Random Musings

In Microsoft Azure, a virtual network (VNet) can have multiple subnets. This is a common and recommended practice for organizing and securing resources within a virtual network. Subnets allow you to segment your network into smaller, more manageable sections, each with its own IP address range and network security rules.

Key Points About Subnets in Azure:

1. Multiple Subnets per VNet:

   • A single virtual network can have multiple subnets, each with its own unique IP address range (CIDR block).
   • Subnets must have non-overlapping IP address ranges within the same virtual network.

2. Purpose of Subnets:

   • Subnets are used to isolate and organize resources, such as virtual machines (VMs), application gateways, Azure Kubernetes Service (AKS) clusters, and more.
   • For example, you might have separate subnets for web servers, application servers, and databases.

3. Subnet Sizing:

   • Each subnet must have a CIDR block that falls within the address space of the virtual network.
   • Azure reserves 5 IP addresses in each subnet for internal use, so plan your IP ranges accordingly.

4. Network Security Groups (NSGs):

   • You can associate a Network Security Group (NSG) with each subnet to control inbound and outbound traffic.
   • This allows you to apply different security rules to different subnets.

5. Service-Specific Subnets:

   • Some Azure services, such as Azure Firewall, Azure Bastion, and Azure Application Gateway, require dedicated subnets.

Example Scenario:

Suppose you have a virtual network with the address space 10.0.0.0/16. You could create the following subnets:

• Web Tier: 10.0.1.0/24 (for web servers)
• App Tier: 10.0.2.0/24 (for application servers)
• Data Tier: 10.0.3.0/24 (for databases)
• Gateway Subnet: 10.0.4.0/27 (for VPN or ExpressRoute gateways)

How to Add Multiple Subnets in Azure:

1. Azure Portal:

   • Go to your virtual network in the Azure portal.
   • Under Settings, click on Subnets.
   • Click + Subnet to add a new subnet and configure its IP address range.

2. Azure CLI:

   az network vnet subnet create \
     --resource-group <ResourceGroupName> \
     --vnet-name <VNetName> \
     --name <SubnetName> \
     --address-prefixes <CIDRBlock>
   

3. Azure PowerShell:

   $subnetConfig = New-AzVirtualNetworkSubnetConfig `
     -Name <SubnetName> `
     -AddressPrefix <CIDRBlock>
   
   $vnet = Get-AzVirtualNetwork `
     -ResourceGroupName <ResourceGroupName> `
     -Name <VNetName>
   
   $vnet.Subnets.Add($subnetConfig)
   Set-AzVirtualNetwork -VirtualNetwork $vnet
   

Best Practices:

• Plan your IP address ranges carefully to avoid overlap and ensure scalability.
• Use NSGs to enforce security policies at the subnet level.
• Consider using Azure Virtual Network (VNet) peering or VPN/ExpressRoute to connect multiple virtual networks if needed.

No, subnets within the same virtual network (VNet) do not require peering to communicate with each other. Subnets in the same VNet are inherently connected and can communicate with each other by default, as long as there are no Network Security Groups (NSGs) or firewalls blocking the traffic.

Key Points About Subnet Communication in Azure:

1. Automatic Connectivity:

   • Subnets within the same VNet can communicate with each other without any additional configuration.
   • Resources in different subnets can communicate over the VNet’s internal IP addresses.

2. Network Security Groups (NSGs):

   • If you want to restrict or control traffic between subnets, you can use NSGs to define inbound and outbound rules.
   • For example, you might allow web servers in one subnet to communicate with application servers in another subnet but block direct access to database servers.

3. User-Defined Routes (UDRs):

   • If you need to customize routing between subnets, you can use User-Defined Routes (UDRs).
   • UDRs allow you to override Azure’s default system routes for specific traffic.

4. Azure Firewall or Network Virtual Appliances (NVAs):

   • For advanced traffic filtering and inspection between subnets, you can deploy an Azure Firewall or a third-party Network Virtual Appliance (NVA).
   • These can act as a central point for controlling and monitoring traffic between subnets.

When to Use VNet Peering:

VNet peering is used to connect two separate virtual networks (not subnets within the same VNet). For example:

• If you have two VNets in the same region or across different regions, you can peer them to enable communication between resources in those VNets.
• Peering allows resources in different VNets to communicate securely over Microsoft’s backbone network.

Example Scenario:

Suppose you have the following setup:

• VNet A: Contains subnets Web-Subnet and App-Subnet.

• VNet B: Contains subnets DB-Subnet and Backup-Subnet.

• Within VNet A: The Web-Subnet and App-Subnet can communicate directly without peering.

• Between VNet A and VNet B: You would need to set up VNet peering to allow communication between App-Subnet (in VNet A) and DB-Subnet (in VNet B).

How to Set Up VNet Peering:

1. Azure Portal:

   • Go to the first VNet (e.g., VNet A).
   • Under Settings, click on Peerings.
   • Click + Add to create a new peering connection.
   • Specify the second VNet (e.g., VNet B) and configure the peering settings (e.g., allow forwarded traffic, gateway transit).

2. Azure CLI:

   az network vnet peering create \
     --resource-group <ResourceGroupName> \
     --vnet-name <VNetAName> \
     --name <PeeringName> \
     --remote-vnet <VNetBId> \
     --allow-vnet-access
   

3. Azure PowerShell:

   $vnetA = Get-AzVirtualNetwork -ResourceGroupName <ResourceGroupName> -Name <VNetAName>
   $vnetB = Get-AzVirtualNetwork -ResourceGroupName <ResourceGroupName> -Name <VNetBName>
   
   Add-AzVirtualNetworkPeering `
     -Name <PeeringName> `
     -VirtualNetwork $vnetA `
     -RemoteVirtualNetworkId $vnetB.Id
   
   Add-AzVirtualNetworkPeering `
     -Name <PeeringName> `
     -VirtualNetwork $vnetB `
     -RemoteVirtualNetworkId $vnetA.Id
   

Summary:

• Subnets within the same VNet are automatically connected and do not require peering.
• Use NSGs, UDRs, or Azure Firewall to control or inspect traffic between subnets.
• Use VNet peering only to connect separate virtual networks.