Azure AI Engineer

Azure Administrator

Azure Fundamentals

Azure Solutions Architect Expert

Azure Security Engineer

Azure Network Engineer Associate

<p>Start writing your course overview...</p>

Learn the fundamentals of what you need to know for the AZ-104 networking questions during your exam.

AZ-104 Networking Crash Course

IP Addresses

Network Address Space & Subnets

Route Tables and User Defined Routes (UDRs)

Network Security Groups (NSGs)

Application Security Groups (ASGs)

Peering

Azure VPN Gateway

Azure ExpressRoute

Azure Load Balancer

Azure Application Gateway

<p>Now that you understand <strong>IP Addresses</strong>, it’s time to build on that foundation and learn about <strong>Subnets</strong> and <strong>CIDR Blocks</strong>.</p><p>These two concepts will help you design, organize, and scale your Azure Virtual Networks efficiently.</p><h2>How is a Virtual Network organized?</h2><img class="tiptap-image" src="https://zta-storage.s3.eu-north-1.amazonaws.com/courses/azure-virtual-networking/lesson-2/001-with-subnets.png" alt="With / Without Subnets Example"><p>When you come across the term <strong>Virtual Network</strong>, think of a group of computers connected to a central hub. The number of computers connected to that hub determines the <strong>size</strong> of the network.</p><p>In Azure, these computers are usually called <strong>Virtual Machines (VMs)</strong>, that’s the term I’ll use throughout the course.</p><p>As a Virtual Networks grows, it becomes harder to manage and maintain.</p><p>For instance, imagine having 100 Virtual Machines inside a network without any structure.</p><p>It would be like tossing all your forks, spoons, and knives into the kitchen drawer without any dividers between them. Everything would get mixed up and hard to find.</p><p>To fix this, you need <strong>dividers</strong>: smaller sections that help you keep things tidy and organized.</p><p>In networking, these dividers are called <strong>subnets</strong>.</p><div data-callout-type="exam-insight" data-content="&lt;p&gt;When you deploy a Virtual Machine in Azure, you must select which Virtual Network and subnet it belongs to. A Virtual Network &lt;strong&gt;needs to exist before&lt;/strong&gt; you can deploy any Virtual Machine.&lt;/p&gt;" data-type="callout" data-title="" class="callout-component" style="margin: 1rem 0px; padding: 1rem; border-radius: 0.5rem; border-left: 4px solid;"><div class="callout-header" style="font-weight: 600; margin-bottom: 0.5rem;">💡 Exam Insight</div><div class="callout-content">&lt;p&gt;When you deploy a Virtual Machine in Azure, you must select which Virtual Network and subnet it belongs to. A Virtual Network &lt;strong&gt;needs to exist before&lt;/strong&gt; you can deploy any Virtual Machine.&lt;/p&gt;</div></div><h2>The Network’s Address Space</h2><img class="tiptap-image" src="https://zta-storage.s3.eu-north-1.amazonaws.com/courses/azure-virtual-networking/lesson-2/002-address-space.png" alt="Address Space Visualization"><p>Before we dive into subnets, let’s first understand the <strong>Address Space</strong> of a Virtual Network, which defines the size of the overall network.</p><p>Think of it as the <strong>total number of Private IP addresses</strong> available in the network. That number will determine how many Virtual Machines (and other resources) you can deploy inside it.</p><p>For example:</p><ul><li><p>You can create a small network with just 32 IP addresses</p></li><li><p>Or create a larger one with 256 IP addresses</p></li></ul><p>However, manually writing down a list of Private IP addresses (like <code>10.0.0.1</code>, <code>10.0.0.2</code>, <code>10.0.0.3</code>, … ) would require too much time, especially if you plan to have networks of bigger sizes, with tens of thousands of addresses.</p><p>To make this easier, administrators and network engineers use a short, standardized syntax called <strong>CIDR Notation</strong>.</p><div data-callout-type="exam-insight" data-content="&lt;p&gt;During your exam, you could be asked to create multiple Virtual Networks. Make sure that their Address Space &lt;strong&gt;don't overlap&lt;/strong&gt;, as that will cause issues in the future if you plan to peer the networks.