further review markups

nslack · nslack · commit e0ec865b8cca · 2024-04-29T17:09:46.000+01:00
diff --git a/articles/communications-gateway/connectivity.md b/articles/communications-gateway/connectivity.md
@@ -38,7 +38,7 @@ The following table lists all the available connection types and whether they're
 |Public internet |⚠️ Lab deployments only|✅|✅|- No extra setup<br>- Where available, not recommended for production |
 
 > [!NOTE]
-> The Operator Connect and Teams Phone Mobile programs do not allow production deployments to use the public internet, including virtual private networks over the public internet.
+> The Operator Connect and Teams Phone Mobile programs do not allow production deployments to use the public internet, including VPNs over the public internet.
 
 Set up your network as in the following diagram and configure it in accordance with any network connectivity specifications for your chosen communications services. For production deployments, your network must have two sites with cross-connect functionality. For more information on the reliability design for Azure Communications Gateway, see [Reliability in Azure Communications Gateway](reliability-communications-gateway.md).
 
@@ -103,7 +103,7 @@ All Azure Communications Gateway IP addresses can be used for both signaling (SI
 
 ## VNet injection for Azure Communications Gateway (preview)
 
-VNet injection for Azure Communications Gateway (preview) allows the network interfaces on your Azure Communications Gateway that connect to your network to be deployed into virtual networks in your subscription. This allows you to control the traffic flowing between your network and your Azure Communications Gateway instance using private subnets, and lets you use private connectivity to your premises such as ExpressRoute Private Peering and Virtual Private Networks.
+VNet injection for Azure Communications Gateway (preview) allows the network interfaces on your Azure Communications Gateway that connect to your network to be deployed into virtual networks in your subscription. This allows you to control the traffic flowing between your network and your Azure Communications Gateway instance using private subnets, and lets you use private connectivity to your premises such as ExpressRoute Private Peering and VPNs.
 
 If you use VNet injection (preview) with Operator Connect or Teams Phone Mobile, your network must still meet the redundancy and resiliency requirements described in the _Network Connectivity Specification_ provided to you by your onboarding team. This mandates that your network is connected to Azure by at least 2 ExpressRoute circuits, each deployed with local redundancy and configured so that each region can use both circuits in the case of failure as described in the diagram below:
 
diff --git a/articles/communications-gateway/prepare-for-vnet-injection.md b/articles/communications-gateway/prepare-for-vnet-injection.md
@@ -19,8 +19,8 @@ The following diagram shows an overview of Azure Communications Gateway deployed
 ## Prerequisites
 - Your Azure subscription is [enabled for Azure Communications Gateway](prepare-to-deploy.md#get-access-to-azure-communications-gateway-for-your-azure-subscription).
 - Your onboarding team is aware that you intend to use your own virtual networks.
-- You  have an Azure virtual network and subnet in each of the Azure regions to be used as the Azure Communications Gateway [service regions](reliability-communications-gateway.md#service-regions). Learn how to create a [virtual network](/azure/virtual-network/manage-virtual-network) and [subnet](/azure/virtual-network/virtual-network-manage-subnet).
-- Each subnet has at least 16 free IP addresses which can be used by Azure Communications Gateway. 
+- You  have an Azure virtual network in each of the Azure regions to be used as the Azure Communications Gateway [service regions](reliability-communications-gateway.md#service-regions). Learn how to create a [virtual network](/azure/virtual-network/manage-virtual-network).
+- You have a subnet to be dedicated to Azure Communications Gateway in each Azure virtual network. These subnets must each have at least 16 IP addresses (a /28 IPv4 range or larger). Learn how to create a [subnet](/azure/virtual-network/virtual-network-manage-subnet).
 - Your chosen connectivity solution (for example ExpressRoute) is deployed into your Azure subscription and ready to use.
 
 > [!TIP]
@@ -78,6 +78,9 @@ Work with your onboarding team to determine the right network security group con
 
 Your network security group configuration must allow traffic to the necessary [Port ranges used by Azure Communications Gateway](./connectivity.md#port-ranges-used-by-azure-communications-gateway).
 
+> [!TIP]
+> You can use [recommendations for network security groups](/azure/well-architected/security/networking#network-security-groups#network-security-groups) to help ensure your configuration matches best practices for security.
+
 ### Associate the subnet with the network security group
 
 1. Go to your network security group, and select **Subnets**.
diff --git a/articles/communications-gateway/whats-new.md b/articles/communications-gateway/whats-new.md
@@ -16,7 +16,7 @@ This article covers new features and improvements for Azure Communications Gatew
 
 ### VNet injection for Azure Communications Gateway (preview)
 
-From April 2024, you can set up private networking between your on-premises environment and Azure Communications Gateway. VNet injection for Azure Communications Gateway (preview) allows the network interfaces on your Azure Communications Gateway which connect to your network to be deployed into virtual networks in your subscription. This allows you to control the traffic flowing between your network and your Azure Communications Gateway instance using private subnets, and lets you use private connectivity to your premises such as ExpressRoute Private Peering and virtual private networks.
+From April 2024, you can set up private networking between your on-premises environment and Azure Communications Gateway. VNet injection for Azure Communications Gateway (preview) allows the network interfaces on your Azure Communications Gateway which connect to your network to be deployed into virtual networks in your subscription. This allows you to control the traffic flowing between your network and your Azure Communications Gateway instance using private subnets, and lets you use private connectivity to your premises such as ExpressRoute Private Peering and Virtual Private Networks (VPNs).
 
 For more information about private networking, see [Connecting to Azure Communications Gateway](./connectivity.md). For deployment instructions, see [Prepare to connect Azure Communications Gateway to your own virtual network](./prepare-for-vnet-injection.md).
 
