> For the complete documentation index, see [llms.txt](https://docs.tessell.com/tessell/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.tessell.com/tessell/governance/networks-doc.md).
# Networks
The Networks app, part of the Governance app family, allows you to manage virtual networks and subnets in a registered cloud subscription. You can create new networks, register existing ones, configure peering, and set up connectivity. If you skipped adding a network when you registered a subscription, you can add it later using this app.
***
## Key concepts
### Virtual networks and subnets
A virtual network is the foundational networking construct where Tessell provisions and runs your database VMs. In AWS, this is a Virtual Private Cloud (VPC). In Azure, this is a Virtual Network (VNet). Each virtual network has a defined IP address range (CIDR block) and is scoped to a single cloud region.
A virtual network is further divided into subnets, each with their own CIDR block. Tessell supports both private and public subnets:
* **Private subnet** – Database VMs are placed in private subnets by default.
* **Public subnet** – Optional. Required only when a database service needs to be accessible from the public internet.
On AWS, subnets are associated with availability zones. On Azure, subnets are region-scoped within the VNet.
### Control plane and data plane connectivity
When you add a network, you choose the communication mode between the Tessell Control Plane (CP) and the cloud Data Plane (DP) where your databases run.
**Private CP-DP**
Control Plane and Data Plane communication happens over a private network using cloud-native private link technology — AWS PrivateLink on AWS and Azure Private Link on Azure. Traffic does not traverse the public internet. This mode eliminates public internet exposure, reduces latency, and simplifies compliance for regulated workloads. Configuring private endpoints is required as part of the network setup.
**Public CP-DP**
Control Plane and Data Plane communication goes over the public internet, with outbound traffic routed through a NAT Gateway. Network Security Group (NSG) rules or security group rules are required to explicitly allow outbound traffic to the required ports and services.
### Network readiness check
When you register a network, Tessell runs a network readiness check to validate that the network is properly configured and ready to host database services. This check validates connectivity to the Tessell Control Plane as well as to the cloud components that database services depend on. On AWS, this includes S3, Secrets Manager, EC2, and CloudWatch. On Azure, this includes AQS, Key Vault, and the Log Analytics workspace.
If a check fails — for example, because a firewall rule blocks access to one of these components — the registration fails with a readiness error. Some checks are marked as skippable. If a check is skippable, you can skip it and continue with registration. The network moves to an active state only after all mandatory checks pass.
***
## Prerequisites
Before you add a network, ensure the following:
* You have registered your cloud subscription in the [Subscriptions](/tessell/governance/subscriptions.md) app under the Governance app family.
***
## Networks dashboard
To access the Networks dashboard, select **Networks** under the Governance app family in the left navigation bar. The dashboard lists all available networks.
**Filters**
You can filter the networks list using the following fields:
* **Search** — Specify a virtual network name to search for a specific network. The list filters automatically as you type.
* **Subscription** — Select a specific subscription from the dropdown list. By default, all subscriptions accessible to you are listed. Available options are All, or the subscriptions added to your account.
* **Status** — Select a network status from the dropdown list. Available options are All, Creating, Active, Disabled, or Failed.
* **Maturity** — Select a maturity status. Available options are All, Draft, Published, or Unpublished.
* **Owner** — Select a username to view networks created by a specific user.
* **Clear** — Select this to clear all selected filters and return to the default view.
**Networks table**
The networks table displays the following columns:
* **Name** — The virtual network name registered with Tessell.
* **IP Address Range** — The IP address range or CIDR block of the virtual network.
* **Cloud/Region** — The cloud provider and region selected for the virtual network.
* **Status** — The current status of the virtual network: Creating, Active, Disabled, or Failed.
* **Maturity** — The maturity status of the virtual network: Draft, Published, or Unpublished.
* **Ellipsis icon** — Select the ellipsis icon to access the following options:
* **Change maturity** — Select this option to change the maturity status of your virtual network. In the **Change maturity status** dialog box, choose Draft, Publish, or Unpublish from the **Status** dropdown list, then select **Update**.
* **Delete** — Select this option to delete the virtual network. In the confirmation dialog box, select the check box to confirm, then select **Delete**.
