Network Diagram of the VCE in Azure
A network diagram will be helpful for understanding how the VCE deployment looks like.

Network Security Groups
On both WAN side (GE1) and LAN side (GE2), a network security group is required. The purpose of this article is not about how the security groups should be configured. Sample security groups are being show here, administrator should adjust them to fit their own requirements.
The following is the sample WAN side Network Security Group with name “VELO_vVCE_SG”:

The following is the sample LAN side Network Security Group with name “VELO_vVCE_LAN_SG”:

Deploy Velocloud virtual Edge in Azure (the manual way)