Subnets within a VNet in Azure - Commands & Configuration

Introduction

When you create a virtual network in Azure, you divide it into smaller parts called subnets. Subnets help organize and secure your network by grouping resources together and controlling traffic between them.

When you want to separate your web servers from your database servers within the same network.

When you need to apply different security rules to different groups of resources.

When you want to control traffic flow between parts of your application.

When you want to allocate IP address ranges efficiently inside your virtual network.

When you want to connect your network to other networks or services securely.

Config File - main.tf

main.tf

provider "azurerm" {
  features {}
}

resource "azurerm_resource_group" "example" {
  name     = "example-resources"
  location = "eastus"
}

resource "azurerm_virtual_network" "example_vnet" {
  name                = "example-vnet"
  address_space       = ["10.0.0.0/16"]
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
}

resource "azurerm_subnet" "subnet1" {
  name                 = "subnet-frontend"
  virtual_network_name = azurerm_virtual_network.example_vnet.name
  resource_group_name  = azurerm_resource_group.example.name
  address_prefixes     = ["10.0.1.0/24"]
}

resource "azurerm_subnet" "subnet2" {
  name                 = "subnet-backend"
  virtual_network_name = azurerm_virtual_network.example_vnet.name
  resource_group_name  = azurerm_resource_group.example.name
  address_prefixes     = ["10.0.2.0/24"]
}

This Terraform file creates an Azure resource group, a virtual network with a 10.0.0.0/16 address space, and two subnets inside it.

The azurerm_virtual_network resource defines the main network.

The azurerm_subnet resources define two smaller networks inside the main one, each with its own IP range.

Commands

This command sets up Terraform in the current folder, downloading the Azure provider so you can create resources.

Terminal

terraform init

Expected Output

Initializing the backend...



Initializing provider plugins...

- Finding latest version of hashicorp/azurerm...

- Installing hashicorp/azurerm v3.64.0...

- Installed hashicorp/azurerm v3.64.0 (signed by HashiCorp)



Terraform has been successfully initialized!

This command shows what Terraform will create in Azure without making any changes yet. It helps you check your setup.

Terminal

terraform plan

Expected Output

An execution plan has been generated and is shown below.

Resource actions are indicated with the following symbols:

  + create



Terraform will perform the following actions:



  # azurerm_resource_group.example will be created

  + resource "azurerm_resource_group" "example" {

      + location = "eastus"

      + name     = "example-resources"

    }



  # azurerm_virtual_network.example_vnet will be created

  + resource "azurerm_virtual_network" "example_vnet" {

      + address_space       = ["10.0.0.0/16"]

      + location            = "eastus"

      + name                = "example-vnet"

      + resource_group_name = "example-resources"

    }



  # azurerm_subnet.subnet1 will be created

  + resource "azurerm_subnet" "subnet1" {

      + address_prefixes     = ["10.0.1.0/24"]

      + name                 = "subnet-frontend"

      + resource_group_name  = "example-resources"

      + virtual_network_name = "example-vnet"

    }



  # azurerm_subnet.subnet2 will be created

  + resource "azurerm_subnet" "subnet2" {

      + address_prefixes     = ["10.0.2.0/24"]

      + name                 = "subnet-backend"

      + resource_group_name  = "example-resources"

      + virtual_network_name = "example-vnet"

    }



Plan: 4 to add, 0 to change, 0 to destroy.

This command creates the resource group, virtual network, and subnets in Azure as defined in the configuration file.

Terminal

terraform apply -auto-approve

Expected Output

azurerm_resource_group.example: Creating...

azurerm_resource_group.example: Creation complete after 2s [id=/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/example-resources]

azurerm_virtual_network.example_vnet: Creating...

azurerm_virtual_network.example_vnet: Creation complete after 3s [id=/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/example-resources/providers/Microsoft.Network/virtualNetworks/example-vnet]

azurerm_subnet.subnet1: Creating...

azurerm_subnet.subnet1: Creation complete after 2s [id=/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/example-resources/providers/Microsoft.Network/virtualNetworks/example-vnet/subnets/subnet-frontend]

azurerm_subnet.subnet2: Creating...

azurerm_subnet.subnet2: Creation complete after 2s [id=/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/example-resources/providers/Microsoft.Network/virtualNetworks/example-vnet/subnets/subnet-backend]



Apply complete! Resources: 4 added, 0 changed, 0 destroyed.

→

-auto-approve - Skips manual approval to apply changes immediately

This Azure CLI command lists all subnets inside the virtual network to verify they were created correctly.

Terminal

az network vnet subnet list --resource-group example-resources --vnet-name example-vnet --output table

Expected Output

Name             AddressPrefix

---------------  --------------

subnet-frontend  10.0.1.0/24

subnet-backend   10.0.2.0/24

→

--output table - Formats output as a readable table

Key Concept

If you remember nothing else from this pattern, remember: subnets divide a virtual network into smaller parts to organize and control your cloud resources.

Common Mistakes

Using overlapping IP address ranges for subnets inside the same virtual network

Overlapping IP ranges cause routing conflicts and prevent resources from communicating properly.

Assign unique, non-overlapping IP address ranges to each subnet within the virtual network.

Not specifying the resource group or virtual network name correctly in subnet definitions

Terraform or Azure CLI cannot find the parent network, causing deployment failures.

Always reference the correct resource group and virtual network names exactly as created.

Trying to create subnets before the virtual network exists

Subnets depend on the virtual network; creating them first causes errors.

Create the virtual network first, then create subnets inside it.

Summary

Create a virtual network with a large IP address range to hold your subnets.

Define subnets with smaller, unique IP ranges inside the virtual network.

Use Terraform commands to initialize, plan, and apply your network configuration.

