How many IP addresses does Azure reserve per subnet?

Azure reserves 5 IP addresses in every subnet: the network address (.0), the default gateway (.1), Azure DNS mapping (.2 and .3), and the broadcast address (.255). This is the same count as AWS.

What is the minimum size for GatewaySubnet in Azure?

The GatewaySubnet in Azure must be at least /27 (32 IP addresses, 27 usable). Using /28 is deprecated. For VPN gateways handling many connections or ExpressRoute coexistence, /26 or larger is recommended.

Does the Azure subnet name matter for managed services?

Yes, Azure enforces exact subnet names for certain managed services. The subnet for Azure Firewall must be named exactly 'AzureFirewallSubnet', for Azure Bastion it must be 'AzureBastionSubnet', and for Route Server it must be 'RouteServerSubnet'. Any typo will cause the service deployment to fail.

Azure Subnet Planner

Last reviewed: May 2026

Azure VNet subnet planning involves more than basic CIDR math. Azure reserves 5 IP addresses in every subnet and requires dedicated, correctly sized subnets for managed services. Use the interactive planner below to generate a layout and export Bicep code.

Interactive Azure VNet Subnet Planner

VNet Address Space

Azure Region

Managed service subnets (fixed names required by Azure):

GatewaySubnet VPN/ER

AzureFirewallSubnet FW

AzureBastionSubnet Bastion

ApplicationGatewaySubnet App GW

AzureFirewallManagementSubnet FW Mgmt

RouteServerSubnet Route Server

Workload subnets:

Frontend

Backend

Data

Management

Subnet Name	CIDR	Type	Azure Usable IPs	Notes

Plan your Azure VNet in SubnetSolver →

Azure IP Reservation Rule

Azure reserves 5 IP addresses in every subnet:

.0 — Network address
.1 — Default gateway
.2 & .3 — Azure DNS mapping
.255 — Broadcast address

Required Subnet Minimum Sizes

Azure enforces minimum subnet sizes for its managed services. Deploying into an undersized subnet will fail at provisioning time.

Subnet Name	Minimum Size	Total IPs	Usable After Reservation	Notes
GatewaySubnet	/27	32	27	VPN & ExpressRoute gateways. /28 is deprecated.
AzureFirewallSubnet	/26	64	59	Name must be exactly "AzureFirewallSubnet"
AzureFirewallManagementSubnet	/26	64	59	Required when forced tunneling is enabled
AzureBastionSubnet	/26	64	59	Name must be exactly "AzureBastionSubnet"
ApplicationGatewaySubnet	/26	64	59	/24 recommended for autoscaling v2 SKU
RouteServerSubnet	/27	32	27	Name must be exactly "RouteServerSubnet"

Naming matters: Azure validates exact subnet names for GatewaySubnet, AzureFirewallSubnet, and AzureBastionSubnet. Any typo means the managed service will refuse to deploy.

Open SubnetSolver to verify your Azure CIDRs →

Azure Subnet Planner

Interactive Azure VNet Subnet Planner

Azure IP Reservation Rule

Required Subnet Minimum Sizes

Related Guides