VNet peering for connectivity in Azure - Deep Dive

Overview - VNet peering for connectivity

What is it?

VNet peering is a way to connect two separate virtual networks in Azure so they can communicate with each other directly. It allows resources in different networks to talk as if they were on the same network, without using the internet or extra gateways. This connection is fast and secure because it uses Azure's internal network. It helps build larger, connected environments in the cloud.

Why it matters

Without VNet peering, virtual networks would be isolated, making it hard for resources in different networks to work together. People would have to use slower, less secure methods like VPNs or public internet connections. VNet peering solves this by providing a simple, fast, and private way to connect networks, enabling better application design and easier management.

Where it fits

Before learning VNet peering, you should understand what virtual networks (VNets) are and how Azure resources connect inside a VNet. After mastering VNet peering, you can explore more complex network designs like hub-and-spoke architectures, network security groups, and Azure Firewall integration.

Mental Model

Core Idea

VNet peering links two virtual networks so their resources can communicate privately and directly as if they were on the same network.

Think of it like...

Imagine two separate office buildings with their own internal phone systems. VNet peering is like installing a private, direct phone line between the two buildings so employees can call each other without going through the public phone network.

┌─────────────┐       Peering Link       ┌─────────────┐
│  VNet A     │──────────────────────────│  VNet B     │
│  (10.0.0.0/16)│                          │ (10.1.0.0/16)│
│  Resources  │                          │  Resources  │
└─────────────┘                          └─────────────┘

Build-Up - 7 Steps

1

Foundation

Understanding Azure Virtual Networks

Concept: Learn what a virtual network (VNet) is and how it isolates resources in Azure.

A VNet is like a private network in the cloud where you can place your Azure resources such as virtual machines. It has its own IP address range and controls who can talk to what inside it. VNets keep your resources secure and organized.

Result

You understand that VNets create isolated spaces for resources and that resources inside a VNet can communicate freely.

Knowing what a VNet is helps you see why connecting VNets is necessary to let resources across networks communicate.

2

Foundation

Basics of Network Connectivity in Azure

Concept: Explore how resources communicate inside and outside a VNet.

Resources inside the same VNet can talk directly using private IPs. To communicate outside, you usually need gateways or public IPs. Without special setup, VNets are isolated from each other.

Result

You realize that VNets are separate by default and that connecting them requires extra steps.

Understanding default isolation clarifies why VNet peering is a valuable feature.

3

Intermediate

What is VNet Peering and How It Works

🤔Before reading on: do you think VNet peering routes traffic over the internet or Azure's private network? Commit to your answer.

Concept: Introduce VNet peering as a private, direct connection between two VNets within Azure.

VNet peering connects two VNets so their resources can communicate using private IPs. The traffic stays inside Azure's backbone network, not the internet. Peering is set up by creating a link from each VNet to the other.

Result

You see that peered VNets behave like one network for communication purposes, improving speed and security.

Knowing that peering uses Azure's private network explains why it is faster and safer than VPNs.

4

Intermediate

Configuring VNet Peering in Azure Portal

🤔Before reading on: do you think peering requires configuration on both VNets or just one? Commit to your answer.

Concept: Learn the practical steps to create a VNet peering connection using Azure Portal.

To peer VNets, you go to one VNet's settings, select 'Peerings', and add a new peering pointing to the other VNet. Then, you repeat the process from the other VNet to complete the connection. You can control traffic flow and gateway use in the settings.

Result

You can create a working peering connection that allows resources in both VNets to communicate.

Understanding the two-way setup prevents common mistakes where peering is incomplete and communication fails.

5

Intermediate

Peering Across Regions and Subscriptions

🤔Before reading on: can VNet peering connect VNets in different Azure regions or subscriptions? Commit to your answer.

Concept: Explore the ability to peer VNets across regions and subscriptions with some limitations.

Azure supports peering VNets in different regions (global VNet peering) and different subscriptions, as long as they are in the same Azure Active Directory tenant. Global peering may have slightly higher latency and costs. Permissions are needed for cross-subscription peering.

Result

You understand that peering is flexible and can connect networks across boundaries, enabling complex architectures.

Knowing cross-region and cross-subscription peering expands your design options for global applications.

6

Advanced

Managing Traffic and Security with VNet Peering

🤔Before reading on: does VNet peering automatically allow all traffic between VNets or can it be controlled? Commit to your answer.

Concept: Learn how to control traffic flow and apply security rules with VNet peering.

By default, peering allows all traffic between VNets. You can disable forwarded traffic or gateway transit to control routing. Network Security Groups (NSGs) still apply to filter traffic. Peering does not change NSG rules, so you must configure them to secure communication.

Result

You can fine-tune what traffic passes between peered VNets and maintain security boundaries.

Understanding that peering is a connection, not a security override, helps prevent accidental exposure.

7

Expert

Limitations and Performance Considerations of VNet Peering

🤔Before reading on: do you think VNet peering supports transitive routing by default? Commit to your answer.

Concept: Discover the limits of VNet peering, including no transitive routing and performance impacts.

VNet peering does not support transitive routing, meaning if VNet A is peered with VNet B, and B with C, A cannot reach C through B automatically. Also, peering has bandwidth limits based on VM sizes and Azure region. Understanding these helps design scalable networks.

Result

You avoid design mistakes that cause unreachable resources or bottlenecks in your network.

