the Subscription scope (or Resource Group scope for spoke resources)Microsoft.Network/virtualWans/write, Microsoft.Network/virtualHubs/write (if using Virtual WAN)Microsoft.Network/privateDnsZones/writeMicrosoft.Network/azureFirewalls/write (if deploying Azure Firewall)manage-azure-landing-zone).Apply the networking definition from networking-design.md to Azure. Ensure that:
(Sector, Tier, Region) with correct CIDRs and subnets.This skill is idempotent.
When writing configurations or documentation, you MUST strictly adhere to the structural notation and types defined in the book. Before proceeding, read the following reference files:
references/notation.mdreferences/types.mdnetworking-design.md. Read it first.naming-convention.md.landing-zone-design.md).Read all input documents before proceeding.
For each region in scope:
Virtual WAN approach:
Standard for full routing and firewall support).Hub VNet approach (alternative for smaller deployments):
AzureFirewallSubnet.For each spoke in the networking design:
For each spoke VNet, create the required subnets from the design:
| Subnet | CIDR Offset | Delegation / Purpose |
|---|---|---|
subnet-public-* | .0.0/24 | Load balancers, Application Gateway |
subnet-private-* | .1.0/22 | AKS node pools, compute workloads |
subnet-data-* | .5.0/24 | Managed databases, Redis Cache |
subnet-endpoints-* | .6.0/25 | Private Endpoints |
AzureBastionSubnet | .7.0/26 | Azure Bastion (if required) |
For AKS node pool subnets, ensure the subnet is large enough for the maximum node count × pod CIDR. Apply the correct subnet delegation if required (e.g., Microsoft.ContainerService/managedClusters).
Virtual WAN: Create a VNet Connection from each spoke VNet to the Virtual Hub. Set the routing configuration to route all traffic through the hub (associated route table: defaultRouteTable; propagated route tables: defaultRouteTable).
Hub VNet peering: Create VNet peerings between the hub VNet and each spoke VNet (bidirectional). On the hub side, allow gateway transit. On the spoke side, use remote gateway. This allows on-premises routes learned by the hub gateway to propagate to spokes.
Verify: no direct spoke-to-spoke peerings exist. If any are found, report them and ask the user whether to remove them.
For each subnet, attach a Network Security Group with the baseline rules from the networking design:
Public subnet NSG:
Private subnet NSG:
Data subnet NSG:
Create NSGs in the same Resource Group as the VNet. Associate them to subnets after creation.
For each spoke, create the internal Private DNS zone:
eu01.live.internal.ecommerce.mountainlab.io) in the connectivity Subscription.If Azure Private DNS Resolver is in use, configure inbound endpoints in the hub subnet and outbound forwarding rules for on-premises DNS zones.
Produce a summary of all resources created, already existing, or skipped.
Produce a Markdown report named azure-networking-report.md:
# Azure Networking Sync Report
**Date**: [timestamp]
**Mode**: [applied / dry-run]
## Hubs
| Name | Region | Type | Status |
|------|--------|------|--------|
| vhub-eu01 | westeurope | Virtual WAN Hub | created |
## Spoke VNets
| Name | Subscription | CIDR | Status |
|------|-------------|------|--------|
| vnet-ecommerce-live-eu01 | sub-ecommerce-live | 10.32.0.0/16 | created |
## Hub Connections
| Spoke VNet | Hub | Status |
|-----------|-----|--------|
| vnet-ecommerce-live-eu01 | vhub-eu01 | created |
## NSG Associations
| Subnet | NSG | Status |
|--------|-----|--------|
| subnet-private-ecommerce-live-eu01 | nsg-private-ecommerce-live-eu01 | created |
## Private DNS Zones
| Zone | Linked VNets | Status |
|------|-------------|--------|
| eu01.live.internal.ecommerce.mountainlab.io | vnet-ecommerce-live-eu01, hub-vnet | created |
## Direct Spoke-to-Spoke Peerings Found
[List any found — should be empty]
## Open Items
[...]
This skill is grounded in Chapter 6: Infrastructure of Crafting Platforms.
npx claudepluginhub craftingplatforms/ai --plugin azureReviews Azure network topology for hub-spoke critique, routing/DNS analysis, shared-services boundaries, firewall placement, and landing-zone connectivity guidance.
Guides Azure Virtual Network development: troubleshooting, best practices, architecture, security, deployment. For configuring VNets, NSGs, peering, VPN/ExpressRoute, Azure Firewall.
Guides AWS VPC network design: subnet tiers (public/private/database), AZ distribution, CIDR ranges, NAT gateways, private endpoints, DNS zones, API gateways.