Three rooms, three doors
The momo shop's site has three tiers: web servers facing the Internet, app servers with the business logic, and a database holding every customer's phone number. If someone breaks into a web server, they should hit a locked door before they reach the database.
In this project you'll build the shop's virtual network: a filter that decides each packet the way Azure does, then the rules that keep the database reachable only from the app tier.
VNets and subnets
A VNet has an address space in private CIDR notation, such as 10.1.0.0/16, and is split into subnets: 10.1.1.0/24 for web, 10.1.2.0/24 for app, 10.1.3.0/24 for data. Azure reserves five addresses in every subnet. Resources in one VNet can talk to each other by default; VNet peering joins VNets, even across regions; a VPN gateway or ExpressRoute links your office network.
Never change a VM's IP settings from inside its operating system — the network is software-defined, so you'd cut yourself off. Configure everything through ARM. To spread traffic, put an Azure Load Balancer (layer 4, TCP/UDP) or an Application Gateway (layer 7, HTTP with a web application firewall) in front of identical VMs. Load balancers send health probes from the special address 168.63.129.16.
Plan address spaces that don't overlap with your office or other VNets — overlapping ranges can't be peered or connected later.