Azure networking cheat sheet
An Azure virtual network is a regional Layer 3 overlay. A VNet lives in exactly one region (it can span availability zones), and Azure does not provide any Layer 2 semantics, so VLANs do not translate and multicast/broadcast traffic is not supported. Traffic between subnets routes automatically by default, but you can attach network security groups and route tables to each subnet to filter or override that routing.
Planning starts with one CIDR block per VNet, then subnets carved from it. Azure accepts any IPv4 subnet from /29 (the smallest) up to /2 (the largest), and every subnet loses five addresses to infrastructure: the first four addresses plus the last one. For a /29 subnet that leaves exactly three usable IP addresses; for a /24 it leaves 251.
Do the arithmetic before you click create. You can extend a VNet address space later (a /16 to a /8, for example), but you cannot change a subnet's address range while resources are deployed in it, and subnets cannot overlap each other. Overlapping ranges are also the reason two networks cannot be connected.
Run any realistic plan through the IPv4 subnet calculator to get network, range and usable counts for each prefix, or the VLSM calculator when you are carving a tiered design from host counts. Use IP range to CIDR when your starting point is a raw address list rather than a prefix.
Address space rules at a glance
| Item | Value or rule |
|---|---|
| Smallest IPv4 subnet | /29 — 8 addresses, 3 usable |
| Largest supported CIDR (VNet or subnet) | /2 |
| IPv6 subnet size | Exactly /64 |
| Recommended address spaces | RFC 1918: 10/8, 172.16/12, 192.168/16 — plus 100.64/10 (RFC 6598), which Azure treats as private |
| Ranges Azure rejects | 224.0.0.0/4 (multicast), 255.255.255.255/32 (broadcast), 127.0.0.0/8 (loopback), 169.254.0.0/16 (link-local), 168.63.129.16/32 (internal DNS/DHCP/health probe) |
| Non-overlap rule | Subnet ranges cannot overlap each other or any other address range in the VNet; a VNet cannot also be connected to a network whose ranges overlap |
| Layer 2 | Not supported — VNets are Layer 3 overlays |
| Region scope | One region only; connect regions via virtual network peering |
The five reserved IP addresses
| Address | Why it is reserved |
|---|---|
| 192.168.1.0 | Network address. Cannot be assigned. |
| 192.168.1.1 | Reserved by Azure for the default gateway. |
| 192.168.1.2 | Reserved to map the Azure DNS IP addresses into the VNet address space (first address). |
| 192.168.1.3 | Same mapping as above (second address). |
| 192.168.1.255 | Network broadcast address. Cannot be assigned. |
usable = total addresses − 5. The default gateway address (.1) is answered by the platform and does not respond to ping. Every reserved address exists in every subnet, regardless of size: a /29 has 8 addresses, so 3 can be assigned, and nothing smaller than /29 is supported — /31 and /32 point-to-point style subnets are not available.Usable addresses per prefix: subtract five
| Prefix | Total addresses | Azure reserved | Usable addresses |
|---|---|---|---|
| /16 | 65,536 | 5 | 65,531 |
| /20 | 4,096 | 5 | 4,091 |
| /21 | 2,048 | 5 | 2,043 |
| /22 | 1,024 | 5 | 1,019 |
| /23 | 512 | 5 | 507 |
| /24 | 256 | 5 | 251 |
| /25 | 128 | 5 | 123 |
| /26 | 64 | 5 | 59 |
| /27 | 32 | 5 | 27 |
| /28 | 16 | 5 | 11 |
| /29 | 8 | 5 | 3 |
2^(32 − prefix) − 5. Note that even a large VNet rarely gets to use everything — Azure caps assigned private IPs per VNet at 65,536 (see networking limits). Feed your chosen prefix into the subnet calculator to see the exact usable range for a concrete network address.Sizing guidance
Practical rules for subnet design
- Size the VNet around the largest tier you expect, then carve subnets; you can extend the address space later (Microsoft documents changing a /16 to /8) as long as existing subnets stay inside it.
- Keep tiers in separate subnets — per-subnet network security groups and route tables are the supported way to filter and route traffic between them.
- Reserve one subnet per tier plus spare blocks for growth, and remember the five-address tax when you count: a /28 hosts 11 resources, not 16.
- If you ever plan a VPN or ExpressRoute connection, create the dedicated _GatewaySubnet_ first: a connection to a virtual network gateway requires it.
- Think about peering before you pick ranges: peered VNets and on-premises ranges cannot overlap, the total address count across a peered group is capped at 128,000, and peering does not support transitive routing.
- Microsoft recommends private (RFC 1918) address space or public address space your organization owns; using someone else's range is a connection bug waiting to happen.
FAQ
How many usable IPs does an Azure /27 have?
27. A /27 has 32 addresses and Azure reserves five (the first four and the last), so usable = 32 − 5 = 27. For example, 192.168.1.0/27 reserves 192.168.1.0, .1, .2, .3 and .31, leaving 192.168.1.4 through .30 assignable.
Why does Azure reserve 5 IPs per subnet?
Microsoft documents five reserved addresses per subnet: the network address (.0), the default gateway address (.1), two addresses (.2 and .3) used to map Azure's DNS IPs into the VNet address space, and the broadcast-address equivalent (the last address). All five cannot be assigned to resources, so plan on total minus five usable addresses.
How big can an Azure VNet be?
The largest supported CIDR is /2, and the smallest IPv4 subnet you can define is /29. Practical limits usually come first: a subscription can hold 1,000 VNets per region, a VNet 3,000 subnets, and Azure caps assigned private IPs per VNet at 65,536. IPv6, when used, must be exactly /64 per subnet.
Are /31 and /32 subnets allowed in Azure?
No. The smallest supported IPv4 subnet is /29, which gives three usable IP addresses after the five-address reservation. Azure has no /31 point-to-point style subnet support, and a /32 is not a subnet size you create — it appears only as an individual IP assignment on a network interface.
Related tools
- IPv4 subnet calculator — break any CIDR block into network, range, broadcast and usable hosts.
- IP range to CIDR — turn an arbitrary address range into its minimal covering CIDR blocks.
- VLSM calculator — split a block into right-sized subnets by host requirements.