Prevent overlapping virtual network address spaces with Azure Policy and IPAM

Azure Virtual Network Manager helps you centrally manage virtual networks across your organization. While it provides governance for VNets, it doesn't automatically prevent overlapping address spaces during virtual network creation or updates. You can enforce nonoverlapping address spaces by combining Azure Policy with IP Address Management (IPAM) pools, ensuring network connectivity without IP conflicts in your environment.

How the policy prevents overlapping address spaces

An IPAM pool hands out nonoverlapping CIDR prefixes to the virtual networks that allocate from it. A policy definition that requires every virtual network to hold an allocation from a designated IPAM pool therefore prevents overlapping address spaces, because a virtual network can't be created or updated without a nonoverlapping prefix from that pool.

The sample policy definition in the next section requires that any virtual network (Microsoft.Network/virtualNetworks) in the scope of the policy definition has an IPAM pool prefix allocation from one of two specified pools. If a virtual network lacks an allocation from either pool, the policy denies the creation or update of the virtual network.

Sample policy definition

Replace <subscriptionID> and <resourceGroupName> with the values for the network manager that hosts your IPAM pools, and replace the pool names with your own.

{
  "mode": "All",
  "parameters": {},
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "type",
          "equals": "Microsoft.Network/virtualNetworks"
        },
        {
          "not": {
            "anyOf": [
              {
                "field": "Microsoft.Network/virtualNetworks/addressSpace.ipamPoolPrefixAllocations[*].pool.id",
                "equals": "/subscriptions/<subscriptionID>/resourceGroups/<resourceGroupName>/providers/Microsoft.Network/networkManagers/network-manager/ipamPools/IPAM-pool-2"
              },
              {
                "field": "Microsoft.Network/virtualNetworks/addressSpace.ipamPoolPrefixAllocations[*].pool.id",
                "equals": "/subscriptions/<subscriptionID>/resourceGroups/<resourceGroupName>/providers/Microsoft.Network/networkManagers/network-manager/ipamPools/IPAM-pool-3"
              }
            ]
          }
        }
      ]
    },
    "then": {
      "effect": "deny"
    }
  }
}

What the policy definition checks

The policy definition performs the following actions:

• Resource check - It applies only to virtual networks (Microsoft.Network/virtualNetworks).
• Pool allocation check - It verifies if the virtual network has an IPAM pool allocation from either:
  • IPAM-pool-2, or
  • IPAM-pool-3.
• Enforcement - If neither allocation is present, the policy denies the action. And in order to have pool allocation, IP prefixes must be nonoverlapped within the pool, as such no VNets with overlapped prefixes can be created.

Implementation steps of the policy

With the policy definition, you can enforce nonoverlapping address spaces in your Azure environment. Follow these steps to implement the policy:

1. Identify existing network manager and IPAM pools - Ensure you have an existing Azure Virtual Network Manager instance and at least two IPAM pools created. For more information, see Create a virtual network manager and Create an IPAM pool.
2. Create an Azure Policy definition - Create a policy definition in Azure Policy using the JSON example. You can do this through the Azure portal, Azure CLI, or PowerShell. For more information, see Create and assign a policy definition.
3. Assign the policy - Assign the policy to a specific scope (subscription or management group) where you want to enforce the nonoverlapping address space rule.
4. Test the policy - Create or update a virtual network without an IPAM pool allocation from the specified pools. The operation should be denied if the policy is working correctly.

Next steps