Azure Learning

subnet

Properties2
tagsnetworking, subnet, vnet
aliasessubnets, subnetting

2 min read

Subnet

What it is

A subnet is a contiguous segment of a Virtual Network’s address space. It is a CERN-scoped boundary (from CIDR-block subdivision) within which resources get their private IPs and to which security and routing rules are attached.

Why it exists

Segmenting a large address space into subnets lets you organize, isolate, and control traffic: place web, app, and DB tiers in separate subnets, apply different NSGs/routes to each, and reserve ranges for specific service types.

Key ideas

  • Each subnet has exactly one address range that must fall entirely within the parent VNet’s range and not overlap other subnets (Azure reserves the first 4 and last 1 addresses of each subnet).
  • Delegation — a subnet can be delegated to a service (e.g. App Service, Azure SQL Managed Instance, AKS virtual nodes) that then manages it.
  • Service endpoints and private endpoints each attach at the subnet level.
  • Some subnets are service-specific (a “gateway subnet” must be exactly GatewaySubnet for gateways; AzureFirewallSubnet, AzureBastionSubnet).
  • Allowed services/hosting: subnets can host VMs (each NIC gets one private IP), ILBs, firewalls, bastions.

How it fits

VNet address space 10.0.0.0/16 is divided:

10.0.0.0/16  VNet
├── 10.0.0.0/24  snet-frontend    [VM][LB][NSG]
├── 10.0.1.0/24  snet-app         [VM][ASG]
├── 10.0.2.0/24  snet-data        [DB]
├── 10.0.3.0/24  GatewaySubnet    [VPN Gateway]
└── 10.0.4.0/24  AzureFirewallSubnet [Firewall]

Exam notes

  • Reserved addresses: Azure always reserves the first 4 IPs (network, default gateway x.x.x.1, DNS x.x.x.2, future, broadcast) and the last IP of each subnet — usable range is 2^(host bits)-5.
  • Subnet ranges cannot overlap within a VNet; contiguous or not, they must be distinct.
  • One NIC = one private IP per subnet; a NIC can only belong to one subnet.
  • Up to 1000 VMs per subnet (default limit), and a subnet can be in at most one VNet.
  • You can’t change a subnet’s address range if it contains resources.

Home · vnet · cidr-ip-addressing · nsg · route-table · vnet-peering

📘 Source: Microsoft Learn — Subnet

Graph View

Backlinks