Two services today that share a theme: knowing what is happening on your network, and surviving the day someone floods it. Network Watcher is the toolbox you will use weekly; DDoS Protection is the insurance you hope stays idle.

DDoS: What the Platform Gives and What You Buy

Every public IP on Azure sits behind infrastructure level DDoS defense that protects the Azure platform itself; it triggers at thresholds sized for Azure, not for your application, which can be saturated long before platform mitigation cares. The paid offering comes in two SKUs. DDoS Network Protection covers all public IPs in enrolled VNets, with adaptive tuning that learns your traffic profile per IP, always on volumetric and protocol mitigation, attack analytics, rapid response support during an incident, and cost protection crediting the scale out an attack causes. DDoS IP Protection is the same engine per single public IP, priced for estates with only a handful of exposed endpoints. The decision is arithmetic: Network Protection carries a fixed monthly platform fee covering 100 IPs, so below roughly 15 protected IPs the per IP SKU is cheaper.

resource "azurerm_network_ddos_protection_plan" "this" {
  name                = "ddos-contoso"
  location            = "westeurope"
  resource_group_name = azurerm_resource_group.net.name
}

resource "azurerm_virtual_network" "hub" {
  name                = "vnet-hub-weu"
  location            = "westeurope"
  resource_group_name = azurerm_resource_group.net.name
  address_space       = ["10.10.0.0/16"]

  ddos_protection_plan {
    id     = azurerm_network_ddos_protection_plan.this.id
    enable = true
  }
}

One plan serves the whole tenant across subscriptions, so create it centrally and reference it everywhere. Layer 7 attacks are explicitly not this service’s job: HTTP floods that look like traffic are absorbed by the WAF rate limiting and bot rules from the Front Door and Application Gateway posts, and a complete posture needs both layers. When an attack does come, the DDoS metrics (under attack flag, dropped versus forwarded packets) feed alerts, and the mitigation reports tell you vectors and volumes for the postmortem.

Network Watcher: The Weekly Toolbox

Network Watcher is a bag of diagnostic tools, and three of them earn permanent places in your workflow. VNet flow logs (the successor to NSG flow logs, enable the new kind) record every flow with source, destination, port, protocol, bytes, and the decision that allowed or denied it, written to a storage account. Alone they are forensic raw material; with Traffic Analytics enabled on top, they become dashboards of talking pairs, cross region flows, denied traffic hot spots, and the answer to “what actually uses this port” before every firewall migration.

resource "azurerm_network_watcher_flow_log" "vnet" {
  network_watcher_name = "NetworkWatcher_westeurope"
  resource_group_name  = "NetworkWatcherRG"
  name                 = "fl-vnet-hub"

  target_resource_id = azurerm_virtual_network.hub.id
  storage_account_id = azurerm_storage_account.flowlogs.id
  enabled            = true
  version            = 2

  retention_policy {
    enabled = true
    days    = 30
  }

  traffic_analytics {
    enabled               = true
    workspace_id          = azurerm_log_analytics_workspace.central.workspace_id
    workspace_region      = "westeurope"
    workspace_resource_id = azurerm_log_analytics_workspace.central.id
    interval_in_minutes   = 10
  }
}

Connection troubleshoot answers the eternal ticket “A cannot reach B” authoritatively: it evaluates the effective route tables, NSGs, and admin rules along the path and names the exact rule that dropped the flow, turning an afternoon of guesswork into a thirty second query. Its always on sibling, connection monitor, runs the same tests continuously between chosen endpoints and alerts on failure or latency drift, ideal for watching the ExpressRoute path or a critical service dependency. And packet capture, triggered remotely on a VM (optionally by an alert), grabs the pcap for the rare problem where only the wire truth will do, without anyone RDPing anywhere, which after the Bastion post should be nobody anyway.

The habit to build: flow logs and traffic analytics on by policy for every VNet, connection monitors on your five most critical paths, and the DDoS plan attached to anything with a public frontend. Visibility first, because you cannot defend what you cannot see.

Cheers
Osama