虚拟网络(VN)地址空间与子网匹配问题咨询及原理疑问

Great question! Let's break down exactly what's happening here, starting with the root cause of your initial error.

First Configuration: VN 10.1.0.0/16 + Subnet 10.0.1.0/24 #

Let's map out the IP ranges for each:

• The virtual network (VN) 10.1.0.0/16 uses a subnet mask of 255.255.0.0, so it covers all IPs from 10.1.0.0 to 10.1.255.255 (every address starting with 10.1.x.x).
• Your subnet 10.0.1.0/24 covers 10.0.1.0 to 10.0.1.255—this is part of the 10.0.x.x range, which is completely outside the VN's address space.

Cloud platforms enforce a strict rule: a subnet's entire IP range must be fully contained within the parent virtual network's address space. Since your subnet didn't meet this requirement, you got the "subnet not contained within virtual network address space" error.

Second Configuration: VN Changed to 10.0.0.0/24 #

Quick reality check: If you kept the subnet as 10.0.1.0/24, this still wouldn't work—10.0.0.0/24 only covers 10.0.0.0 to 10.0.0.255. So I suspect you either:

• Adjusted the subnet to match the new VN range (e.g., 10.0.0.0/24), or
• Had a small typo and meant to set the VN to 10.0.0.0/16 (which covers all 10.0.x.x addresses, including your 10.0.1.0/24 subnet).

Either way, the critical fix was ensuring your subnet's IP range fully fit inside the virtual network's address space—hence the successful setup.

Here are the core rules that apply to most cloud platforms (like Azure VNet, AWS VPC, etc.):

• Subnets must be fully embedded: Every subnet's CIDR block must sit entirely within one of the VN's address space blocks. No partial overlaps or out-of-range subnets allowed.
• Multiple non-overlapping CIDRs allowed: You can add multiple distinct address blocks to a single VN (e.g., 10.0.0.0/16 and 192.168.1.0/24), but these blocks can't overlap with each other.
• Use private IP ranges (recommended): Stick to RFC 1918 private address spaces to avoid conflicts with public IPs:
  • 10.0.0.0/8 (10.0.0.0 – 10.255.255.255)
  • 172.16.0.0/12 (172.16.0.0 – 172.31.255.255)
  • 192.168.0.0/16 (192.168.0.0 – 192.168.255.255)
• No overlapping VN ranges: Virtual networks in the same region/environment can't have overlapping address spaces—this would break routing between them.
• Prefix length limits: For IPv4, VN address spaces typically use prefix lengths from /8 to /30. /31 is sometimes allowed for point-to-point links, but /32 isn't supported (you can't split a single IP into a subnet).

内容的提问来源于stack exchange，提问作者Sanika Kalvikatte