**Fig 1: Networks dashboard**
***
## Add a network
1. Select **Add Network** in the top-right corner of the page. The **Add Network** window opens.
2. From the **Tessell Subscription** dropdown list, select a registered cloud subscription.
3. From the **Select Region** dropdown list, select a cloud region.
4. If you have already executed the ARM/CloudFormation template, toggle the switch and do the following:
1. Paste the ARM/CloudFormation template output in the box provided.
2. Select **Create**.
5. If the ARM/CloudFormation template has not been executed, follow the steps for your cloud provider below.
**Note:** If Tessell was granted permission to manage virtual networks during subscription onboarding, Tessell can create a virtual network without requiring an ARM or CloudFormation template.
**Fig 2: Select subscription and region**
***
### Adding a network in Azure
Choose whether to enable private communication between the Tessell Control Plane (CP) and the cloud Data Plane (DP).
***
#### CP-DP private connectivity enabled
**Add a new network**
1. In the **Network Details** section, select **Add new network**.
2. Provide the following details:
* **Network Name** — Specify the VNet name.
* **CIDR Range** — Specify the IP address range for the new VNet.
* **Private Subnet Name** — Specify the private subnet name.
* **Private Subnet CIDR** — Specify the IP address range for the private subnet.
3. In the **Endpoint Configuration** section, specify the following:
* **Tessell Control Plane endpoint name** — Specify the name of the Azure private endpoint from the Data Plane VNet for connecting to the Private Link Service in the Tessell Control Plane.
**Fig 3: Azure add network and private CP-DP**
**Register an existing network**
**Register from a different resource group (account not registered on Tessell)**
1. In the **Network Details** section, select **Register existing network**.
2. Provide the following details:
* **Virtual Network Name** — Specify the name of the VNet in Tessell for reference.
* **Virtual Network ID** — Specify the Resource ID of the existing VNet.
* **Private Subnet ID** — Specify the Resource ID of the subnet.
3. In the **Endpoint Configuration** section, do one of the following:
**To add new endpoints:**
* **Tessell Control Plane endpoint name** — Specify the name of the Azure private endpoint from the Data Plane VNet for connecting to the Private Link Service in the Tessell Control Plane.
**To register existing endpoints:**
* **Tessell Control Plane endpoint name** — Specify the Resource ID of the private endpoint in the Data Plane VNet attached to the Control Plane Private Link Service.
**Fig 4: Azure register network from different resource group (private CP-DP)**
**Register from the same resource group (account registered on Tessell)**
1. From the **Network** dropdown list, select a VNet from the available VNets in the account registered on Tessell.
2. From the **Private Subnet** dropdown list, select a private subnet in the selected VNet.
3. In the **Network Name** field, specify the name of the VNet in Tessell for reference.
4. In the **Endpoint Configuration** section, do one of the following:
**To add new endpoints:**
* **Tessell Control Plane endpoint name** — Specify the name of the Azure private endpoint from the Data Plane VNet for connecting to the Private Link Service in the Tessell Control Plane.
**To register existing endpoints:**
* **Tessell Control Plane endpoint name** — Specify the Resource ID of the private endpoint in the Data Plane VNet attached to the Control Plane Private Link Service.
**Fig 5: Azure register network from same resource group (private CP-DP)**
***
#### CP-DP private connectivity disabled
**Add a new network**
1. In the **Network Details** section, select **Add new network**.
2. Provide the following details:
* **Network Name** — Specify the VNet name.
* **CIDR Range** — Specify the IP address range for the new VNet.
* **Private Subnet Name** — Specify the private subnet name.
* **Private Subnet CIDR** — Specify the IP address range for the private subnet.
3. To create a database service with public access in the VNet, toggle **Public Access** and provide the following:
* **Public Subnet Name** — Specify the public subnet name.
* **Public Subnet CIDR** — Specify the IP address block (CIDR) for the public subnet.
**Fig 6: Azure add network and public CP-DP**
**Register an existing network**
**Register from a different resource group (account not registered on Tessell)**
1. In the **Network Details** section, select **Register existing network**.
2. Provide the following details:
* **Virtual Network Name** — Specify the name of the VNet in Tessell for reference.
* **Virtual Network ID** — Specify the Resource ID of the existing VNet.
* **Private Subnet ID** — Specify the Resource ID of the subnet.
3. To create a database service with public access in the VNet, toggle **Public Subnets** and specify the following:
* **Public Subnet ID** — Specify the Resource ID of the existing public subnet.
**Fig 7: Azure register network from different resource group (public CP-DP)**
**Register from the same resource group (account registered on Tessell)**
1. From the **Network** dropdown list, select a VNet from the available VNets in the account registered on Tessell.
2. From the **Private Subnet** dropdown list, select a private subnet in the selected VNet.
3. To create a database service with public access in the VNet, toggle **Public Subnets** and select a public subnet from the **Public Subnet** dropdown list.
