Subnets within a VNet in Azure - Deep Dive

Overview - Subnets within a VNet

What is it?

A Virtual Network (VNet) in Azure is like a private neighborhood for your cloud resources. Within this neighborhood, subnets are smaller sections or blocks that divide the space into manageable parts. Each subnet holds a group of resources that can communicate easily with each other. This helps organize and secure your cloud environment by controlling traffic and access.

Why it matters

Without subnets, all resources in a VNet would be in one big open space, making it hard to control who talks to whom and increasing security risks. Subnets let you separate resources by function or security level, making your cloud setup safer and easier to manage. This separation also helps with performance and scaling, as traffic can be controlled and routed efficiently.

Where it fits

Before learning about subnets, you should understand what a VNet is and how cloud networking basics work. After mastering subnets, you can explore network security groups, routing, and advanced network architectures like peering and VPN gateways.

Mental Model

Core Idea

Subnets are like rooms within a house (VNet) that organize and control how devices inside communicate and connect to the outside world.

Think of it like...

Imagine a large office building (the VNet) divided into different rooms (subnets). Each room hosts a team working on a specific task. Doors between rooms can be locked or open to control who can enter or leave, just like subnets control network traffic.

Virtual Network (VNet)
┌─────────────────────────────┐
│                             │
│  ┌─────────────┐  ┌─────────┐│
│  │ Subnet A    │  │ Subnet B││
│  │ (Team Room) │  │ (Lab)   ││
│  └─────────────┘  └─────────┘│
│                             │
└─────────────────────────────┘

Build-Up - 7 Steps

1

Foundation

Understanding Virtual Networks (VNets)

Concept: Learn what a VNet is and why it acts as a private network in the cloud.

A Virtual Network (VNet) is a private space in Azure where you can place your cloud resources like virtual machines and databases. It isolates your resources from others and lets them communicate securely. Think of it as your own private internet inside Azure.

Result

You understand that a VNet is the basic container for cloud networking in Azure.

Knowing what a VNet is sets the stage for understanding how subnets organize and secure resources inside it.

2

Foundation

What is a Subnet in a VNet?

Concept: Introduce subnets as subdivisions of a VNet that group resources and control traffic.

A subnet is a smaller network inside a VNet. It divides the VNet's address space into chunks. Each subnet holds resources that share similar roles or security needs. This helps manage traffic and apply rules easily.

Result

You see subnets as building blocks inside a VNet that organize resources.

Understanding subnets as parts of a VNet helps you grasp how network traffic and security are managed.

3

Intermediate

Subnet Address Ranges and IP Allocation

🤔Before reading on: do you think subnets can overlap in IP addresses within the same VNet? Commit to yes or no.

Concept: Learn how subnets use non-overlapping IP address ranges to avoid conflicts.

Each subnet gets a unique range of IP addresses from the VNet's overall address space. These ranges cannot overlap to prevent confusion about where data should go. For example, if your VNet uses 10.0.0.0/16, one subnet might be 10.0.1.0/24 and another 10.0.2.0/24.

Result

You understand that subnets must have distinct IP ranges to keep network traffic clear and organized.

Knowing about IP ranges prevents mistakes that cause network conflicts and communication failures.

4

Intermediate

Subnet Security and Network Isolation

🤔Before reading on: do you think all resources in different subnets can communicate freely by default? Commit to yes or no.

Concept: Explore how subnets help control traffic flow and security between resource groups.

By default, resources in different subnets within the same VNet can talk to each other. But you can add Network Security Groups (NSGs) to subnets to control who can send or receive data. This lets you isolate sensitive parts of your network, like databases, from others.

Result

You see how subnets combined with security rules create safe zones inside your cloud network.

Understanding subnet isolation is key to building secure and well-organized cloud environments.

5

Intermediate

Subnet Delegation and Service Integration

Concept: Learn how subnets can be delegated to specific Azure services for better integration.

Some Azure services, like Azure Kubernetes Service or Azure SQL, require subnets to be delegated to them. Delegation means the subnet is reserved for that service, allowing it to manage network settings automatically. This helps services work smoothly and securely.

Result

You know how to prepare subnets for special Azure services by delegation.

Recognizing subnet delegation helps you design networks that support advanced Azure services without manual configuration.

6

Advanced

Subnet Sizing and IP Address Planning

🤔Before reading on: do you think making subnets too large or too small has no impact? Commit to yes or no.

Concept: Understand how to choose subnet sizes to balance resource needs and efficient IP use.

Choosing the right subnet size means picking an IP range big enough for current and future resources but not wasteful. Too small, and you run out of addresses; too large, and you lose address space for other subnets. Azure reserves some IPs in each subnet, so plan accordingly.

Result

You can design subnet sizes that fit your workload and avoid IP shortages or waste.

Good IP planning prevents costly network redesigns and downtime as your cloud grows.

7

Expert

Advanced Subnet Routing and Peering Effects

🤔Before reading on: do you think subnet traffic always stays inside the VNet without routing? Commit to yes or no.

Concept: Explore how routing tables and VNet peering affect subnet traffic flow and security.

Subnets can have custom route tables that send traffic to specific destinations like firewalls or on-premises networks. When VNets are peered, subnets in different VNets can communicate as if in one network, but routing and security rules still apply. This allows complex, secure network designs.

Result

You understand how subnet traffic can be controlled and extended beyond a single VNet.

Knowing routing and peering effects on subnets unlocks powerful, scalable network architectures.

