Azure Virtual Networks and Subnets

You write a small calculator to check the plan, build vnet-saat in a long-lived resource group, check which IPs are taken, and save the IDs for later lessons.

1Check the plan with a subnet calculator

Paste this whole block:

function Get-SubnetInfo {
    param([Parameter(Mandatory)][string]$Cidr)
    $ip, $bits = $Cidr -split '/'
    $b = ([System.Net.IPAddress]$ip).GetAddressBytes()
    [int64]$n = ($b[0] * 16777216) + ($b[1] * 65536) + ($b[2] * 256) + $b[3]
    [int64]$size = [math]::Pow(2, 32 - [int]$bits)
    $start = [math]::Floor($n / $size) * $size
    $toIp = { param($v) '{0}.{1}.{2}.{3}' -f [math]::Floor($v / 16777216), ([math]::Floor($v / 65536) % 256), ([math]::Floor($v / 256) % 256), ($v % 256) }
    [pscustomobject]@{
        Cidr        = $Cidr
        Network     = & $toIp $start
        FirstUsable = & $toIp ($start + 4)
        LastUsable  = & $toIp ($start + $size - 2)
        Total       = $size
        Usable      = $size - 5
    }
}
'10.30.0.0/16','10.30.1.0/24','10.30.250.0/26','10.30.255.0/27' | ForEach-Object { Get-SubnetInfo $_ } | Format-Table

You should see this:

Cidr           Network     FirstUsable LastUsable    Total Usable
----           -------     ----------- ----------    ----- ------
10.30.0.0/16   10.30.0.0   10.30.0.4   10.30.255.254 65536  65531
10.30.1.0/24   10.30.1.0   10.30.1.4   10.30.1.254     256    251
10.30.250.0/26 10.30.250.0 10.30.250.4 10.30.250.62     64     59
10.30.255.0/27 10.30.255.0 10.30.255.4 10.30.255.30     32     27

This output is exact: it’s simple arithmetic. The first usable address is always .4 and the last is one below the broadcast address, because Azure keeps five.

2Create the core resource group and the VNet

Run this:

az group create --name rg-saat-core --tags course=saatvedha-azure lesson=11 keep=true -o none
az network vnet create --resource-group rg-saat-core --name vnet-saat --address-prefixes 10.30.0.0/16 --tags course=saatvedha-azure lesson=11 keep=true -o none
$subnets = @{ 'snet-web' = '10.30.1.0/24'; 'snet-app' = '10.30.2.0/24'; 'snet-data' = '10.30.3.0/24'; 'snet-mgmt' = '10.30.10.0/24' }
foreach ($name in $subnets.Keys) {
    az network vnet subnet create --resource-group rg-saat-core --vnet-name vnet-saat --name $name --address-prefixes $subnets[$name] --default-outbound-access false -o none
}
az network vnet subnet list --resource-group rg-saat-core --vnet-name vnet-saat --query "sort_by(@, &addressPrefix)[].{name:name, prefix:addressPrefix, defaultOutbound:defaultOutboundAccess}" -o table

You should see something like this:

Name       Prefix         DefaultOutbound
---------  -------------  -----------------
snet-web   10.30.1.0/24   False
snet-mgmt  10.30.10.0/24  False
snet-app   10.30.2.0/24   False
snet-data  10.30.3.0/24   False

sort_by sorts the text, so 10.30.10.0 comes before 10.30.2.0, the same as sorting words. --default-outbound-access false makes each subnet private explicitly, so the result is the same whichever API version your tools use. The tag keep=true marks resources that stay between lessons.

3Check which addresses are free

Run this:

az network vnet check-ip-address --resource-group rg-saat-core --name vnet-saat --ip-address 10.30.1.4
az network vnet check-ip-address --resource-group rg-saat-core --name vnet-saat --ip-address 10.30.1.2 --query available

You should see something like this:

{
  "available": true
}
false

.4 is the first address a VM can get. .2 belongs to Azure DNS, so it’s never available. This command is handy before you give a VM a static private IP.

4Save the IDs for later lessons

Run this:

$v = [ordered]@{ ResourceGroup = 'rg-saat-core'; VnetName = 'vnet-saat' }
$v.VnetId = az network vnet show -g rg-saat-core -n vnet-saat --query id -o tsv
foreach ($name in 'snet-web','snet-app','snet-data','snet-mgmt') {
    $v[$name] = az network vnet subnet show -g rg-saat-core --vnet-name vnet-saat -n $name --query id -o tsv
}
$v | ConvertTo-Json | Set-Content C:\azure-lab\vnet-saat.json
(Get-Content C:\azure-lab\vnet-saat.json | ConvertFrom-Json).'snet-web'

You should see something like this:

/subscriptions/6f1c2d3e-.../resourceGroups/rg-saat-core/providers/Microsoft.Network/virtualNetworks/vnet-saat/subnets/snet-web

From now on, labs load this file with $v = Get-Content C:\azure-lab\vnet-saat.json | ConvertFrom-Json instead of looking up IDs again.

✅ Checkpoint: vnet-saat has four private subnets, and C:\azure-lab\vnet-saat.json holds their IDs. Keep both for the rest of the course.