AZ-104
Deep Dive
VNets are the fundamental network building block in Azure. The AZ-104 evaluates subnet design, CIDR, peering, custom routing, and how to isolate or connect resources inside and outside Azure.
Contents
A Virtual Network (VNet) is an isolated private network in Azure. It works like an on-premises network: it has a range of private IPs (CIDR), subnets, route tables, and traffic control — but managed by software in the cloud.
VNets are regional — they cannot span multiple regions directly. To connect VNets across regions, Global VNet Peering is used.
Key characteristics
SLA and availability
Per-subscription limits
IPs reserved by Azure in every subnet
In a /28 subnet (16 IPs) there are only 11 usable IPs. Azure always reserves 5:
Azure's special subnets
GatewaySubnet
Required for VPN Gateway and ExpressRoute. Exact name. Minimum /27, /26 or larger recommended.
AzureBastionSubnet
Required for Azure Bastion. Exact name. Minimum /26.
AzureFirewallSubnet
Required for Azure Firewall. Exact name. Minimum /26.
AzureFirewallManagementSubnet
For Azure Firewall with forced tunneling enabled. Minimum /26.
| CIDR | Total IPs | Usable IPs | Typical use |
|---|---|---|---|
| /8 | 16,777,216 | 16,777,211 | Entire VNet (maximum range) |
| /16 | 65,536 | 65,531 | Mid-size organization VNet |
| /24 | 256 | 251 | Standard subnet with plenty of room |
| /26 | 64 | 59 | Azure services subnet (Bastion, Firewall, GW) |
| /27 | 32 | 27 | Minimum viable GatewaySubnet |
| /28 | 16 | 11 | Small subnet for limited resources |
| /29 | 8 | 3 | Very limited — avoid in production |
VNet Peering connects two VNets privately using Microsoft's backbone — without going through the internet, without a gateway, without encryption (the backbone is already secure). Traffic travels at full network speed with low latency.
Regional Peering
Connects VNets in the same Azure region.
Global VNet Peering
Connects VNets in different Azure regions.
Important peering characteristics
• Peering is not transitive: if VNet-A peers with VNet-B and VNet-B peers with VNet-C, VNet-A CANNOT talk to VNet-C
• For transitive connectivity: use Azure Virtual WAN or an NVA (Network Virtual Appliance) as a hub
• Peering is bidirectional: two links are created (A→B and B→A)
• Options: Allow gateway transit (the hub VNet shares its gateway with the spokes) and Use remote gateway (the spoke uses the hub's gateway)
System routes (automatic)
Azure creates routes automatically for every subnet. You cannot modify them, but you can override them with a UDR.
User-Defined Routes (UDR)
Let you override system routes to direct traffic through an NVA, Azure Firewall, or VPN Gateway.
• Created in a Route Table and associated with subnets
• Next hop types: Virtual appliance (NVA/Firewall IP), Virtual network gateway, VNet, Internet, None (drop)
• Typical case: force all outbound internet traffic through Azure Firewall (UDR 0.0.0.0/0 → Firewall IP)
• Typical case: force on-premises traffic over VPN with BGP route propagation disabled
Service Endpoint
Extends the VNet's identity to Azure PaaS services (Storage, SQL, Key Vault, etc.). Traffic travels over Azure's backbone but the source IP remains the VNet's private IP.
Advantages
Limitations
Private Endpoint (Private Link)
Creates a NIC with a private IP in your subnet that maps directly to the PaaS service. The PaaS service becomes fully private — accessible only from your VNet.
Advantages
Limitations
Traffic evaluation with NSG
Inbound traffic
1. Destination subnet NSG → 2. Destination NIC NSG
Outbound traffic
1. Source NIC NSG → 2. Source subnet NSG
If the subnet NSG blocks the traffic, the NIC NSG is not evaluated (the packet has already been dropped).
Useful NSG Service Tags
Did you get this topic?
Test what you just learned
A subnet has the range 10.0.1.0/26. How many IPs are available for Azure resources?
Put what you learned to the test with original AZ-104 exam questions.
Start AZ-104 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.