Under the Hood

Azure VNets are built on software-defined networking that creates isolated virtual networks. Subnets are defined by dividing the VNet's IP address space into smaller blocks. Azure assigns IP addresses to resources from these blocks and uses routing tables and security groups to control traffic. The platform manages address allocation, routing, and isolation dynamically to ensure resources communicate securely and efficiently.

Why designed this way?

Subnets were designed to provide logical separation within a VNet to improve security, organization, and traffic management. Early cloud networks were flat and hard to secure. Dividing networks into subnets allows fine-grained control and scalability. Azure's approach balances flexibility with ease of use, avoiding complex manual network setups.

Azure VNet
┌─────────────────────────────┐
│ VNet IP Range: 10.0.0.0/16 │
│                             │
│  ┌─────────────┐  ┌─────────┐│
│  │ Subnet A    │  │ Subnet B││
│  │ 10.0.1.0/24 │  │ 10.0.2.0/24││
│  └─────┬───────┘  └─────┬───┘│
│        │               │     │
│  ┌─────▼───────┐  ┌────▼───┐│
│  │ VM1         │  │ VM2    ││
│  └─────────────┘  └─────────┘│
│                             │
└─────────────────────────────┘

Myth Busters - 4 Common Misconceptions

Quick: Do subnets in the same VNet block all communication between each other by default? Commit to yes or no.

Common Belief: Subnets automatically block traffic between each other unless explicitly allowed.

Reality: By default, subnets within the same VNet can communicate freely without extra configuration.

Why it matters: Assuming subnets block traffic can lead to unnecessary troubleshooting and misconfigured security rules.

Quick: Can two subnets in the same VNet have overlapping IP address ranges? Commit to yes or no.

Common Belief: Subnets can share overlapping IP ranges as long as they are in the same VNet.

Reality: Subnets must have unique, non-overlapping IP address ranges within a VNet to avoid conflicts.

Why it matters: Overlapping IP ranges cause routing confusion and communication failures between resources.

Quick: Does subnet delegation mean the subnet is locked and cannot be used for other resources? Commit to yes or no.

Common Belief: Delegated subnets are locked and cannot host any resources except the delegated service.

Reality: Delegation allows specific Azure services to manage the subnet but does not necessarily lock it from all other uses, depending on the service.

Why it matters: Misunderstanding delegation can lead to over-restricting subnet use or misconfiguring services.

Quick: Is it safe to make subnets as large as possible to avoid running out of IPs? Commit to yes or no.

Common Belief: Making subnets very large is always better to avoid IP shortages.

Reality: Oversized subnets waste IP address space and reduce flexibility for other subnets and networks.

Why it matters: Poor subnet sizing can cause inefficient IP use and complicate future network growth.

Expert Zone

1

Azure reserves the first four and the last IP addresses in each subnet for protocol use, reducing usable IPs by 5 per subnet.

2

Subnet delegation can trigger automatic network policy enforcement by Azure services, which may override manual settings.

3

Custom route tables attached to subnets can redirect traffic to virtual appliances, enabling advanced security and monitoring setups.

When NOT to use

Avoid using very small subnets for workloads that may scale quickly; instead, plan larger subnets or use dynamic IP allocation methods. For isolated workloads requiring strict security, consider using separate VNets with peering instead of relying solely on subnets.

Production Patterns

In production, teams often create subnets by function (e.g., web, app, database) with tailored NSGs for each. Delegated subnets are used for managed services like AKS. Custom routes direct traffic through firewalls or monitoring appliances. IP address planning is done upfront to accommodate growth and avoid reconfiguration.

Connections

Network Security Groups (NSGs)

Builds-on

Understanding subnets is essential before applying NSGs, which control traffic at the subnet level for security.

IP Addressing and CIDR Notation

Builds-on

Knowing how IP ranges and CIDR work helps in designing subnet address spaces correctly.

Urban Planning

Analogy

Just like city planners divide land into zones and neighborhoods to organize and control development, subnetting organizes cloud networks for better management and security.

Common Pitfalls

#1 Creating overlapping IP ranges for subnets within the same VNet.

Wrong approach:

Subnet A: 10.0.1.0/24
Subnet B: 10.0.1.128/25

Correct approach:

Subnet A: 10.0.1.0/25
Subnet B: 10.0.1.128/25

Root cause:

Misunderstanding how IP ranges must be unique and non-overlapping within a VNet.

#2 Assuming subnets block traffic by default and not configuring NSGs.

Wrong approach:

No NSGs applied, expecting subnets to isolate traffic automatically.

Correct approach:

Apply NSGs to subnets to explicitly control traffic between them.

Root cause:

Confusing default VNet behavior with security controls leads to false security assumptions.

#3 Assigning too small a subnet range that runs out of IP addresses quickly.

Wrong approach:

Subnet: 10.0.1.0/29 (only 3 usable IPs)

Correct approach:

Subnet: 10.0.1.0/24 (up to 251 usable IPs)

Root cause:

Underestimating the number of resources and reserved IPs needed in a subnet.

Key Takeaways

Subnets divide a Virtual Network into smaller, manageable sections that organize and secure cloud resources.

Each subnet must have a unique, non-overlapping IP address range within the VNet to avoid network conflicts.

By default, subnets within the same VNet can communicate freely, but security groups can control this traffic.

Proper subnet sizing and planning are crucial to avoid IP shortages and inefficient address use.

Advanced subnet features like delegation and custom routing enable integration with Azure services and complex network designs.