Implement and manage virtual networking
Address space and subnetting
Plan VNet address space so it never overlaps another VNet you might peer with or any on-premises range. Azure reserves five IP addresses in every subnet (network address, gateway, two for DNS, and broadcast), so a /24 yields 251 usable addresses. Some subnets require exact names: GatewaySubnet for VPN and ExpressRoute gateways, AzureFirewallSubnet for Azure Firewall, and AzureBastionSubnet for Bastion.
Filtering traffic
Network security groups contain inbound and outbound rules with priorities from 100 to 4096; the lower number wins. Default rules exist in every NSG (AllowVnetInBound 65000, AllowAzureLoadBalancerInBound 65001, DenyAllInBound 65500). NSGs attach to subnets and NICs, and both are evaluated. Application security groups group NICs so rules can reference a name instead of IP addresses.
Routing and connectivity
System routes handle VNet-local and internet traffic. User-defined routes override them, with next hop types such as virtual appliance, virtual network gateway, virtual network, or internet. Precedence is UDR, then BGP, then system routes. VNet peering is non-transitive: A peered to B and B peered to C does not connect A to C unless you add a route and a gateway, or use a hub firewall. Peering also requires non-overlapping address spaces.
Private access to PaaS
Service endpoints extend VNet identity to a PaaS service over the Azure backbone, and the service firewall allows that subnet. Private endpoints instead give the service a private IP in your subnet through Private Link, which needs a matching private DNS zone to resolve.
Worked rule of thumb
Troubleshoot connectivity in this order: DNS resolution, NSG rules, UDR next hop, then peering or gateway.