Nordlicht Reisen GmbH, a fictional travel agency, is building a network of its own in Azure for its booking portal: one part for the web servers, one part for the application, one part for the data. From the outside, only the web part should be reachable, through a fixed address. The exam calls this: create and configure virtual networks and subnets and configure public IP addresses.

Prior knowledge: What a virtual network is in outline is covered in "AZ-900 compact", lesson 2.4. IP addresses, ports, and netmasks are explained in K3, lesson 3.0.2 ("TCP/IP, ports and what a connection is"). Here you learn how to plan and create address spaces. Filters (NSGs) follow in lesson 4.3.

The virtual network

A virtual network (VNet) is your private network in Azure. Virtual machines and other resources live in it and talk to each other over private IP addresses. It belongs to one region and one subscription. Microsoft describes VNets as layer 3 networks: there are no VLANs and no layer 2 features.

The address space consists of one or more ranges in CIDR notation (10.10.0.0/16). For private networks, Microsoft names:

Range Standard Note
10.0.0.0/8 RFC 1918 private
172.16.0.0/12 RFC 1918 private
192.168.0.0/16 RFC 1918 private
100.64.0.0/10 RFC 6598 counts as private in Azure; for when the RFC 1918 ranges run short

Plan the address space before you create it. The most important rules:

  • Ranges must not overlap with networks you want to connect: other virtual networks via peering (lesson 4.2), on-premises networks via VPN or ExpressRoute. Two ranges overlap as soon as any part is the same: 10.0.0.0/16 and 10.0.1.0/24 overlap.
  • Once a peering exists, the network's address ranges can be changed only with extra steps (lesson 4.2).
  • Do not make it larger than necessary; Microsoft advises not to waste address space.
  • A network can carry IPv4 alone or IPv4 and IPv6 (dual stack); IPv6 subnets are exactly /64 in size.

Costs arise mainly from what runs in the network; what is charged for the network itself is listed on the Virtual Network pricing page. By default, Azure handles DNS name resolution; you enter your own DNS servers on the network (--dns-servers, lesson 4.5).