Verify subnet creation using Azure CLI to list subnets in the virtual network.

Practice

1. What is the main purpose of creating subnets within a Virtual Network (VNet) in Azure?

easy

A. To create virtual machines directly inside the VNet

B. To divide the VNet into smaller IP address ranges for better organization and security

C. To connect different VNets together automatically

D. To increase the total IP address space of the VNet

Solution

1. Step 1: Understand the role of subnets in a VNet

   Subnets split a VNet into smaller parts, each with its own IP range.

2. Step 2: Identify the purpose of subnetting

   Subnetting helps organize resources and apply security rules within the VNet.

3. Final Answer:

   To divide the VNet into smaller IP address ranges for better organization and security -> Option B

4. Quick Check:

   Subnet purpose = divide and organize IP ranges [OK]

Hint: Subnets split IP space inside a VNet for organization [OK]

Common Mistakes:

• Thinking subnets increase total IP space
• Confusing subnets with VNet peering
• Believing subnets create VMs automatically

2. Which of the following is the correct way to define a subnet within an Azure VNet using CIDR notation?

easy

A. 10.0.1.0/24

B. 10.0.0.256/24

C. 10.0.0.0/16

D. 10.0.0.0/33

Solution

1. Step 1: Review valid CIDR notation for subnets

   CIDR notation uses an IP address and a prefix length between 0 and 32 for IPv4.

2. Step 2: Check each option for validity

   10.0.0.0/16 is a VNet range, not a subnet. 10.0.1.0/24 is a valid subnet inside 10.0.0.0/16. 10.0.0.256/24 has an invalid IP (256 is out of range). 10.0.0.0/33 has an invalid prefix length (33 is too large).

3. Final Answer:

   10.0.1.0/24 -> Option A

4. Quick Check:

   Valid subnet CIDR = 10.0.1.0/24 [OK]

Hint: Subnet CIDR must have valid IP and prefix ≤ 32 [OK]

Common Mistakes:

• Using IP octets above 255
• Using prefix length greater than 32
• Confusing VNet and subnet CIDR sizes

3. Given a VNet with address space 192.168.0.0/16, which subnet CIDR block is valid and fits inside this VNet?

medium

A. 192.168.1.0/24

B. 192.169.0.0/24

C. 192.168.0.0/15

D. 10.0.0.0/24

Solution

1. Step 1: Understand the VNet address space

   The VNet covers IPs from 192.168.0.0 to 192.168.255.255 (a /16 block).

2. Step 2: Check which subnet fits inside the VNet

   192.168.1.0/24 (192.168.1.0/24) fits inside the VNet range. 192.169.0.0/24 is outside the 192.168.x.x range. 192.168.0.0/15 has a /15 prefix which is larger than the VNet's /16, so it extends outside. 10.0.0.0/24 is a different private IP range.

3. Final Answer:

   192.168.1.0/24 -> Option A

4. Quick Check:

   Subnet inside VNet range = 192.168.1.0/24 [OK]

Hint: Subnet must be fully inside VNet IP range [OK]

Common Mistakes:

• Choosing subnet outside VNet range
• Using larger prefix than VNet
• Confusing private IP ranges

4. You tried to create a subnet with CIDR 10.1.0.0/16 inside a VNet with address space 10.0.0.0/24. What is the problem?

medium

A. The subnet CIDR is invalid because it uses a private IP range

B. The subnet CIDR is too small for a subnet

C. The subnet CIDR overlaps with another subnet

D. The subnet CIDR is larger than the VNet address space and does not fit inside

Solution

1. Step 1: Compare subnet and VNet address spaces

   The VNet covers 10.0.0.0 to 10.0.0.255 (/24). The subnet 10.1.0.0/16 covers 10.1.0.0 to 10.1.255.255, which is outside the VNet range.

2. Step 2: Identify the error

   The subnet CIDR must be fully inside the VNet's address space. Here, it is larger and outside the VNet.

3. Final Answer:

   The subnet CIDR is larger than the VNet address space and does not fit inside -> Option D

4. Quick Check:

   Subnet must fit inside VNet range [OK]

Hint: Subnet CIDR must be inside VNet CIDR, not bigger [OK]

Common Mistakes:

• Ignoring subnet size vs VNet size
• Thinking private IP ranges are invalid
• Assuming overlap without checking

5. You have a VNet with address space 172.16.0.0/16. You want to create three subnets: 172.16.0.0/18, 172.16.64.0/18, and 172.16.128.0/17. Which statement is true about these subnets?

hard

A. The second subnet is outside the VNet address space

B. The third subnet overlaps with the first two subnets

C. All three subnets fit inside the VNet without overlapping

D. The subnet sizes are invalid for this VNet

Solution

1. Step 1: Analyze the VNet and subnet ranges

   The VNet covers 172.16.0.0 to 172.16.255.255 (/16). The first subnet covers 172.16.0.0 to 172.16.63.255 (/18). The second covers 172.16.64.0 to 172.16.127.255 (/18). The third covers 172.16.128.0 to 172.16.255.255 (/17).

2. Step 2: Check for overlaps

   The subnets cover distinct ranges: first 172.16.0.0-172.16.63.255, second 172.16.64.0-172.16.127.255, third 172.16.128.0-172.16.255.255. No overlaps, all fit within the VNet.

3. Final Answer:

   All three subnets fit inside the VNet without overlapping -> Option C

4. Quick Check:

   All three subnets fit without overlapping [OK]

Hint: Check subnet ranges carefully for overlaps [OK]

Common Mistakes:

• Miscalculating subnet ranges and thinking they overlap
• Confusing prefix lengths and their sizes
• Ignoring subnet boundaries