julianobarbosa/devops-network-calculator-for-azure

Azure Network Calculator

Offline Azure network planning tool. Calculates CIDRs, detects overlaps, analyzes VNet utilization, plans AKS networking, and generates Terraform-ready output. Zero external dependencies — uses Python stdlib only.

Quick Start

# What CIDR do I need for 500 hosts?
python3 scripts/network-calc.py calculate --from-hosts 500

# Analyze current VNet
python3 scripts/network-calc.py analyze --from-tfvars terraform/terraform.tfvars

# Validate for overlaps (pre-commit compatible)
python3 scripts/network-calc.py validate --from-tfvars terraform/terraform.tfvars

# Find where to place a new subnet
python3 scripts/network-calc.py first-fit --vnet 10.248.0.0/20 \
  --subnets "10.248.0.0/22,10.248.4.0/22,10.248.8.0/26,10.248.9.0/24" --hosts 500

Commands

| Command | Purpose | Reference | |---------|---------|-----------| | calculate | CIDR info, host sizing, subnet splitting | CIDR Guide | | analyze | VNet utilization, gap analysis | CIDR Guide | | validate | Overlap detection, Azure constraint checks | Azure Constraints | | first-fit | Find optimal placement for new subnet | CIDR Guide | | plan-multi | Multi-environment VNet allocation | Segmentation |

Project Context

This project's current VNet: 10.248.0.0/20 (4,096 IPs, 57.8% utilized)

| Subnet | CIDR | Usable | |--------|------|--------| | GatewaySubnet | 10.248.0.0/22 | 1,019 | | PublicSubnet | 10.248.4.0/22 | 1,019 | | AzureBastionSubnet | 10.248.8.0/26 | 59 | | PrivateSubnet | 10.248.9.0/24 | 251 | | Available gaps | | 1,708 |

Key files: terraform/terraform.tfvars, terraform/networking.tf, terraform/nsg.tf

Azure Quick Reference

• 5 reserved IPs per subnet (.0, .1, .2, .3, broadcast)
• Bastion: min /26 | Gateway: min /27 | Firewall: min /26
• Max subnets/VNet: 3,000 | Max NSG rules: 1,000
• Full reference: Azure Constraints

Reference Guides

| Guide | When to Read | |-------|-------------| | CIDR Calculation Guide | Subnet sizing, gap analysis, overlap detection | | AKS Networking Guide | CNI comparison, pod/service CIDR, node sizing | | Segmentation Patterns | Design patterns, anti-patterns, decision matrices | | Azure Constraints | Hard limits, naming rules, reserved addresses |

Templates

| Template | Purpose | |----------|---------| | VNet Layout | Terraform variable blocks for VNet config | | AKS NSG Rules | NSG rules for AKS workloads | | Multi-Env Plan | Multi-environment planning output |

Execution

Follow the instructions in ./workflow.md.

Gotchas

• Azure reserves 5 IPs per subnet, not 2: A standard /29 gives you 3 usable IPs, not 6. Sizing AKS node pools with /29 starves scaling and surfaces as InsufficientFreeAddressesInSubnet mid-scale.
• GatewaySubnet name is literal: Azure refuses VPN Gateway attach unless the subnet is named exactly GatewaySubnet. Same for AzureBastionSubnet and AzureFirewallSubnet. Typo breaks at apply, not plan.
• AKS Azure CNI eats one subnet IP per pod: A 30-node cluster at 30 pods/node needs 900+ subnet IPs, not 30. Plan --max-pods first; switching CNI later requires cluster rebuild.
• first-fit picks lowest gap, not smartest: Places a /24 in a /22 gap and leaves fragmented unusable /25 leftovers. For long-lived VNets, use plan-multi and reserve growth gaps explicitly.
• CIDR overlap with on-prem fails silently until peering: A 10.0.0.0/16 VNet looks fine alone, but ExpressRoute peering black-holes routes overlapping corporate ranges. Validate against full corporate IPAM.
• NSG rule limit is 1,000 total, not per-direction: Inbound + outbound + default + Azure-auto rules share the budget. Leave headroom or hit a hard wall during scale.