4. In the **Network Name** field, specify the name of the VNet in Tessell for reference.
**Fig 8: Azure register network from same resource group (public CP-DP)**
***
### Adding a network in AWS
Choose whether to enable private communication between the Tessell Control Plane (CP) and the cloud Data Plane (DP).
***
#### CP-DP private connectivity enabled
**Add a new network**
1. In the **Network Details** section, select **Add new network**.
2. Provide the following details:
* **Network Name** — Specify the VPC name.
* **CIDR Range** — Specify the IP address range for the new VPC.
3. In the **List of Availability Zones** pane, a list of availability zones for the selected region is displayed. You can add more availability zones if they are available.
4. From the **Availability Zone** dropdown list, select an availability zone for the new subnets.
5. Provide the following subnet details:
* **Private Subnet Name** — Specify the private subnet name.
* **Private Subnet CIDR** — Specify the IP address range for the private subnet.
**To create a private subnet group:**
1. Select **Create a private subnet group**. The **Private Subnet Group** dialog box opens.
2. Specify a name for the group in the **Name your Group** field.
3. Provide details for the first private subnet:
* **Private Subnet Name 1** — Specify the subnet name.
* **Private Subnet CIDR 1** — Specify the IP address range.
4. Provide details for the second private subnet:
* **Private Subnet Name 2** — Specify the subnet name.
* **Private Subnet CIDR 2** — Specify the IP address range.
5. Select **+Add Subnet** to add more private subnets to the group.
6. Select **Add** to create the private subnet group.
7. To remove an existing private subnet group, select **Remove Group**.
#### Endpoint configuration
6. Provide the following:
* **AWS Endpoint Principal ID** — Specify the IAM role or user ARN. This allows Tessell to grant visibility on the Tessell Control Plane endpoint services.
**AWS endpoints:**
* **SQS** — Specify the name of the SQS endpoint required to push Tessell-related logs to SQS.
* **SQS Security Group** — Specify the name of the security group attached to the SQS endpoint.
* **Secret Manager** — Specify the name of the Secret Manager endpoint required to access database-related secrets.
* **Secret Manager Security Group** — Specify the name of the security group attached to Secret Manager.
* **CloudWatch** — Specify the name of the CloudWatch endpoint required to push database engine logs to CloudWatch.
* **CloudWatch Security Group** — Specify the name of the security group attached to CloudWatch.
* **EC2** — Specify the name of the EC2 service endpoint required to perform EC2 operations for the SQS server.
* **EC2 Security Group** — Specify the name of the security group attached to the EC2 service.
* **Tessell Control Plane** — Specify the name of the AWS endpoint attached to the Tessell Control Plane endpoint service for CP-DP communication.
* **Tessell Control Plane Security Group** — Specify the name of the security group attached to the Tessell Control Plane endpoint.
**Gateway endpoint:**
* **S3 Gateway** — Specify the name of the S3 gateway endpoint required to connect to the S3 service for snapshots, PITR logs, and related operations.
**Fig 9: AWS add network and private CP-DP**
**Register an existing network**
1. In the **Network Details** section, select **Register existing network**.
2. From the **Network** dropdown list, select a VPC from the available VPCs in the account registered on Tessell.
3. In the **Availability Zone** column, select an availability zone from the existing list.
4. In the **Private Subnet** column, select a private subnet from the existing list.
5. In the **Network Name** field, specify the name of the VPC in Tessell for reference.
#### Endpoint configuration
1. Specify the **AWS Endpoint Principal ID** — the IAM role or user ARN that allows Tessell to grant visibility on the Tessell Control Plane endpoint services.
**To add new endpoints:**
* **SQS** — Specify the name of the SQS endpoint required to push Tessell-related logs to SQS.
* **SQS Security Group** — Specify the name of the security group attached to the SQS endpoint.
* **Secret Manager** — Specify the name of the Secret Manager endpoint required to access database-related secrets.
* **Secret Manager Security Group** — Specify the name of the security group attached to Secret Manager.
* **CloudWatch** — Specify the name of the CloudWatch endpoint required to push database engine logs to CloudWatch.
* **CloudWatch Security Group** — Specify the name of the security group attached to CloudWatch.
* **EC2** — Specify the name of the EC2 service endpoint required to perform EC2 operations for the SQS server.
* **EC2 Security Group** — Specify the name of the security group attached to the EC2 service.
