Subnets within a VNet in Azure - Step-by-Step Execution

Process Flow - Subnets within a VNet

Create Virtual Network (VNet)

↓

Define Address Space for VNet

↓

Create Subnet 1 with CIDR

↓

Create Subnet 2 with CIDR

↓

Assign Subnets to VNet

↓

VNet with multiple subnets ready for resources

This flow shows how a virtual network is created first, then divided into smaller subnetworks (subnets) with their own address ranges inside the VNet.

Execution Sample

Azure

resource "azurerm_virtual_network" "example" {
  name                = "example-vnet"
  address_space       = ["10.0.0.0/16"]
  location            = "eastus"
  resource_group_name = "example-rg"
}

resource "azurerm_subnet" "subnet1" {
  name                 = "subnet1"
  resource_group_name  = "example-rg"
  virtual_network_name = azurerm_virtual_network.example.name
  address_prefixes     = ["10.0.1.0/24"]
}

resource "azurerm_subnet" "subnet2" {
  name                 = "subnet2"
  resource_group_name  = "example-rg"
  virtual_network_name = azurerm_virtual_network.example.name
  address_prefixes     = ["10.0.2.0/24"]
}

This code creates a virtual network with a large address space, then creates two subnets inside it with smaller address ranges.

Process Table

Step	Action	Resource Created	Address Space	Subnet CIDR	Result
1	Create VNet	Virtual Network	10.0.0.0/16	N/A	VNet created with large address space
2	Create Subnet 1	Subnet	10.0.0.0/16	10.0.1.0/24	Subnet1 created inside VNet
3	Create Subnet 2	Subnet	10.0.0.0/16	10.0.2.0/24	Subnet2 created inside VNet
4	Assign Subnets	VNet with Subnets	10.0.0.0/16	10.0.1.0/24, 10.0.2.0/24	VNet now contains two subnets
5	End	N/A	N/A	N/A	Setup complete, ready for resource deployment

💡 All subnets created within the VNet address space, no overlaps, deployment ready

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	Final
VNet Address Space	None	10.0.0.0/16	10.0.0.0/16	10.0.0.0/16	10.0.0.0/16
Subnet1 CIDR	None	None	10.0.1.0/24	10.0.1.0/24	10.0.1.0/24
Subnet2 CIDR	None	None	None	10.0.2.0/24	10.0.2.0/24
Subnets Assigned	None	None	Subnet1	Subnet1, Subnet2	Subnet1, Subnet2

Key Moments - 3 Insights

Why must subnet CIDRs be within the VNet address space?

Subnet CIDRs must fit inside the VNet address space to avoid IP conflicts and ensure all subnets belong to the same network, as shown in execution_table steps 1 to 4.

Can subnets overlap each other’s address ranges?

No, subnets cannot overlap. Each subnet must have a unique, non-overlapping CIDR block inside the VNet, as seen in steps 2 and 3 where subnets have distinct ranges.

What happens if you try to create a subnet outside the VNet address space?

The deployment will fail because Azure requires subnets to be inside the VNet’s address space, which is why step 4 confirms subnets are assigned only if they fit inside the VNet.

Visual Quiz - 3 Questions

Look at the execution_table at step 3, what is the CIDR of Subnet2?

A 10.0.2.0/24

B 10.0.1.0/24

C 10.0.0.0/16

D 192.168.1.0/24

💡 Hint

Check the 'Subnet CIDR' column at step 3 in the execution_table.

At which step are both subnets assigned to the VNet?

A Step 2

B Step 3

C Step 4

D Step 5

💡 Hint

Look at the 'Subnets Assigned' variable in variable_tracker after each step.

If Subnet1 CIDR was changed to 10.0.2.0/24, what would happen?

A VNet address space would automatically expand

B Subnet1 and Subnet2 would overlap causing deployment failure

C Subnet1 would be created successfully with no issues

D Subnet2 would be deleted automatically

💡 Hint

Refer to key_moments about overlapping subnets and execution_table steps 2 and 3.

Concept Snapshot

Subnets within a VNet:
- Create a VNet with a large address space (e.g., 10.0.0.0/16)
- Define subnets with smaller CIDR blocks inside the VNet range
- Subnets must not overlap each other
- Assign subnets to the VNet before deploying resources
- Ensures organized IP allocation and network segmentation

Full Transcript

This lesson shows how to create a virtual network (VNet) in Azure and divide it into smaller parts called subnets. First, you create the VNet with a big address space like 10.0.0.0/16. Then you create subnets inside it with smaller address ranges like 10.0.1.0/24 and 10.0.2.0/24. Each subnet must fit inside the VNet's address space and cannot overlap with others. After creating subnets, they are assigned to the VNet. This setup allows you to organize your network and assign IP addresses properly for your cloud resources.

Practice

1. What is the main purpose of creating subnets within a Virtual Network (VNet) in Azure?

easy

A. To create virtual machines directly inside the VNet

B. To divide the VNet into smaller IP address ranges for better organization and security

C. To connect different VNets together automatically

D. To increase the total IP address space of the VNet

Solution

1. Step 1: Understand the role of subnets in a VNet

   Subnets split a VNet into smaller parts, each with its own IP range.

