Networking Migration: Citrix NetScaler/Gateway to AVD¶

# Allow UDP for RDP Shortpath (managed networks)
az network nsg rule create \
  --nsg-name nsg-avd-sessionhosts \
  --resource-group rg-avd-prod \
  --name AllowRDPShortpath \
  --priority 200 \
  --direction Inbound \
  --access Allow \
  --protocol Udp \
  --destination-port-ranges 3390 \
  --source-address-prefixes "10.0.0.0/8" "172.16.0.0/12"  # internal only

# OUTBOUND ONLY (no inbound rules needed)
# Session hosts need outbound access to:

# AVD service endpoints
# *.wvd.microsoft.com (TCP 443)
# *.servicebus.windows.net (TCP 443)
# *.prod.warm.ingest.monitor.core.windows.net (TCP 443)

# Azure infrastructure
# login.microsoftonline.com (TCP 443)
# login.windows.net (TCP 443)
# kms.core.windows.net (TCP 1688)

# Windows Update
# *.windowsupdate.com (TCP 443)
# *.update.microsoft.com (TCP 443)

# RDP Shortpath (if using public network Shortpath)
# STUN/TURN endpoints (UDP 3478, TCP 443)

az network nsg rule create \
  --nsg-name nsg-avd-sessionhosts \
  --resource-group rg-avd-prod \
  --name AllowAVDServiceOutbound \
  --priority 100 \
  --direction Outbound \
  --access Allow \
  --protocol Tcp \
  --destination-port-ranges 443 \
  --destination-address-prefixes "WindowsVirtualDesktop" "AzureMonitor" "AzureActiveDirectory"

# Deny all other outbound (optional, for zero-trust)
az network nsg rule create \
  --nsg-name nsg-avd-sessionhosts \
  --resource-group rg-avd-prod \
  --name DenyAllOutbound \
  --priority 4096 \
  --direction Outbound \
  --access Deny \
  --protocol "*" \
  --destination-port-ranges "*" \
  --destination-address-prefixes "*"

# Create Private Link for AVD host pool
az desktopvirtualization hostpool update \
  --name hp-analytics-prod \
  --resource-group rg-avd-prod \
  --public-network-access Disabled

# Create private endpoint for host pool connection
az network private-endpoint create \
  --name pe-avd-hostpool \
  --resource-group rg-avd-prod \
  --vnet-name vnet-avd-prod \
  --subnet snet-privateendpoints \
  --private-connection-resource-id /subscriptions/.../hostPools/hp-analytics-prod \
  --group-id connection \
  --connection-name pec-avd-connection

# Create private endpoint for workspace feed
az network private-endpoint create \
  --name pe-avd-workspace \
  --resource-group rg-avd-prod \
  --vnet-name vnet-avd-prod \
  --subnet snet-privateendpoints \
  --private-connection-resource-id /subscriptions/.../workspaces/ws-analytics-prod \
  --group-id feed \
  --connection-name pec-avd-feed

# Azure Front Door provides global anycast entry points
# Users connect to the nearest Front Door POP
# Front Door routes to the closest AVD region

az afd profile create \
  --profile-name afd-avd-global \
  --resource-group rg-avd-global \
  --sku Premium_AzureFrontDoor

# Note: Front Door integration with AVD requires Private Link
# for backend connectivity to AVD host pools

# ExpressRoute provides private, dedicated connectivity
# Useful for:
# - Branch offices connecting to AVD via private network
# - Hybrid scenarios with on-prem file servers
# - Regulatory requirements for private connectivity

# ExpressRoute circuit (established via provider)
az network express-route create \
  --name er-avd-primary \
  --resource-group rg-avd-networking \
  --location eastus2 \
  --bandwidth 1000 \
  --peering-location "Washington DC" \
  --provider "Equinix"

# Create private DNS zones for AVD Private Link
az network private-dns zone create \
  --name "privatelink.wvd.microsoft.com" \
  --resource-group rg-avd-networking

# Link to AVD VNet
az network private-dns link vnet create \
  --name link-avd-vnet \
  --resource-group rg-avd-networking \
  --zone-name "privatelink.wvd.microsoft.com" \
  --virtual-network vnet-avd-prod \
  --registration-enabled false

# Create private DNS zone for Azure Files
az network private-dns zone create \
  --name "privatelink.file.core.windows.net" \
  --resource-group rg-avd-networking

az network private-dns link vnet create \
  --name link-avd-files \
  --resource-group rg-avd-networking \
  --zone-name "privatelink.file.core.windows.net" \
  --virtual-network vnet-avd-prod \
  --registration-enabled false

# Private endpoint to Fabric/Synapse
az network private-endpoint create \
  --name pe-avd-fabric \
  --resource-group rg-avd-prod \
  --vnet-name vnet-avd-prod \
  --subnet snet-privateendpoints \
  --private-connection-resource-id /subscriptions/.../workspaces/fabric-analytics \
  --group-id sql

# Private endpoint to Databricks workspace
az network private-endpoint create \
  --name pe-avd-databricks \
  --resource-group rg-avd-prod \
  --vnet-name vnet-avd-prod \
  --subnet snet-privateendpoints \
  --private-connection-resource-id /subscriptions/.../workspaces/dbx-analytics \
  --group-id databricks_ui_api

# Private endpoint to ADLS Gen2
az network private-endpoint create \
  --name pe-avd-adls \
  --resource-group rg-avd-prod \
  --vnet-name vnet-avd-prod \
  --subnet snet-privateendpoints \
  --private-connection-resource-id /subscriptions/.../storageAccounts/adlsanalytics \
  --group-id dfs