Design and Implement Core Networking Infrastructure
Plan the address space first
A virtual network is defined by one or more CIDR blocks; RFC 1918 and public ranges are both permitted. Subnets must fall wholly inside that space, must not overlap with any peered VNet, and each subnet permanently loses five addresses (network, default gateway, two for Azure DNS mapping, broadcast). A /24 therefore yields 251 usable addresses. Reserved subnets have fixed names and minimum sizes: GatewaySubnet (exact spelling, /27 or larger recommended), AzureFirewallSubnet (/26), AzureFirewallManagementSubnet for forced tunnelling, and AzureBastionSubnet (/26). A misnamed subnet is a very common distractor - the gateway or firewall simply refuses to deploy.
Routing behaviour
Azure installs system routes for VNet-local, peered-VNet and internet traffic. User-defined routes override them using next-hop types VirtualNetworkGateway, VirtualNetwork, Internet, VirtualAppliance and None (blackhole). Peering is not transitive: if spoke A must reach spoke B, use direct peering, a hub with gateway transit plus Use remote gateways, or an NVA/Azure Firewall in the hub with UDRs. A peering shows Connected only after both directions are configured.
Name resolution
Azure-provided DNS (168.63.129.16) resolves public names and VNet-internal names only. Private DNS zones handle custom namespaces; VM auto-registration works from one linked VNet, and further VNets link with registration disabled.
Worked example: you need 60 hosts in one subnet. 60 + 5 reserved = 65, so a /26 (62 usable) is too small - pick a /25. Rule of thumb: always round up one prefix size and reserve a spare block per region for future growth.