* **Tessell Control Plane** — Specify the name of the AWS endpoint attached to the Tessell Control Plane endpoint service for CP-DP communication.
* **Tessell Control Plane Security Group** — Specify the name of the security group attached to the Tessell Control Plane endpoint.
* **Note:** Create the S3 gateway endpoint separately in the database subnet or VPC if private connectivity from the database VM to the S3 service is required.
**To register existing endpoints:**
* **SQS** — Select the SQS endpoint from the dropdown list.
* **Secret Manager** — Select the Secret Manager endpoint from the dropdown list.
* **CloudWatch** — Select the CloudWatch endpoint from the dropdown list.
* **EC2** — Select the EC2 service endpoint from the dropdown list.
* **Tessell Control Plane** — Select the AWS endpoint attached to the Tessell Control Plane endpoint service from the dropdown list.
**Gateway endpoint:**
* **S3 Gateway** — Select the S3 gateway endpoint from the dropdown list.
**Fig 10: AWS register network and private CP-DP**
***
#### CP-DP private connectivity disabled
**Add a new network**
1. In the **Network Details** section, select **Add new network**.
2. Provide the following details:
* **Network Name** — Specify the VPC name.
* **CIDR Range** — Specify the IP address range for the new VPC.
3. In the **List of Availability Zones** pane, a list of availability zones for the selected region is displayed. You can add more availability zones if they are available.
4. From the **Availability Zone** dropdown list, select an availability zone for the new subnets.
5. Provide the following subnet details:
* **Private Subnet Name** — Specify the private subnet name.
* **Private Subnet CIDR** — Specify the IP address range for the private subnet.
6. To create a database service with public access in the VPC, toggle **Public Access** and provide the following:
* **Public Subnet Name** — Specify the public subnet name.
* **Public Subnet CIDR** — Specify the IP address range for the public subnet.
**To create a private subnet group:**
1. Select **Create a private subnet group**. The **Private Subnet Group** dialog box opens.
2. Specify a name for the group in the **Name your Group** field.
3. Provide details for the first private subnet:
* **Private Subnet Name 1** — Specify the subnet name.
* **Private Subnet CIDR 1** — Specify the IP address range.
4. Provide details for the second private subnet:
* **Private Subnet Name 2** — Specify the subnet name.
* **Private Subnet CIDR 2** — Specify the IP address range.
5. Select **+Add Subnet** to add more private subnets to the group.
6. Select **Add** to create the private subnet group.
7. To remove an existing private subnet group, select **Remove Group**.
**Fig 11: AWS add network and public CP-DP**
**Register an existing network**
1. In the **Network Details** section, select **Register existing network**.
2. From the **Network** dropdown list, select a VPC from the available VPCs in the account registered on Tessell.
3. In the **Availability Zone** column, select an availability zone from the existing list.
4. In the **Private Subnet** column, select a private subnet from the existing list.
5. To create a database service with public access in the VPC, toggle **Public Access** and select a public subnet from the **Public Subnet** column.
6. In the **Network Name** field, specify the name of the VPC in Tessell for reference.
**Fig 12: AWS register network and public CP-DP**
***
### Launch the ARM/CloudFormation template
**Note:** This step is required only if Tessell was not granted permission to manage virtual networks during subscription onboarding.
1. Select **Launch ARM/CloudFormation Template** to execute the template. Alternatively, select **Copy URL** to generate a direct link to the template.
2. After the template executes and generates JSON output, select the check box **I have generated the ARM/CloudFormation deployment output (JSON)**.
3. Paste the JSON output in the box provided.
4. Select **Create**.
To deploy using code instead:
1. Select the **Code** button in the top-right corner to view the code in Shell, Python, Go, Java, JavaScript, or PowerShell.
2. Copy or download the code using the buttons in the top-right corner.
3. Select **Close** to return to the main window.
**Fig 13: Launch template and create network**
***
## Networks home page
Select a virtual network from the dashboard to open its home page. The network name, cloud region, subscription name, owner, and a **More info** icon are displayed at the top of the page.
Select the **More info** icon to view the following details:
**Cloud details**
* **Cloud** — The cloud provider selected for the virtual network.
* **Region** — The cloud region selected for the virtual network.
* **Status** — The status of the virtual network.
**Subscription details**
* **Subscription** — The cloud subscription selected for the virtual network.
* **Start date** — The start date of the cloud subscription.
* **IP Address Range** — The IP address range or CIDR block of the virtual network.
