Anatomy of Azure Networking: Understanding the Building Blocks

In this article , we will explore different components of Azure Networking.

As I am preparing for AZ-104, I found out Azure Networking is interesting as well as important topic to understand. First it may sound very complex, but in practice it may not be!

Let us deep dive.

Today we shall explore:

1. VNet

2. Address space

3. Subnet

4. Reserved Address

5. SDR vs UDR

6. Private IP Ranges

7. IPv4 vs IPv6

What is VNet?

A VNet is a private network in Azure where resources can communicate securely.

Explanation using simple example:

VNet: My-Network
Address Space: 10.0.0.0/16

This means if we consider VNet as a city , then the city owns all the addresses from: 10.0.0.0–10.0.255.255

What is Address Space?

Address space defines the total range of IP addresses available inside a Vnet.

VNet: My-Network
Address Space: 10.0.0.0/16

Above is example of IPv4 address space which is 32 bits long.

16 are network bits (First 2 octets [10.0] are unchangeable) , remaining 16 bits [last 2 octets ] are host bits (changeable)

Every host bit can have either of 2 possible values: 0 or 1.

This provides 65,536 IP addresses.

2^16 = 65,536

What is Subnet?

A subnet divides the Vnet into smaller sections.

VNet: 10.0.0.0/16
split into:
Web Subnet: 10.0.1.0/24
App Subnet: 10.0.2.0/24
Database Subnet: 10.0.3.0/24

What are Reserved Addresses?

Azure reserves 5 IP addresses in every subnet.

Example:

Subnet: 10.0.1.0/24

Available range: 10.0.1.0–10.0.1.255

10.0.1 = subnet name (fixed)
last number = host number (changeable)

Azure reserves:

Usable addresses:

10.0.1.4–10.0.1.254

So a /24 subnet has total 256 IPs — 5 IPs reserved by Azure = 251 Usable IPs.

CIDR Prefix:

10.0.0.0/16

/16, /24, /8 — are called CIDR prefixes.

An IPv4 address has 4 octets, total 32 bits long (each group is of 8 bits)

For /16 — 10.0.x.x, first 16 network bits (10.0) are fixed. The last 2 octets (host bits) can vary.

10.0.1.0/24

has 32–24= 8 host bits

and 256 IP addresses:

2^8 = 256

Quick Rule:

Every time you decrease the prefix by 1 (/24 -> /23), you double the number of IP addresses. Every time you increase it by 1 (/23 -> /24), you halve them.

If you have subnet 10.0.0.0/24, try to assign:

10.0.1.0 or 10.0.1.1 to a VM, Azure won’t allow it.

The first usable IP address is 10.0.1.4

Overlapping/Conflicting address spaces:

Suppose you have 2 VNets:

VNet A: 10.0.0.0/16

VNet B: 10.0.0.0/16

Azure will reject VNet peering between them because Azure needs unique IP ranges to know where traffic should go to.

Best Practice :

Use unique address spaces:

On-Premises: 192.168.0.0/16
Azure Prod: 10.0.0.0/16
Azure Dev: 10.1.0.0/16
Azure Test: 10.2.0.0/16

This prevents conflicts when:

1. Creating VPNs

2. Using Express Route

3. Peering VNets

4. Connecting multiple clouds

5. Merging Networks later

System Defined Routing (SDR) vs User Defined Routing (UDR):

SDR is created by Azure.

UDR is created by User.

Example:

Default Azure Route (SDR): VM -> Internet

UDR: VM -> Firewall-> Internet

What makes the networks different if the IPs are the same?

Azure tracks both VNet ID + IP Address. So Azure can distinguish VNet-A, 10.0.1.4 and VNet-B, 10.0.1.4

Once you connect the networks, routing is based on IP prefixes, and overlapping prefixes become a problem.

Let Us Understand Some more nuances in terms of IP ranges and addresses

3 Private IP ranges:

IPv4 vs IPv6:

An IPv4 address is 32 bits long.

Number of IPv4 addresses 2³² = 4.3 billion

Why we needed IPv6?

Earlier, 1 person used 1 computer in general.

Today 1 person alone can use laptop, phone, tablet, smart TV/Watch, IOT devices etc

plus there are companies, cloud providers, Data Centers etc

So 4.3 billion IPv4 addresses could be exhausted after sometime.

How we delayed the problem?

Using NAT (Network Address Translation).

The whole house (Laptop, Phone, TV) uses one single public IP.

How IPv6 further reduces complexity?

An IPv6 IP address is 128 bits long.

Number of addresses 2¹²⁸ = 340 undecillion

This is unimaginably long number.

IPv6 also has the equivalent of private ranges called Unique local addresses (ULA)

fc00::/7
fd00::/8 (is subset of fc00::/7)

fd00::/8 is the portion of ULAs space that is commonly in practice today.

IPv4 private addresses and IPv6 ULAs are analogous:

But they are not completely equivalent. IPv6 ULAs use a unique randomly generated 40 bit global Id which substantially reduces the network collision.

For example:

Network A: fd12:3456:789a::/48

Network B: fdab:cdef:1234::/48

Because the Global ID is randomly generated, the chance that both networks pick the same /48 is very small.

IPv6 address types are separated into different major ranges:

Miscelleneous:

In Azure for a VNet you can have both IPv4 and IPv6 addresses.

A VM may then have IPv4: 10.0.1.4, IPv6: 2001:db8:1234::4

Both addresses can exist on the same NIC.

CIDR in IPv6

2001:db8::/64

First 64 bits = network

Remaining 64 bits = host

Why keep IPv4 if IPv6 is now available?

VM -> Old Phone Number (IPv4)

VM -> New Phone Number (IPv6)

IPv4 and IPv6 are different protocols. An IPv4 only device cannot directly talk to an IPv6 only device.

Dual stack solves this.

Suppose your server has:

IPv4: 10.0.1.4
IPv6: 2001:db8::4

Then old systems use IPv4 to connect to the server, while new systems use IPv6

Conclusion

In this article, we have gone through the different components of Azure Networking and their importance.
In my next article I shall further explore SDR and UDR in more details, NSG etc.

Next Lesson

Excited about collaborating with fellow engineers? Connect with the vibrant group

NextOps: Dev,Cloud & Intelligence

Sayonara! See you soon!

Thank you for reading and see you in my next article.
You could reach out to/follow me in LinkedIn