Last reviewed: May 2026
Both /26 and /27 are common choices, and the right one depends less on host counts than on where the block sits in your wider plan. Here is the direct comparison, then the practical guidance.
| Prefix | Total IPs | Usable (standard) | AWS usable | Azure usable | GCP usable | Typical use |
|---|---|---|---|---|---|---|
| /26 | 64 | 62 | 59 | 59 | 60 | Service subnet, Azure Firewall/Bastion minimum |
| /27 | 32 | 30 | 27 | 27 | 28 | Small service tier, Azure Gateway minimum |
AWS and Azure reserve 5 addresses per subnet; GCP reserves 4. Those columns are what you can actually assign to workloads.
Anything on Azure that touches a managed service. AzureFirewallSubnet, AzureBastionSubnet and Application Gateway all require a /26 minimum — a /27 is rejected outright at deployment time, which is one of the most common first-time Azure networking failures.
Infrastructure subnets with a known, small, fixed host count: NTP, DNS, jump hosts, load balancer front-ends. A /27 leaves 30 usable addresses, which is comfortable for a service tier that will never scale horizontally.
Prefix choice is a downstream decision. Start from the VPC or VNet block, divide it per region and per availability zone, and only then choose subnet sizes. The Cloud VPC & VNet CIDR Planning Guide covers that top-down process, and the free subnet finder will tell you which of these sizes actually fits in the space you have left.
Neither is better in the abstract. A /26 has more usable addresses and a /27 conserves address space. Choose based on expected host count, provider minimums for the service involved, and how much room the parent block has left.
Exactly 2, because the prefix difference is 1 bit and 2^1 = 2.
Both reserve five addresses in every subnet: the network address, the default gateway, two for internal DNS and future use, and the broadcast address. GCP reserves four. A /26 therefore yields fewer assignable addresses in cloud than the textbook figure.