2. Step 2: Identify the purpose of subnetting

   Subnetting helps organize resources and apply security rules within the VNet.

3. Final Answer:

   To divide the VNet into smaller IP address ranges for better organization and security -> Option B

4. Quick Check:

   Subnet purpose = divide and organize IP ranges [OK]

Hint: Subnets split IP space inside a VNet for organization [OK]

Common Mistakes:

• Thinking subnets increase total IP space
• Confusing subnets with VNet peering
• Believing subnets create VMs automatically

2. Which of the following is the correct way to define a subnet within an Azure VNet using CIDR notation?

easy

A. 10.0.1.0/24

B. 10.0.0.256/24

C. 10.0.0.0/16

D. 10.0.0.0/33

Solution

1. Step 1: Review valid CIDR notation for subnets

   CIDR notation uses an IP address and a prefix length between 0 and 32 for IPv4.

2. Step 2: Check each option for validity

   10.0.0.0/16 is a VNet range, not a subnet. 10.0.1.0/24 is a valid subnet inside 10.0.0.0/16. 10.0.0.256/24 has an invalid IP (256 is out of range). 10.0.0.0/33 has an invalid prefix length (33 is too large).

3. Final Answer:

   10.0.1.0/24 -> Option A

4. Quick Check:

   Valid subnet CIDR = 10.0.1.0/24 [OK]

Hint: Subnet CIDR must have valid IP and prefix ≤ 32 [OK]

Common Mistakes:

• Using IP octets above 255
• Using prefix length greater than 32
• Confusing VNet and subnet CIDR sizes

3. Given a VNet with address space 192.168.0.0/16, which subnet CIDR block is valid and fits inside this VNet?

medium

A. 192.168.1.0/24

B. 192.169.0.0/24

C. 192.168.0.0/15

D. 10.0.0.0/24

Solution

1. Step 1: Understand the VNet address space

   The VNet covers IPs from 192.168.0.0 to 192.168.255.255 (a /16 block).

2. Step 2: Check which subnet fits inside the VNet

   192.168.1.0/24 (192.168.1.0/24) fits inside the VNet range. 192.169.0.0/24 is outside the 192.168.x.x range. 192.168.0.0/15 has a /15 prefix which is larger than the VNet's /16, so it extends outside. 10.0.0.0/24 is a different private IP range.

3. Final Answer:

   192.168.1.0/24 -> Option A

4. Quick Check:

   Subnet inside VNet range = 192.168.1.0/24 [OK]

Hint: Subnet must be fully inside VNet IP range [OK]

Common Mistakes:

• Choosing subnet outside VNet range
• Using larger prefix than VNet
• Confusing private IP ranges

4. You tried to create a subnet with CIDR 10.1.0.0/16 inside a VNet with address space 10.0.0.0/24. What is the problem?

medium

A. The subnet CIDR is invalid because it uses a private IP range

B. The subnet CIDR is too small for a subnet

C. The subnet CIDR overlaps with another subnet

D. The subnet CIDR is larger than the VNet address space and does not fit inside

Solution

1. Step 1: Compare subnet and VNet address spaces

   The VNet covers 10.0.0.0 to 10.0.0.255 (/24). The subnet 10.1.0.0/16 covers 10.1.0.0 to 10.1.255.255, which is outside the VNet range.

2. Step 2: Identify the error

   The subnet CIDR must be fully inside the VNet's address space. Here, it is larger and outside the VNet.

3. Final Answer:

   The subnet CIDR is larger than the VNet address space and does not fit inside -> Option D

4. Quick Check:

   Subnet must fit inside VNet range [OK]

Hint: Subnet CIDR must be inside VNet CIDR, not bigger [OK]

Common Mistakes:

• Ignoring subnet size vs VNet size
• Thinking private IP ranges are invalid
• Assuming overlap without checking

5. You have a VNet with address space 172.16.0.0/16. You want to create three subnets: 172.16.0.0/18, 172.16.64.0/18, and 172.16.128.0/17. Which statement is true about these subnets?

hard

A. The second subnet is outside the VNet address space

B. The third subnet overlaps with the first two subnets

C. All three subnets fit inside the VNet without overlapping

D. The subnet sizes are invalid for this VNet

Solution

1. Step 1: Analyze the VNet and subnet ranges

   The VNet covers 172.16.0.0 to 172.16.255.255 (/16). The first subnet covers 172.16.0.0 to 172.16.63.255 (/18). The second covers 172.16.64.0 to 172.16.127.255 (/18). The third covers 172.16.128.0 to 172.16.255.255 (/17).

2. Step 2: Check for overlaps

   The subnets cover distinct ranges: first 172.16.0.0-172.16.63.255, second 172.16.64.0-172.16.127.255, third 172.16.128.0-172.16.255.255. No overlaps, all fit within the VNet.

3. Final Answer:

   All three subnets fit inside the VNet without overlapping -> Option C

4. Quick Check:

   All three subnets fit without overlapping [OK]

Hint: Check subnet ranges carefully for overlaps [OK]

Common Mistakes:

• Miscalculating subnet ranges and thinking they overlap
• Confusing prefix lengths and their sizes
• Ignoring subnet boundaries