Lab 01 – Virtual Networks & Subnets

⏱️ Total Estimated Time: 50 minutes

Real-Life Scenario

Company: FinServe Solutions

FinServe is migrating to Azure and needs to design their network architecture. They need to create virtual networks with proper subnetting strategy, assign static private IPs for critical services, restrict access to storage using service endpoints, create private connections without exposing data to the internet, and plan IP address space for future growth.

The Challenge: Design a network that isolates workloads, restricts access, and scales without redesign?

❗

Core Learning Objective

VNets are the foundation of Azure networking. You'll learn subnetting strategy, IP planning, service endpoints vs private endpoints, and access restriction patterns. This is essential for designing secure, scalable cloud infrastructure.

Objectives

Prerequisites

Part 1 – Create the VNet and subnets

⏱️ 15 minutes
ℹ️

VNet Fundamentals

A Virtual Network is your private network in Azure. Subnets segment the VNet for organization and security. Each subnet gets a portion of the VNet's address space using CIDR notation.

✓

Step 1: Create Virtual Network and First Subnet

  1. In the Azure Portal, search for Virtual networks > Create
  2. Fill in the Basics tab:
  • Resource group: Create new and name it rg-az104-lab12
  • Name: vnet-hub
  • Region: East US
  1. Click Next: IP Addresses
  2. Configure the address space and first subnet:
  • IPv4 address space: 10.50.0.0/16 (65,536 addresses)
  • Subnet name: subnet-web
  • Subnet address range: 10.50.1.0/24 (256 addresses, ~251 usable)
  1. Click Review + create > Create
  2. Wait for the VNet to be created (typically 1-2 minutes)
❗

Reserved IPs in Subnets

Each subnet reserves 5 IPs: .0 (network), .1 (gateway), .2/.3 (DNS), and broadcast. A /24 (256 IPs) has only ~251 usable IPs for resources. Always account for this when planning.

✓

Step 2: Add Additional Subnets

  1. Navigate to vnet-hub > Subnets (left menu under Settings)
  2. Click + Subnet to add the data subnet:
  • Name: subnet-data
  • Subnet address range: 10.50.2.0/24
  • Click Add
  1. Click + Subnet again to add the management subnet:
  • Name: subnet-mgmt
  • Subnet address range: 10.50.3.0/24
  • Click Add
  1. Verify all three subnets appear in the subnets list

Part 1 Validation

After Part 1

  • VNet vnet-hub created with /16 address space (65,536 addresses)
  • Three subnets created, each with /24 (256 addresses, ~251 usable)
  • You understand CIDR notation and address space planning
  • You know 5 IPs are reserved per subnet

Part 2 – Static private IP

⏱️ 8 minutes
ℹ️

Static vs Dynamic IPs

Dynamic IPs can change when resources restart. Static IPs are permanently assigned to a resource. Critical services (databases, DNS servers) should use static IPs.

✓

Step 1: Create Virtual Machine with Static IP

  1. Search for Virtual machines > Create > Azure virtual machine
  2. In the Basics tab, fill in:
  • Resource group: rg-az104-lab12
  • Virtual machine name: vm-data01
  • Image: Ubuntu 22.04 LTS
  • Size: Standard_B1s (cheapest option)
  • Authentication type: Password (for lab simplicity)
  • Create a username and password (remember these)
  1. Click Next: Disks, then Next: Networking
✓

Step 2: Configure Network Settings

  1. In the Networking tab, configure:
  • Virtual network: vnet-hub
  • Subnet: subnet-data
  • Public IP: None (keep this VM private for security)
  • NIC network security group: Basic
  1. Click Next: Management, then Next: Advanced
  2. In the Advanced tab, find Network Interface section
  3. Set Private IP address assignment: Static
  4. Set the static IP to 10.50.2.10
✓

Step 3: Complete VM Creation

  1. Click Review + create
  2. Review the configuration and click Create
  3. Wait for the VM to be created (typically 2-3 minutes)
  4. Once created, navigate to the VM > Networking and verify static IP 10.50.2.10

Part 2 Validation

After Part 2

  • VM deployed with static private IP within the VNet
  • VM is isolated (no public IP) and only reachable from within VNet
  • You understand static IP assignment for critical services
  • You can secure VMs by removing public IP exposure

Part 3 – Service Endpoints

⏱️ 10 minutes
ℹ️

Service Endpoints Overview

Service Endpoints extend your VNet's identity to Azure services (like Storage) over the Azure backbone. The PaaS resource keeps its public endpoint but can restrict access to specified subnets.

✓

Step 1: Enable Service Endpoint on Subnet

  1. Navigate to vnet-hub > Subnets > select subnet-data
  2. Scroll down to Service endpoints section
  3. Click + Add in the Service endpoints area
  4. In the dropdown, select Microsoft.Storage
  5. Click Add to enable the service endpoint
  6. Save the subnet configuration
✓

Step 2: Create Storage Account

  1. Search for Storage accounts > Create
  2. Fill in the Basics tab:
  • Resource group: rg-az104-lab12
  • Storage account name: stoaz104lab12 (must be globally unique, 3-24 chars, lowercase only)
  • Region: East US
  • Performance: Standard
  • Redundancy: Locally-redundant storage (LRS)
  1. Click Review + create > Create
❗

Storage Account Naming

Storage account names must be globally unique (3-24 characters, lowercase letters and numbers only). If your choice is taken, add numbers until it's unique.

