Virtual Networks and Subnets

Azure Basics · Virtual Networking – VNets, IPs, NSGs, Firewall and DNS · Lesson 1 of 5

A VNet is your private network in Azure with one address space; subnets split the VNet, must not overlap, and Azure reserves 5 addresses in each.

A Virtual Network (VNet) is your private, logically isolated network in one region: for cloud-only networks, for extending your datacenter (VPN, ExpressRoute) or for hybrid setups. Creating a VNet needs an address space (CIDR, such as 10.10.0.0/16) and at least one subnet.

flowchart TB
  subgraph V["vnet-lab 10.10.0.0/16 (southeastasia)"]
    S1["snet-web 10.10.1.0/24<br/>vm-web-01"]
    S2["snet-app 10.10.2.0/24<br/>vm-app-01"]
  end
  OP["On-prem 192.168.0.0/16"] -- "VPN (no overlap)" --> V
  %% step S1: Each subnet takes its own slice of the VNet range: snet-web gets 10.10.1.0/24 for the web VM.
  %% step S2: snet-app gets 10.10.2.0/24. Subnet ranges inside one VNet can never overlap.
  %% step: Azure keeps 5 addresses in every subnet, so a /24 gives 251 usable IPs.
  %% step OP: On-prem uses 192.168.0.0/16, which does not overlap 10.10.0.0/16, so a VPN can join both networks.

Subnets split a VNet into logical zones with their own NSGs and route tables, separating web/app/data tiers.
A subnet range must sit inside the address space and must not overlap other subnets.
Azure reserves 5 addresses per subnet (network address, gateway .1, two DNS addresses .2 and .3, broadcast), so a /24 leaves 251 usable IPs.
The address spaces of VNets and on-premises networks must not overlap if you want peering or VPN.

Command	Meaning
`az network vnet create -g rg-devops-lab -n vnet-lab --address-prefixes 10.10.0.0/16 --subnet-name snet-web --subnet-prefixes 10.10.1.0/24`	VNet + first subnet
`az network vnet subnet create -g rg-devops-lab --vnet-name vnet-lab -n snet-app --address-prefixes 10.10.2.0/24`	Add a subnet
`az network vnet list -o table`	List VNets

Connecting VNets

Option	What it does
VNet peering	Links two VNets over Microsoft's backbone; works across regions (global peering) and subscriptions
VPN Gateway	Encrypted tunnel over the internet to an office (site-to-site) or a laptop (point-to-site)
ExpressRoute	Private, dedicated circuit to a Microsoft edge through a provider, with predictable bandwidth

Peering is not transitive: if A peers with B and B with C, A cannot reach C unless you peer A and C or route through a hub with a firewall or gateway. A VNet always stays in one region; to span regions you create a VNet per region and peer them.

Special subnets

Several services require a subnet with an exact name:

Subnet name	Used by
`GatewaySubnet`	VPN and ExpressRoute gateways
`AzureBastionSubnet`	Azure Bastion
`AzureFirewallSubnet`	Azure Firewall

Some PaaS services use subnet delegation instead, which reserves a subnet for that service (for example App Service VNet integration or Azure Container Instances), so other resources cannot be placed there.

Design habits

Plan address space once for all environments and keep a record of which range belongs to whom.
Split subnets by tier and security boundary rather than by team, because NSGs and route tables attach per subnet.
Use a hub-spoke layout so shared services (firewall, Bastion, DNS resolver) live once in the hub.
Name consistently, for example vnet-<app>-<env>-<region> and snet-<tier>.

Viewing what you built

az network vnet show -g rg-devops-lab -n vnet-lab --query subnets[].addressPrefix lists subnet ranges, and az network vnet peering list -g rg-devops-lab --vnet-name vnet-lab -o table shows peering state, which must be Connected on both sides.