**Owner**
* **Cloud** — The cloud provider selected for the virtual network.
* **Maturity** — The maturity status of the virtual network.
* **My Role** — Your role on the virtual network.
* **Publicly Accessible** — Whether the virtual network is enabled for public connectivity.
***
### Azure
#### Subnets
Use the **Search** bar to search for a specific subnet. The list filters automatically as you type.
The subnets table displays the following columns:
* **Name** — The registered subnet name in the network.
* **CIDR** — The CIDR block or IP address range of the subnet.
* **Connectivity Type** — Whether the subnet is private or public.
* **Delegated To** — Whether the subnet is a delegated subnet to enable Azure NetApp Files (ANF).
**Fig 14: Azure subnets tab**
**Add subnets**
1. Select **+ Subnets** in the top-right corner of the page. The **Register More Subnets** window opens.
* The network cloud region is displayed in the **Region** field.
* The virtual network name is displayed in the **Name** field.
2. Select a private subnet from the available list for the network.
3. To enable Azure NetApp Files (ANF) on this VNet, select one delegated subnet.
**Note:**
* Select a delegated subnet to provide secure access and optimized storage performance for your database services.
* For SAP workloads, a delegated subnet size of at least /25 is recommended. For other workloads, /26 is preferable.
4. Toggle **Enable Public Subnets** to register a public subnet.
5. If enabled, select a public subnet from the available list for the network.
**Note:** When the public subnets option is disabled, database services created on this network are not accessible from the public internet.
6. Select **Register**.
To add subnets using code:
1. Select the **Code** button in the top-right corner to view the code in Shell, Python, Go, Java, JavaScript, or PowerShell.
2. Copy or download the code using the buttons in the top-right corner.
3. Select **Close** to return to the main window.
**Fig 15: Azure add subnet**
#### Sharing
Use the **Search** bar to search for a specific user. The list filters automatically as you type.
**Share a VNet**
1. Select **Share** in the top-right corner of the page. The **Add co-owners for VNet** dialog box opens.
2. Use the **Search** bar to search for specific users.
3. To grant access, select users from the left **Choices** column and move them to the right **Chosen** column.
**Note:** Users and roles are managed in the **IAM** app under the Governance app family.
4. Select **Save**.
The sharing table displays the following columns:
* **User** — A list of usernames with whom the network is shared.
* **Role** — The user's defined role, which can be Co-owner.
To remove a user, select the ellipsis icon next to the user's details and select **Remove User**. In the confirmation dialog box, select the check box to confirm, then select **Remove**.
**Fig 16: Azure sharing tab**
***
### AWS
#### Subnets
Use the **Search** bar to search for a specific subnet. The list filters automatically as you type.
The subnets table displays the following columns:
* **Availability Zone** — The availability zone selected for the subnet in the network.
* **Private Subnet Group** — The private subnet group name.
* **Private Subnet** — The private subnet name and CIDR block.
* **Public Subnet** — The public subnet name and CIDR block.
**Fig 17: AWS subnet tab**
#### Peering connections
Use the **Search** bar to search for a specific VPC from the list of peered VPCs. The list filters automatically as you type.
The peering connections table displays the following columns:
* **Name** — The accepter VPC name.
* **Cloud ID** — The cloud ID of the peering connection.
* **VPC** — The requester VPC name.
* **Region** — The accepter VPC region.
* **Status** — The status of the peering connection: Active or Inactive.
* **Ellipsis icon** — Select the ellipsis icon and then select **Delete** to delete the peering connection. In the confirmation dialog box, confirm the action, then select **Delete**.
**Add a peering connection**
1. Select **+ Add Peering Connection** in the top-right corner of the page. The **Add peering connection for your VPC** dialog box opens.
2. Select one of the following options: **Account ID**, **CloudFormation**, or **Tessell VPC**.
**To peer using an Account ID:**
* **Account ID** — Specify the account ID associated with the VPC to peer with.
* **VPC ID** — Specify the VPC ID of the VPC to peer with.
* **Region** — Select the region associated with the VPC to peer with.
**To peer using CloudFormation:**
* From the **Region** dropdown list, select the region for peering.
* Select **Launch CloudFormation** or copy and open the link.
* Edit and create the stack, then select the VPC.
**To peer using a Tessell VPC:**
* From the **Select Tessell VPC** dropdown list, select a VPC registered in Tessell for peering.
3. Select **Add**.
**Fig 18: AWS peering connection tab**
***
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.tessell.com/tessell/governance/networks-doc.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.