cidr-ip-addressing

IP Addressing & CIDR

What it is

Classless Inter-Domain Routing (CIDR) is the shorthand Azure uses for IP ranges, such as 10.0.0.0/24. An address plan uses those ranges to divide a virtual network into subnets and give resources private addresses. A resource gets a public IP only when a supported design assigns one.

Why it exists

You need a way to say both “which neighborhood?” and “how many addresses?” CIDR combines those facts in one short label so Azure can check that subnets fit inside their VNet and that connected networks do not overlap.

Key ideas

• The / number: it is the number of network bits. A /24 leaves 8 host bits, so it contains 2^8 = 256 IPv4 addresses. A smaller suffix, such as /16, describes a larger range.
• Private ranges: common choices are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. Azure also recognizes the shared 100.64.0.0/10 space, but it can be unsuitable for some connected networks. Plan against existing corporate and partner ranges.
• Azure reservations: Azure reserves the first four and last address in every subnet. Thus a /24 has 251 addresses available for use. The smallest supported IPv4 subnet is /29; IPv6 subnets must be /64.
• Private versus public: a private address works inside the network path; a public IP is a separate Azure resource used by a supported component for internet-routable addressing. Neither address type grants permission by itself.
• Dynamic versus static private IP: for Resource Manager resources, both remain assigned until the resource is deleted; “static” lets you choose an available address, while “dynamic” lets Azure choose it.

Northwind example

Northwind reserves 10.20.0.0/16 for its ordering VNet. It gives the web tier 10.20.1.0/24, the application tier 10.20.2.0/24, and leaves room for growth. Before linking a warehouse network, Maya checks that it does not already use 10.20.0.0/16; overlapping ranges make routing ambiguous and prevent VNet peering.

Quick calculation

For IPv4, a CIDR range contains 2^(32 − prefix length) addresses. Azure then reserves five addresses per subnet. For example, /27 contains 32 addresses and has 27 addresses available. This is a sizing aid, not a reason to use the smallest possible range—some Azure services have their own subnet-size requirements.

How it fits

Exam notes

• Always confirm no overlap between VNet ranges and peered VNets / ExpressRoute/corporate ranges — overlap breaks peering and routing.
• Use the smallest subnet that fits to conserve address space (exam likes subnet sizing questions, e.g. how many /24s fit in a /16 → 256).
• Do not plan a VNet with ranges that overlap other VNets, on-premises networks, or partner networks it must reach.
• A route and an NSG still control how an address is reached and whether a flow is allowed.

Related

Home · subnet · vnet · azure-dns · network-watcher

📘 Source: Microsoft Learn — Azure Virtual Network FAQ