Azure VNets, subnets and peering explained
An Azure virtual network (VNet) is a private address space in one region, a subnet is a slice of that space where resources get their IPs, and peering links two VNets so they talk over Microsoft’s backbone. Two rules decide most exam questions: Azure keeps five addresses in every subnet, and peering is not transitive (A to B and B to C does not give A to C).
Layer 1: the VNet is an address plan
You choose one or more address spaces in CIDR notation, typically from the private ranges, such as 10.20.0.0/16. Nothing outside is reachable yet: a VNet is a boundary, and resources inside it can talk to each other by default. A VNet also lives in one region and one subscription, which is why connecting several of them is a design question and not a setting.
The planning rule that matters later: address spaces of VNets you will connect must not overlap. Peering between overlapping spaces is not possible, and changing an address space after resources are deployed is disruptive. Plan the whole estate on paper before creating the first network.
Layer 2: subnets carve up the space
A subnet is a range inside the VNet, and subnet ranges cannot overlap each other. Microsoft’s FAQ states that Azure reserves the first four addresses and the last address in each subnet, five in total. For 192.168.1.0/24 these are .0 (network address), .1 (default gateway), .2 and .3 (Azure DNS mapping) and .255 (broadcast). The smallest supported IPv4 subnet is /29.
Worked example: sizing a subnet
A web tier needs 40 VMs today and should have room to grow.
| Prefix | Total addresses | Usable after the 5 reserved |
|---|---|---|
| /29 | 8 | 3 |
| /28 | 16 | 11 |
| /27 | 32 | 27 |
| /26 | 64 | 59 |
A /27 holds only 27 usable addresses, so it fails. A /26 holds 59, which covers 40 with growth. The exam version of this question usually offers the “obvious” prefix that ignores the reservation. Count addresses as 2 to the power of (32 minus prefix), then subtract five.
Some services need a dedicated subnet with a fixed name or minimum size. Azure Bastion, for example, needs a subnet named AzureBastionSubnet, and gateways need GatewaySubnet. When a scenario says “the service will not deploy”, check the subnet name and size.
Layer 3: peering connects VNets
Peering links two VNets so that resources reach each other by private IP, in the same region or across regions (global peering). Facts to hold:
- Not transitive. Microsoft’s FAQ is explicit: if VNetA is peered with VNetB and VNetB with VNetC, VNetA and VNetC are not peered. You must peer A to C directly.
- No overlap. The address spaces must be distinct. A newer option, subnet peering (configurable only through the CLI, PowerShell, the API or templates), peers selected subnets instead of whole networks, but the peered subnets still must not overlap.
- Two links. Peering has a link on each side. If one link is deleted, the other shows Disconnected and both must be recreated.
- No bandwidth cap from peering itself; data transfer across a peering is charged.
- A peered VNet cannot be moved to another subscription or resource group until its peering is deleted.
- Peering is configured per direction. Allowing forwarded traffic and using the remote gateway are settings on each link, so a one-sided change is a classic cause of traffic that works in one direction only.
Getting past “not transitive”
Hub-and-spoke is the pattern: shared services and a firewall or gateway in a hub, workloads in spokes. Spoke-to-spoke traffic works only if it is forwarded through something in the hub, usually a firewall or network virtual appliance with route tables on the spokes. Gateway transit lets spokes use a VPN or ExpressRoute gateway in the hub to reach on-premises. Neither of these is automatic: peering by itself never forwards traffic on behalf of a third network.
Which exams test this
| Exam | How the topic appears | Where on this site |
|---|---|---|
| AZ-104 | Implement and manage virtual networking (15 to 20 percent): create and configure VNets, subnets and peering, configure user-defined routes and troubleshoot connectivity | Virtual networking guide |
| AZ-305 | Design infrastructure solutions: recommend network connectivity solutions, to the internet and to on-premises networks, where hub-and-spoke and peering are the usual building blocks | Infrastructure design guide |
| AZ-900 | Describe Azure architecture and services: describe the purpose of virtual networks, subnets and peering | Architecture and services guide |
| SC-900 | Capabilities of Microsoft security solutions: describe network segmentation with Azure virtual networks. A minor topic: segmentation as a security idea, not addressing or peering details (same objective in the outline that applies from October 21, 2026) | Security solutions guide |
How exam questions are built around this topic
Hidden reservation. The scenario asks for a subnet that fits N hosts, and one option is exactly the next power of two above N. Subtract five before choosing.
Hidden transitivity. A longer story with three or four VNets, where the failing path goes A to B through a hub. Draw the peering links as lines; if there is no line between two networks and no appliance in between, there is no connectivity.
Overlap. Two networks that “must be connected” share a range such as 10.0.0.0/16 and 10.0.5.0/24. The fix is readdressing, not a setting.
Constraint words that decide the answer: “directly”, “least administrative effort”, “across regions”, “on-premises”, and “without a gateway”. Remember that an NSG or DNS change cannot create a route that does not exist; see NSG rule evaluation for what NSGs do control.
Two practice questions
Question 1. A subnet must host 30 virtual machines, each with one network interface. Which is the smallest IPv4 prefix that can hold them?
- A. /27
- B. /26
- C. /28
- D. /29
Show answer
Answer: B
Azure reserves five addresses per subnet. A /27 has 32 addresses and 27 usable, which is too few for 30. A /26 has 64 addresses and 59 usable, which fits 30. A /28 (11 usable) and a /29 (3 usable) are far too small.
Question 2. VNet-Prod uses 10.0.0.0/16. A newly created VNet-Dev uses 10.0.5.0/24, and the teams want the two networks peered. What must be done first?
- A. Enable gateway transit on both peering links
- B. Add an NSG rule that allows VirtualNetwork traffic
- C. Link a private DNS zone to both networks
- D. Change the address space of one of the networks so they no longer overlap
Show answer
Answer: D
Peered virtual networks cannot have overlapping address spaces, and 10.0.5.0/24 falls inside 10.0.0.0/16. One network must be readdressed before peering is possible. Virtual network peering has no setting that ignores overlap. A gateway or an NSG rule does not change the addressing problem, and DNS settings are unrelated.
Go deeper
- Azure Virtual Network FAQ, Microsoft Learn (reserved addresses, subnet sizes, peering answers)
- Virtual network peering, Microsoft Learn
- Hub-spoke network topology, Azure Architecture Center
- Related on this site: NSG rule evaluation, subnetting step by step, how to study for certification exams