&lt;/p&gt;" data-type="callout" data-title="" class="callout-component" style="margin: 1rem 0px; padding: 1rem; border-radius: 0.5rem; border-left: 4px solid;"><div class="callout-header" style="font-weight: 600; margin-bottom: 0.5rem;">💡 Exam Insight</div><div class="callout-content">&lt;p&gt;During your exam, you could be asked to create multiple Virtual Networks. Make sure that their Address Space &lt;strong&gt;don't overlap&lt;/strong&gt;, as that will cause issues in the future if you plan to peer the networks.&lt;/p&gt;</div></div><h2>What is CIDR Notation?</h2><img class="tiptap-image" src="https://zta-storage.s3.eu-north-1.amazonaws.com/courses/azure-virtual-networking/lesson-2/003-subnet-example.png" alt="CIDR Example"><p>CIDR stands for <em>Classless Inter-Domain Routing</em>, and it’s <strong>a compact way to define a range of IP Addresses</strong>.</p><p>Here’s a quick example:</p><pre><code class="language-jsx">10.0.0.0/27</code></pre><p>This single line is equal to writing down all IP Addresses from <code>10.0.0.0</code> all the way to <code>10.0.0.31</code> (a total of 32 IP Addresses).</p><p>Here is another example:</p><pre><code class="language-jsx">10.1.0.0/16</code></pre><p>This line defines <strong>65,536 IP Addresses</strong>, from <code>10.1.0.0/16</code> to <code>10.1.255.255</code> .</p><p>The way it works is as follows:</p><p>A CIDR Block always begins with a <strong>base IP Address</strong> such as <code>10.0.0.0</code> .</p><p>Then, you add a slash follows by a number between 1 and 32, called the <strong>prefix length:</strong> <code>10.0.0.0/24</code> .</p><p>The prefix length tells you how many bits at the start of the IP Address are locked. The remaining bits are unlocked, as they can change, creating different addresses for devices in your network (more on this in the optional deep dive below).</p><p>In <code>10.0.0.0/24</code> the first 24 bits are fixed, and the last 8 bits (32 bits - 24 bits) can vary. That gives you <strong>2⁸ = 256 possible addresses</strong>.</p><div data-callout-type="deep-dive" data-content="&lt;p&gt;Think of a street address like “10 Main Street, Apartment ___. “ The part before the blank (the street name) is fixed, everyone on that street shares it. The apartment name is variable, it defines each person’s home address on that street.&lt;/p&gt;" data-title="Analogy" data-type="callout" class="callout-component" style="margin: 1rem 0px; padding: 1rem; border-radius: 0.5rem; border-left: 4px solid;"><div class="callout-header" style="font-weight: 600; margin-bottom: 0.5rem;">Analogy</div><div class="callout-content">&lt;p&gt;Think of a street address like “10 Main Street, Apartment ___. “ The part before the blank (the street name) is fixed, everyone on that street shares it. The apartment name is variable, it defines each person’s home address on that street.&lt;/p&gt;</div></div><h2>See it in Binary (Optional Deep Dive)</h2><img class="tiptap-image" src="https://zta-storage.s3.eu-north-1.amazonaws.com/courses/azure-virtual-networking/lesson-2/004-binary-example.png" alt="Binary Visualization"><p>If you want to see how this works under the hood, here’s the binary version of <code>10.0.0.0/24</code>:</p><pre><code>10.0.0.0     -&gt; 00001010.00000000.00000000.00000000
Prefix (/24) -&gt; 11111111.11111111.11111111.00000000</code></pre><p>Each <code>1</code> means “locked” (the fixed part of the network).</p><p>Each <code>0</code> means “available to vary” (the host part).</p><p>So the first 24 bits stay the same, and the last 8 bits can change from <code>00000000</code> to <code>11111111</code>.</p><p>This gives you the range:</p><pre><code>10.0.0.0    (Start of Range)
10.0.0.255  (End of Range)
Total = 256 IP Addresses</code></pre><p>Try changing <code>/24</code> to <code>/16</code> or <code>/28</code> and notice how the total number of available addresses changes.</p><div data-callout-type="exam-insight" data-content="&lt;p&gt;Remember that the prefix &lt;code&gt;/16&lt;/code&gt; represents &lt;strong&gt;65,536 &lt;/strong&gt;addresses and &lt;code&gt;/24&lt;/code&gt; represents &lt;strong&gt;256 &lt;/strong&gt;addresses, as these are the most common CIDR Blocks encountered.&lt;/p&gt;" data-type="callout" data-title="" class="callout-component" style="margin: 1rem 0px; padding: 1rem; border-radius: 0.5rem; border-left: 4px solid;"><div class="callout-header" style="font-weight: 600; margin-bottom: 0.5rem;">💡 Exam Insight</div><div class="callout-content">&lt;p&gt;Remember that the prefix &lt;code&gt;/16&lt;/code&gt; represents &lt;strong&gt;65,536 &lt;/strong&gt;addresses and &lt;code&gt;/24&lt;/code&gt; represents &lt;strong&gt;256 &lt;/strong&gt;addresses, as these are the most common CIDR Blocks encountered.