🔢 Azure Subnets (Sub-Networks)

📌 Overview

A Subnet is a range of IP addresses within a Virtual Network (VNet). You can divide a VNet into multiple subnets for organization and security.

Think of a VNet as a Building and Subnets as the Floors inside it.

✨ Why segment into Subnets?

  1. Isolation: Keep Database servers away from the public internet.
  2. Organization: Group resources by department (HR, IT, Finance).
  3. Security: Apply specific security rules (NSG) to one subnet without affecting others.

🧮 Understanding CIDR Notation

Azure uses CIDR (Classless Inter-Domain Routing) to define IP ranges.

CIDR PrefixTotal IPsUsable IPs (Azure)Description
/1665,53665,531Huge network (VNet size)
/24256251Standard subnet size
/281611Very small subnet

⚠️ Note: Azure reserves 5 IPs in every subnet:

  1. x.x.x.0 (Network Address)
  2. x.x.x.1 (Default Gateway)
  3. x.x.x.2 (Azure DNS Mapping 1)
  4. x.x.x.3 (Azure DNS Mapping 2)
  5. x.x.x.255 (Broadcast Address)

🛠️ General Concept: How to Design Subnets (Subnetting)

Subnetting is the process of stealing bits from the Host part of an IP address to create more Networks (Subnets).

Step-by-Step Guide to Creating Subnets

Step 1: Identify Requirements

Ask yourself:

  1. How many subnets do I need? (e.g., 2 subnets: Web, DB)
  2. How many hosts (IPs) per subnet? (e.g., 50 servers each)

Step 2: Choose Your Network Class/CIDR

Start with a standard network block.

Step 3: Borrow Bits (The Calculation)

To create 2 subnets, you need to borrow 1 bit (2^1 = 2).

This splits the block perfectly in half.

Visual Calculation Example

Goal: Split 192.168.1.0/24 into 2 Subnets.

  1. Subnet A (First Half)

    • Range: 192.168.1.0 to 192.168.1.127
    • CIDR: 192.168.1.0/25
    • Total IPs: 128 (Usable: 123 in Azure)

  2. Subnet B (Second Half)

    • Range: 192.168.1.128 to 192.168.1.255
    • CIDR: 192.168.1.128/25
    • Total IPs: 128 (Usable: 123 in Azure)

Key Rule: Every time you increase the CIDR number by 1 (e.g., /24 -> /25), you double the number of subnets but halve the number of IPs in each.

🏗️ Architecture: Public vs Private Subnets

Although Azure doesn't technically have "Public" or "Private" subnet types (like AWS), we simulate them using NSGs and Route Tables.

1. Public Subnet

2. Private Subnet

Architecture Diagram (Segmentation)

       [        VNet (10.0.0.0/16)        ]
       +----------------------------------+
       |                                  |
       |   +--------------------------+   |
       |   | Public Subnet (Web Tier) |   |
       |   | 10.0.1.0/24              |   |
       |   | [WebVM] <---(Internet)---|   |
       |   +--------------------------+   |
       |              |                   |
       |              v (Allowed)         |
       |   +--------------------------+   |
       |   | Private Subnet (DB Tier) |   |
       |   | 10.0.2.0/24              |   |
       |   | [SQLDB] <---(No Access)--|   |
       |   +--------------------------+   |
       |                                  |
       +----------------------------------+

🎓 Advanced Concepts

1. Subnet Delegation

Some Azure services (like Azure Container Instances, App Service VNet Integration) require a subnet to be "Delegated" (Dedicated) to them.

2. Service Endpoints

Allows you to extend your VNet identity to Azure services (like Storage or SQL).

3. Private Endpoints (Private Link)

Brings the Azure Service (like SQL DB) inside your VNet with a private IP. This is the most secure method.

💡 Hinglish Explanation (Office Layout)

1. Subnet (Departments)

2. 5 Reserved IPs (Staff Area)

3. Service Endpoint (Direct Tunnel)

⚡ Exam Tips for AZ-900

  1. Calculation: If a question asks "How many usable IPs in a /24 subnet?", the answer is 251 (256 - 5 reserved).
  2. Delegation: Certain PaaS services require a dedicated (empty) subnet.
  3. Security: You secure subnets using Network Security Groups (NSGs), not by just naming them "Private".