Split and join subnets visually. Click a row to divide or merge.
Minimum and recommended sizes for Azure subnets that host platform services. Sizes include the 5 IPs Azure reserves in every subnet. With Azure selected, type one of the required names (GatewaySubnet, AzureBastionSubnet, …) in the Name column and the splitter checks the subnet’s size and flags typos.
| Subnet | Minimum | Recommended | Notes |
|---|---|---|---|
| GatewaySubnetName | /29 | /27 | /29 only for the Basic VPN Gateway SKU; all other SKUs need /27 or larger. Use /26 or larger to connect 16 ExpressRoute circuits. ExpressRoute + VPN coexistence also needs a larger subnet. |
| AzureFirewallSubnetName | /26 | /26 | Must be /26. Sufficient for all scaling scenarios. |
| AzureFirewallManagementSubnetName | /26 | /26 | Required when the Management NIC is enabled (forced tunneling, packet capture). Always enabled on the Basic SKU. |
| AzureBastionSubnetName | /26 | /26 | /26 minimum for deployments since November 2, 2021. /26 or larger for host scaling. Not needed for the Developer SKU. |
| RouteServerSubnetName | /26 | /26 | Dedicated subnet. No NSG or UDR support. |
| Application Gateway v2 | Varies | /24 | 1 IP per instance + 1 private frontend IP + 5 Azure-reserved. Up to 125 instances; size for your maximum instance count. |
| API Management (v2) | /27 | /24 | 2 IPs per scale unit. /24 recommended to allow scaling. |
| Azure Container Instances | /24 | /24 | Delegated subnet, container groups only. Smaller subnets cause “subnet full” deployment failures. |
Each subnet links to its Microsoft Learn source. Last verified September 2026.
AWS reserves 5 IP addresses in every VPC subnet: the network address (.0), the VPC router (.1), the DNS server (.2), a future-use address (.3), and the broadcast address (the last address in the block). A /24 subnet with 256 addresses therefore has 251 usable IPs.
Azure reserves 5 IP addresses per subnet: the network address, the default gateway (.1), two addresses mapped for Azure DNS (.2 and .3), and the broadcast address (the last address in the block).
Google Cloud reserves 4 IP addresses per subnet: the network address, the default gateway (.1), a second-to-last reserved address, and the broadcast address (the last address in the block).
Each cloud provider reserves a different number of addresses in every subnet for its own networking services, such as the default gateway and DNS. Select a provider above and this tool automatically adjusts the usable host count and lists exactly which addresses are reserved and why.
The AzureBastionSubnet must be /26 or larger for Azure Bastion deployments created on or after November 2, 2021. A /26 or larger subnet also leaves room for host scaling. The Bastion Developer SKU doesn't need a dedicated subnet.
The smallest GatewaySubnet is /29, but it's only allowed for the Basic VPN Gateway SKU. All other SKUs need /27 or larger, and connecting 16 ExpressRoute circuits requires /26 or larger.