✓

Step 3: Restrict Storage Access via Service Endpoint

  1. Navigate to your storage account > Networking (under Security + networking in left menu)
  2. Under Public network access, select Enabled from selected virtual networks and IP addresses
  3. Under Virtual networks, click + Add existing virtual network
  4. Select:
  • Subscription: Your current subscription
  • Virtual network: vnet-hub
  • Subnets: subnet-data
  1. Click Add
  2. Set Default action to Deny
  3. Click Save

Part 3 Validation

After Part 3

  • Service endpoint enabled on subnet to extend VNet identity to Storage
  • Storage account public access restricted to only the specified subnet
  • You understand how service endpoints add network security without private IPs
  • All other internet access to storage is denied

Part 4 – Private Endpoint

⏱️ 8 minutes
ℹ️

Private Endpoints vs Service Endpoints

Service Endpoints: Extend VNet identity to service, service keeps public endpoint. Private Endpoints: Give the PaaS service a private IP inside your VNet—fully removes public exposure.

✓

Step 1: Create Private Endpoint

  1. Search for Private endpoints > Create
  2. Fill in the Basics tab:
  • Resource group: rg-az104-lab12
  • Name: pe-storage
  • Region: East US
  1. Click Next: Resource
✓

Step 2: Connect to Storage Resource

  1. In the Resource tab, configure:
  • Connection method: Connect to an Azure resource in my directory
  • Resource type: Microsoft.Storage/storageAccounts
  • Resource: Select your storage account stoaz104lab12
  • Target sub-resource: blob
  1. Click Next: Virtual Network
✓

Step 3: Configure VNet and DNS

  1. In the Virtual Network tab, configure:
  • Virtual network: vnet-hub
  • Subnet: subnet-mgmt
  1. Click Next: DNS
  2. Enable Private DNS integration: Yes (auto-creates DNS zone for private resolution)
  3. Click Review + create > Create
  4. Wait for the private endpoint to be created (typically 1-2 minutes)

Part 4 Validation

After Part 4

  • Storage account now has a private IP endpoint inside subnet-mgmt
  • Traffic to storage never traverses the public internet
  • Private DNS resolves storage FQDN to private IP
  • You understand the difference: Service Endpoints (public + restricted) vs Private Endpoints (fully private)

Part 5 – IP address planning exercise

⏱️ 10 minutes
ℹ️

IP Planning Strategy

Plan your address space to accommodate current and future growth. Subnets cannot be easily resized after creation, so plan generously. Different services require different subnet sizes.

✓

Step 1: Review Address Space Allocation

  1. Review your existing infrastructure based on 10.50.0.0/16:
  • subnet-web: 10.50.1.0/24 (250+ hosts)
  • subnet-data: 10.50.2.0/24 (60+ hosts)
  • subnet-mgmt: 10.50.3.0/24 (20+ hosts)
  1. Remaining available space: 10.50.4.0 - 10.50.255.0 (much of the /16 is still unused)
✓

Step 2: Design for Growth

  1. Plan subnets for future requirements:
  • AzureBastionSubnet: minimum /26 (64 addresses)
  • Example: 10.50.4.0/26
  • GatewaySubnet: recommended /26 or larger (for VPN/ExpressRoute)
  • Example: 10.50.4.64/26
  • AKS cluster subnet: 1,000+ hosts → /22 (1,024 addresses)
  • Example: 10.50.8.0/22
  1. Verify: No overlapping address ranges
✓

Step 3: Understand Reserved Subnet Names

  1. Azure has reserved subnet names for specific services:
  • GatewaySubnet: Required for VPN gateways and ExpressRoute
  • AzureBastionSubnet: Required for Azure Bastion (RDP/SSH access)
  • AzureFirewallSubnet: Required for Azure Firewall NVA
  1. These names must be exact—you can only deploy those services in subnets with these names
  2. Plan their size accordingly based on expected deployment scale

Part 5 Validation

After Part 5

  • You designed IP address space accommodating current and future needs
  • You understand CIDR notation and subnet sizing (/24, /26, /22, etc.)
  • You know reserved subnet names and their purposes
  • You can plan growth without redesigning the entire VNet

Success Criteria

Lab Completion Checklist

  • VNet vnet-hub created with /16 address space (10.50.0.0/16)
  • Three subnets created with no overlapping address ranges
  • VM vm-data01 deployed with static private IP 10.50.2.10 in subnet-data
  • Service endpoint (Microsoft.Storage) enabled on subnet-data
  • Storage account created and restricted via service endpoint to subnet-data only
  • Private endpoint created for storage in subnet-mgmt with private DNS integration
  • IP address planning exercise completed for future growth

Cleanup

If you want to delete the resources created in this lab:

  1. Navigate to Resource groups > select rg-az104-lab12
  2. Click Delete resource group
  3. Confirm the deletion
  4. All resources (VNet, subnets, VMs, storage account, endpoints) will be deleted

Exam Tips