VNet Peering

Regional vs Global Peering

Non-Transitive Routing

VNet Peering is non-transitive — the most important concept to understand. If VNet-A peers with VNet-B, and VNet-B peers with VNet-C:

• A can reach B ✅
• B can reach C ✅
• A CANNOT reach C ❌ — no direct peering exists

To connect A to C, you must either: create a direct A↔C peering, or use a hub VNet with Azure Firewall/NVA that routes traffic between spokes.

Peering Settings

When creating a peering, key options to configure:

Hub-Spoke Topology

The most common enterprise Azure network design. A central hub VNet contains shared services — VPN Gateway, ExpressRoute gateway, Azure Firewall, Bastion. Spoke VNets contain workloads and peer to the hub.

Benefits: shared gateway reduces cost, centralised security policy, spokes are isolated from each other.

Transit Routing via NVA

Since peering is non-transitive, spoke-to-spoke traffic by default cannot flow through the hub. To enable it:

1. Deploy Azure Firewall or NVA (Network Virtual Appliance) in the hub
2. Create UDRs (User Defined Routes) in each spoke pointing to the NVA as next hop for other spoke traffic
3. Enable Allow forwarded traffic on all peerings
4. Now all spoke-to-spoke traffic routes through the hub firewall for inspection

Cross-Subscription and Cross-Tenant Peering

VNet Peering works across subscriptions and even across Azure AD tenants:

• Cross-subscription — Both subscriptions must be in the same tenant. User creating the peering needs Network Contributor role on both VNets (or custom permissions).
• Cross-tenant — Requires a service principal with appropriate permissions in the remote tenant. More complex but fully supported.

# Get remote VNet resource ID
REMOTE_VNET_ID=$(az network vnet show \
  --name RemoteVNet \
  --resource-group RemoteRG \
  --subscription RemoteSubscriptionId \
  --query id --output tsv)

# Create peering from local VNet to remote VNet
az network vnet peering create \
  --name LocalToRemote \
  --resource-group LocalRG \
  --vnet-name LocalVNet \
  --remote-vnet $REMOTE_VNET_ID \
  --allow-vnet-access

Troubleshooting Peering