IP addressing, subnets and NAT Gateway
Poor address planning is expensive to fix because you cannot resize a subnet that has resources in it. The exam tests reserved addresses, special subnet names and how outbound traffic leaves a virtual network.
Planning address space
Use private ranges from RFC 1918: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. Avoid overlap with on-premises and with any network you will peer or connect by VPN, because overlapping ranges cannot be peered or routed.
Azure reserves five addresses in every subnet: the network address, the broadcast address, the default gateway (.1), and two for Azure DNS (.2 and .3). A /29 is therefore the smallest subnet that is useful, with 3 usable addresses.
Special subnets
| Subnet name | Used by | Minimum size |
|---|---|---|
| GatewaySubnet | VPN gateway and ExpressRoute gateway | /27 recommended |
| AzureFirewallSubnet | Azure Firewall | /26 |
| AzureFirewallManagementSubnet | Firewall forced tunneling | /26 |
| AzureBastionSubnet | Azure Bastion | /26 |
| RouteServerSubnet | Azure Route Server | /27 |
The name must match exactly. You cannot put other resources in these subnets, and you should not attach a route table with a default route to GatewaySubnet.
Public IP addresses
Public IP addresses come in Basic and Standard SKUs. Standard is static, zone-aware, and closed to inbound traffic until a network security group (NSG) allows it. Basic is being retired, so new designs use Standard. Standard load balancers, Azure Firewall, NAT Gateway and zone-redundant gateways need Standard. You can also create a public IP prefix to reserve a contiguous block of addresses.
Private addresses are dynamic by default. A “static” private address is set in the NIC settings and does not change while the NIC exists.
Outbound connectivity and NAT Gateway
Default outbound access for VMs without an explicit method is being retired for new virtual networks. Use an explicit method:
- Public IP on the NIC.
- Standard load balancer with outbound rules.
- Azure Firewall with a UDR.
- Azure NAT Gateway attached to the subnet.
NAT Gateway is the recommended choice for scalable outbound traffic. It gives static outbound IPs, provides up to 64,512 SNAT ports per public IP, and handles TCP and UDP. It has no inbound capability, is attached at subnet level, and works with zones. When a NAT gateway is on a subnet, it takes precedence over the other outbound methods for that subnet.
Exam traps
- A /27 does not give 32 usable addresses. Subtract five.
- NAT Gateway is for outbound only. It cannot publish a web server.
- NAT Gateway can be combined with Azure Firewall by attaching it to the AzureFirewallSubnet to add SNAT ports.
- Subnet names such as GatewaySubnet and AzureFirewallSubnet must be exact.
- Standard public IP does not allow inbound traffic until an NSG permits it.
Practice questions
Choose an answer, then review the explanation to check your understanding.
1. You create a subnet with the prefix 10.0.1.0/27. How many addresses can you assign to resources?
Show answer
Answer: C.Azure reserves five addresses in every subnet. A /27 has 32, so 27 are usable.
2. VMs in a private subnet need a fixed public outbound IP address, with no inbound access from the internet. What is the simplest option?
Show answer
Answer: B.NAT Gateway gives a subnet static outbound public IPs, and it does not allow unsolicited inbound connections.
3. Which resource must be deployed in a subnet named exactly AzureBastionSubnet?
Show answer
Answer: A.Azure Bastion requires a subnet called AzureBastionSubnet of /26 or larger. Azure Firewall uses AzureFirewallSubnet.
4. You need a public IP address that supports availability zones and is used by a Standard load balancer. Which SKU and assignment?
Show answer
Answer: B.Standard public IPs are always static, support zones and are secure by default, meaning closed to inbound traffic until an NSG allows it.