Azure Vnet Private IP Ranges

Question

I've not from a networking background. I'm data platform solution architecture and data/ai engineer. Since distributed data processing and scale out using containers has come into my world I've decided to bite the bullet and learn IP fundamentals so I can build clusters.

I've been doing lots of training but have a simple and relatively dumb question but finding simple answers to simple questions seems quite hard on the topic networking!

I have 2 Azure VNets for example in my subscription on the same domain does it matter if a subnet on 1 vnet overlaps a subnet on other vnet? Presumably that would only be a problem when they're peered together. Does the vnet ring fence it's private ip ranges?

Answer 1

"I have 2 Azure VNets for example in my subscription on the same domain does it matter if a subnet on 1 vnet overlaps a subnet on other vnet? "*Presumably that would only be a problem when they're peered together."

To be exact the answer is "NO". It doesn't really matter as long as the particular subnet doesn't require to communicate with another subnet in a different VNET. If you have a plan to configure VNET peering at some point then there are certain best practices that you should have followed to avoid conflicts. However, following are the best practices to implement an enterprise network in Azure.

1. Start from scratch by documenting your subnets along with subnet mask in each VNET.
2. There shouldn't be overlapping IP address ranges if your network design contains VNET peering, custom routing, Azure firewall, Azure load balancer etc.
3. There shouldn't be overlapping IP address ranges if you are planning to implement Site to Site VPN between your azure tenant and on-premises network.

"Does the vnet ring fence it's private ip ranges?"

Yes, subenets within a VNET can communicate with each other without any custom routes with the help of default systems routes. But subnets in VNET-A cannot communicate with subnets in VNET-B if there's no VNET peering configured between VNET-A and VNET-B.

Hope this answer cleared out the doubts.

Answer 2

"I have 2 Azure VNets for example in my subscription on the same domain does it matter if a subnet on 1 vnet overlaps a subnet on other vnet? "*Presumably that would only be a problem when they're peered together."

Correct. Your subnet address space can overlap on different networks (VNETS). But if you ever need them to talk to each other with out some pretty complex routing changes or redeploying your resources then creating unique address space per subnet is recommend - deploy unique address space.

Struggling to understand why you require the same address space in different VNETs , there is plenty of address space available to ensure they do not overlap even if using ARM templates i.e use variables to deploy.

"Does the vnet ring fence it's private ip ranges?"

Essentially yes, RFC 1918 “Address Allocation for Private Internets" defines that private address space does not route out of a private network. I am no expert to be fair, but really interesting link here

https://whatis.techtarget.com/definition/RFC-1918

RFC 1918

Request for Comment 1918 (RFC 1918), “Address Allocation for Private Internets,”is the Internet Engineering Task Force (IETF) memorandum on methods of assigning of private IP addresses on TCP/IP networks.

Along with NAT (network address tunneling), RFC 1918 facilitates expansion of the usable number of IP addresses available under IPV4, as a stopgap solution to prevent the exhaustion of public IPs available before the adoption of IPV6. It’s not necessary to register private IPs with a Regional Internet Registry (RIR), which simplifies setting up private networks.

RFC 1918 was used to create the standards by which networking equipment assigns IP addresses in a private network. A private network can use a single public IP address. The RFC reserves the following ranges of IP addresses that cannot be routed on the Internet:

10.0.0.0 - 10.255.255.255 (10/8 prefix) 172.16.0.0 - 172.31.255.255 (172.16/12 prefix) 192.168.0.0 - 192.168.255.255 (192.168/16 prefix) IP addresses within these ranges can be assigned within a private network; each address will be unique on that network but not outside of it. Private IP addresses can't be communicated with directly by external computers because they are not globally unique and, as such, not addressable on the public Internet.

Computers on the inside of the network can communicate with the Internet through NAT. NAT translates an IP address used within one network to a different IP address known within another network. Typically, a company maps its local inside network addresses to one or more global outside IP addresses and unmaps the global IP addresses on incoming packets back into local IP addresses.

Answer 3

no, its doesn't. But you won't be able to peer\vpn them together. So they are effectively isolated from each other forever (or at least until you fix that).