Quartz 5

subnet

Properties2
tagsnetworking, subnet, vnet
aliasessubnets, subnetting

3 min read

Subnet

What it is

A subnet is a smaller, continuous slice of a Virtual Network’s private address range. Resources in that slice can receive private IP addresses, and the subnet can carry shared routing and network-security settings. It is an address-and-traffic boundary, not a physical room or an automatic security wall.

Why it exists

Segmenting a large address space into subnets lets you organize, isolate, and control traffic: place web, app, and DB tiers in separate subnets, apply different NSGs/routes to each, and reserve ranges for specific service types.

Key ideas

  • A subnet range must sit inside the VNet’s address range and cannot overlap another subnet. Azure reserves five IP addresses in each subnet, so a range has fewer usable addresses than its size suggests.
  • Associate an NSG to filter traffic for the subnet and a route table to control paths. These settings apply to traffic, not to a business department or application name.
  • Some Azure services require a dedicated subnet with a required name or size. Do not place unrelated workloads there without checking that service’s documentation.
  • Delegation lets a supported Azure service manage a subnet for that service. A private endpoint uses a private IP from a subnet but is a separate network interface and should be designed with DNS.

Northwind example

Northwind splits 10.20.0.0/16 into 10.20.1.0/24 for front ends, 10.20.2.0/24 for application components, and 10.20.3.0/24 for private endpoints. The application subnet receives an NSG rule that accepts only the front end’s required traffic. That rule does not make the subnet a database or application by itself; it simply limits network flows to the resources placed there.

Common confusion

  • A subnet is not an Azure subscription and is not a billing boundary.
  • An NSG filters traffic; it does not create a subnet or select a traffic route.
  • Sizing a subnet too tightly can prevent future scale-out or private endpoints. Reserve room before production deployment.

How it fits

VNet address space 10.0.0.0/16 is divided:

10.0.0.0/16  VNet
├── 10.0.0.0/24  snet-frontend    [VM][LB][NSG]
├── 10.0.1.0/24  snet-app         [VM][ASG]
├── 10.0.2.0/24  snet-data        [DB]
├── 10.0.3.0/24  GatewaySubnet    [VPN Gateway]
└── 10.0.4.0/24  AzureFirewallSubnet [Firewall]

Practical limits and failure modes

  • Azure reserves the first four and last address of every subnet. Use the current service limits and subnet documentation for exact sizing.
  • Existing resources can constrain an address-range change. Plan a migration rather than assuming a subnet can be resized in place.
  • Use meaningful but non-sensitive names. Names help humans; rules, routes, and service configuration enforce behavior.

vnet · cidr-ip-addressing · nsg · route-table · vnet-peering · private-endpoint · northwind-traders-case-study

📘 Source: Microsoft Learn — Add, change, or delete a virtual network subnet, checked 2026-09-16.

Graph View

Backlinks