Hybrid Azure network incidents waste days because teams debug the wrong layer. An application “cannot connect to SQL” is treated as a firewall ticket, then a route ticket, then a DNS ticket, then a weekend of packet captures that confirm all three were involved.
Start with the path, not the product. Name resolution first: which DNS server answered, and did it return a private or public address? Then routing: which next hop does the client, the gateway and the hub firewall believe in? Then policy: NSG, Azure Firewall, NVAs, UDRs, and on-premises ACLs. Then the application protocol itself.
ExpressRoute and VPN add their own failure modes: BGP advertisements that unexpectedly include or exclude prefixes, asymmetric return paths, MTU, and a default route that blackholes internet-bound traffic from a spoke. If you advertised 0.0.0.0/0 toward on-premises without intending to, you will find out during the next DNS outage.
Private Endpoints change the problem. You now have a NIC in a subnet, a private DNS zone, and a record that must exist in the right zone. Missing zone links look identical to “the firewall is blocking 443”. They are not.
Write the topology down before you change anything. Hub, spokes, gateways, firewalls, DNS. North Ark’s troubleshooting work often ends with a diagram the internal team did not have, plus a short list of permanent fixes: a route, a DNS link, a named owner for the next incident.
All technical perspectives