Azure Vnets and Subnets best practices

Question

Azure Vnets and Subnets best practices

Lance Lyons 86

Hi, Trying to figure out some best practices for Azure Virtual Network/subnet design.

we have 3 subscriptions (sandbox, non production, production). We are going to be deploying to non prod and production using bicep/arm templates.

each subscription has a vnet with 65536 addresses.

we are thinking of subnets with 256 addresses.

there is currently no peering between production and non production and sandbox.

we currently have dedicated VPNs to each subscription but are in the process of setting up an express route.

i noticed with some of the bicep templates for vnets and subnets that are in the Microsoft Azure quick templates that common subnets are created for webapps, functions, private end points, databases, etc

is there a best practice for the different subnets?

From an automation perspective should subnets in the different subscriptions use similar names?

is there any documentation related to this scenario?

thanks in advance

Answer 1

msrini-MSFT 6,231 Microsoft Employee

Hi,

If you want Prod and non-prod to be connected to each other, maybe in future, then plan IPAM in such a way that there are no overlaps between them.

You can have a same name for subnets but for the ease of figuring out which environment you are working on, you can follow some naming convention. From my perspective subnets name can be the same but make sure your VNET name is named with a conversion where you can identify your environment.

Regards,

Karthik Srinivas

Lance Lyons 86 Reputation points

2023-03-08T17:40:23.33+00:00

Thanks Karthik, when you mean "VNET name is named with a conversion" are you saying doing something like this for vnets

prod_vnet
nonprod_vnet

sandbox_vnet

and similar for subnets?
msrini-MSFT 6,231 Reputation points Microsoft Employee

2023-03-08T17:44:19.4533333+00:00

Its "naming convention". Got a typo there. yes, you are correct. Something like vnet1-prod-eastus. But as far as subnet goes, I think its upto you. You can either do Appserver-subnet or prod-appserver-subnet
Lance Lyons 86 Reputation points

2023-03-08T17:45:53.41+00:00

Is there any best practices on the usages of subnets.

i saw from some bicep files in quick templates that microsoft was creating a subnet for function apps and one for private end points.

should there be different ones for different types of azure resources?
msrini-MSFT 6,231 Reputation points Microsoft Employee

2023-03-08T18:43:49.6766667+00:00

There are few services which requires you to create a delegated subnet and not deploy any other resources on that subnet other than the resource which got delegated. And Azure firewall needs subnet to be named as AzureFirewallSubnet. Gateway subnet needs to be named as "GatewaySubnet". So you will need to read through the doc of the respective resource which you will deploy and then proceed according to the recommendation provided

Azure Vnets and Subnets best practices

0 additional answers

Activity