&lt;/p&gt;</div></div><h2>What are Subnets?</h2><img class="tiptap-image" src="https://zta-storage.s3.eu-north-1.amazonaws.com/courses/azure-virtual-networking/lesson-2/005-real-world-example.png" alt="Example Subnets"><p>Now that you understand CIDR, let’s return to subnets, the “sections” inside your Virtual Network.</p><p>A subnet is simply <strong>a smaller, organized portion</strong> of the Virtual Network’s Address Space.</p><p>For example, let’s say you have a Virtual Network with this address space:</p><pre><code>10.5.0.0/25</code></pre><p>This gives you 128 IP Addresses, from <code>10.5.0.0</code> to <code>10.5.0.127</code>.</p><p>You could divide this network like this:</p><table class="tiptap-table" style="min-width: 300px;"><colgroup><col style="min-width: 100px;"><col style="min-width: 100px;"><col style="min-width: 100px;"></colgroup><tbody><tr class="tiptap-table-row"><th class="tiptap-table-header" colspan="1" rowspan="1"><p>Subnet Name</p></th><th class="tiptap-table-header" colspan="1" rowspan="1"><p>CIDR Range</p></th><th class="tiptap-table-header" colspan="1" rowspan="1"><p>Purpose</p></th></tr><tr class="tiptap-table-row"><td class="tiptap-table-cell" colspan="1" rowspan="1"><p>DatabaseSubnet</p></td><td class="tiptap-table-cell" colspan="1" rowspan="1"><p>10.5.0.0/27 (from <code>10.5.0.0</code> to <code>10.5.0.31</code>)</p></td><td class="tiptap-table-cell" colspan="1" rowspan="1"><p>For VMs running SQL Databases</p></td></tr><tr class="tiptap-table-row"><td class="tiptap-table-cell" colspan="1" rowspan="1"><p>WebServerSubnet</p></td><td class="tiptap-table-cell" colspan="1" rowspan="1"><p>10.5.0.32/27 (from <code>10.5.0.32</code> to <code>10.5.0.63</code>)</p></td><td class="tiptap-table-cell" colspan="1" rowspan="1"><p>For VMs running web servers</p></td></tr></tbody></table><p>By dividing a Virtual Network into subnets, you have a better idea of what should exist in the Virtual Network, since you plan ahead.</p><div data-callout-type="exam-insight" data-content="&lt;p&gt;Every Azure Virtual Network must contain &lt;strong&gt;at least one subnet&lt;/strong&gt;, and you must define it when you create the Virtual Network.&lt;/p&gt;" data-type="callout" data-title="" class="callout-component" style="margin: 1rem 0px; padding: 1rem; border-radius: 0.5rem; border-left: 4px solid;"><div class="callout-header" style="font-weight: 600; margin-bottom: 0.5rem;">💡 Exam Insight</div><div class="callout-content">&lt;p&gt;Every Azure Virtual Network must contain &lt;strong&gt;at least one subnet&lt;/strong&gt;, and you must define it when you create the Virtual Network.&lt;/p&gt;</div></div><h2>What to remember for your exam</h2><ul><li><p>A Virtual Network contains a long list of Private IP Addresses, which you define using CIDR Notation.</p></li><li><p>You can, and should, split up a Virtual Network into smaller parts called “subnets”. Subnets are also defined using CIDR Notation.</p></li><li><p>In real world cases, Virtual Networks have separate subnets for Web Servers and Databases.</p></li><li><p>When you deploy a Virtual Machine in Azure, you must choose both the Virtual Network and the Subnet in which you want to deploy it to.</p></li><li><p>The most common CIDR Notation Prefix Lengths are <code>/24</code> (256 IP Addresses) and <code>16</code> (65,536 IP Addresses).</p></li><li><p>Overlapping Address Spaces between Virtual Networks prevent them from being peered.</p></li></ul><h2>What’s next?</h2><p>To lock in what you’ve learned, take the short <strong>8-question quiz</strong> for this lesson. It will help you test your understanding of Subnets and CIDR Notation before you move on.</p><p>In the next lesson, you'll learn how network traffic is routed inside a Virtual Network via <strong>Routing Tables,</strong> and how to override the default behavior using <strong>User Defined Routes (UDRs)</strong>.</p>

Network Address Space & Subnets

Alexandru Tepes

Practice Quiz

Want to pass your next certification?

Azure AI Engineer

Azure Administrator

Azure Fundamentals

Azure Solutions Architect

Azure Security Engineer

Azure Network Engineer

Want to connect with others?

Join Our Discord Community

Active Discussions

Study Groups

Celebrate Wins