Knowing peering limits guides you to use hub-and-spoke or VPN gateways when needed for complex routing.

Under the Hood

VNet peering creates a direct link between the virtual network fabric of two VNets inside Azure's backbone network. It updates routing tables so traffic destined for the peered VNet's IP range is sent through this private link. The traffic never leaves Azure's infrastructure, ensuring low latency and high security. Peering is implemented at the network virtualization layer, making it transparent to virtual machines.

Why designed this way?

Azure designed VNet peering to provide a simple, fast, and secure way to connect VNets without the complexity and cost of VPN gateways or public internet. Alternatives like VPNs add latency and management overhead. Peering leverages Azure's internal network to optimize performance and security, meeting enterprise needs for scalable cloud networks.

┌─────────────┐       ┌─────────────┐
│  VNet A     │       │  VNet B     │
│  Routing   ├───────►│  Routing   │
│  Table     │       │  Table     │
└─────┬──────┘       └─────┬──────┘
      │                    │
      │  Azure Backbone    │
      └────────────────────┘
         Private Peering Link

Myth Busters - 4 Common Misconceptions

Quick: Does VNet peering allow transitive routing between VNets? Commit yes or no.

Common Belief: VNet peering automatically allows traffic to pass through multiple peered VNets (transitive routing).

Reality: VNet peering does NOT support transitive routing. Each peering is only between two VNets directly.

Why it matters: Assuming transitive routing can cause unreachable resources and network failures in multi-VNet architectures.

Quick: Is VNet peering traffic sent over the public internet? Commit yes or no.

Common Belief: Traffic between peered VNets travels over the public internet.

Reality: Traffic stays within Azure's private backbone network, never touching the public internet.

Why it matters: Believing traffic is public may lead to unnecessary encryption or security measures, increasing complexity and cost.

Quick: Does VNet peering override Network Security Group rules? Commit yes or no.

Common Belief: VNet peering bypasses NSG rules, allowing all traffic between VNets.

Reality: NSG rules still apply and control traffic even over peered connections.

Why it matters: Ignoring NSGs can cause security breaches or blocked traffic unexpectedly.

Quick: Can you peer VNets across different Azure Active Directory tenants? Commit yes or no.

Common Belief: You can peer VNets across any Azure subscriptions regardless of directory.

Reality: Peering requires VNets to be in subscriptions under the same Azure Active Directory tenant.

Why it matters: Trying to peer across tenants without proper setup leads to failed connections and wasted effort.

Expert Zone

1

Peering does not support transitive routing, so complex topologies require hub-and-spoke or VPN gateways.

2

Global VNet peering across regions incurs additional latency and costs compared to same-region peering.

3

Peering connections consume a small amount of resources and have limits per subscription, which can affect large-scale deployments.

When NOT to use

Avoid VNet peering when you need transitive routing or must connect VNets across different Azure Active Directory tenants. Use VPN gateways or Azure Virtual WAN for cross-tenant or complex routing scenarios.

Production Patterns

Common patterns include hub-and-spoke networks where a central VNet peers with multiple spokes, enabling centralized security and routing. Global VNet peering connects VNets in different regions for multi-region applications. Peering is also used to connect VNets in different subscriptions within the same organization.

Connections

Software-Defined Networking (SDN)

VNet peering is an example of SDN principles applied in cloud networking.

Understanding SDN helps grasp how virtual networks and peering abstract physical hardware to provide flexible, programmable connectivity.

Private Telephone Lines

VNet peering is like private lines connecting offices, avoiding public networks.

Knowing how private lines work in telecom clarifies why peering improves security and performance over public internet connections.

Supply Chain Logistics

Both involve connecting separate hubs efficiently without unnecessary detours.

Seeing VNet peering like direct shipment routes helps understand the importance of direct, private connections for speed and reliability.

Common Pitfalls

#1 Incomplete peering setup causing no connectivity.

Wrong approach:

Create peering from VNet A to VNet B only, without creating the reverse peering from VNet B to VNet A.

Correct approach:

Create peering from VNet A to VNet B and also from VNet B to VNet A to establish two-way communication.

Root cause:

Misunderstanding that peering is a two-way connection requiring configuration on both VNets.

#2 Assuming peering allows transitive routing.

Wrong approach:

Design network where VNet A peers with VNet B, and VNet B peers with VNet C, expecting A to reach C through B.

Correct approach:

Use hub-and-spoke design with a central VNet peered individually with A and C, or use VPN gateways for transitive routing.

Root cause:

Not knowing that peering connections do not forward traffic beyond the two connected VNets.

#3 Ignoring Network Security Group rules on peered VNets.

Wrong approach:

Configure peering but do not adjust NSGs, expecting all traffic to flow freely.

Correct approach:

Review and update NSG rules to allow desired traffic between peered VNets.

Root cause:

Believing peering overrides security controls, leading to blocked or insecure traffic.

Key Takeaways

VNet peering connects two Azure virtual networks privately and directly using Azure's backbone network.

Peering requires configuration on both VNets and does not support transitive routing between multiple VNets.

Traffic over peering stays within Azure's private infrastructure, ensuring security and low latency.

Network Security Groups still control traffic between peered VNets and must be managed accordingly.

Understanding peering limits and design patterns helps build scalable, secure cloud networks.