​
Overview

The working list of tiers inside the VPC — “Monitor IP usage and manage networks within this VPC”. This is where a VPC stops being an empty address range and becomes something machines can sit in.
Navigation: Networking → VPC → click a VPC → Networks.

​
Columns

The Firewall Policy column is the fastest audit in the console. Scan it top to bottom: a tier reading Assign Firewall Policy is running on a system default, which is rarely what you want for a database tier.

​
Row actions

Edit Network does not touch addressing. A tier’s CIDR and gateway are fixed once created — there’s no resize and no renumber. Getting a tier wrong means creating a new one and moving the machines.

​
Creating a network

Covered in Adding a network, including the Auto-generate button that derives a non-overlapping /24 from the VPC’s range.
Use Auto-generate rather than typing a range. Hand-picked CIDRs are the most common source of overlap, and an overlapping tier fails to create with a message that doesn’t always say which existing tier it collided with.

​
Firewall policies are shared

The assignment dialog states it plainly:
Firewall policies are reusable — editing a policy’s rules affects every resource it is assigned to.
Create a separate policy per tier whenever the tiers need different rules. It costs nothing, and it removes the class of mistake where opening a port for the web tier silently opens it on the database tier too.Duplicating an existing policy isn’t offered — you create a new one and add its rules. See Firewall Policies.

​
Deleting a network

Deletion is where the blast radius shows up. From the designer you get an explicit count — “This network has VM(s) attached. Deleting it may disrupt them. Continue?” — and the machines lose connectivity.
1

Check what is on it first

The IP usage indicator tells you whether anything is using addresses. A tier that looks empty in the machine list can still have NICs on it.
2

Move or delete the machines

Attach the machines to another tier from Networking, or delete them.
3

Free the addressing

Static NAT mappings pointing into the tier should be disabled from Public IP Addresses first, so you don’t leave an address mapped to nothing.
4

Then delete the network

The tier’s CIDR returns to the VPC’s unreserved space, which you can confirm on Details.

Firewall Policies

The rules, and what a system default does.

Network Designer

Reassign policies by dragging.

Details

How much address space is left.

Public IP Addresses

Publishing a machine in one of these tiers.