Transit Virtual Network Scenarios in Azure

Introduction to Transit Connectivity

In Azure, virtual networks provide network isolation. However, many applications require communication across different VNets. This is known as transit connectivity. Achieving this securely and efficiently is crucial for distributed architectures.

Common scenarios requiring transit connectivity include:

• Connecting on-premises networks to multiple Azure VNets.
• Enabling communication between different application tiers deployed in separate VNets.
• Facilitating disaster recovery between VNets.
• Implementing centralized network security policies.

Methods for Achieving Transit

Several approaches can be used to enable transit connectivity in Azure:

• VNet Peering: A simple and cost-effective method for direct connections between VNets within the same region or globally.
• Azure VPN Gateway: Used for connecting VNets to on-premises networks or for site-to-site VPNs, which can also facilitate VNet-to-VNet transit.
• Azure Virtual WAN: A managed networking service that simplifies connectivity between VNets, branches, and remote users.
• Hub-Spoke Architecture: A design pattern that centralizes network resources (like firewalls or VPN gateways) in a "hub" VNet, with other VNets ("spokes") connecting to it.

VNet Peering for Transit

VNet peering enables direct network connectivity between Azure VNets. When you peer two VNets, resources in each VNet can communicate with each other as if they were within the same network. This applies to VNets within the same region or across different Azure regions (global peering).

How it works:

To enable transit using VNet peering, you typically need a hub VNet. Spokes connect to the hub, and you can enable gateway transit on the spoke VNets to allow them to use the hub's gateway for connectivity to other spokes or on-premises networks.

Important Note: VNet peering is non-transitive by default. This means if VNet A is peered with VNet B, and VNet B is peered with VNet C, VNet A cannot communicate with VNet C directly through VNet B. To achieve transitive routing, you need to explicitly configure it using a hub VNet with gateway transit or a Virtual WAN.

Configuration steps:

1. Create a hub VNet.
2. Create spoke VNets.
3. Peer each spoke VNet to the hub VNet.
4. Enable Gateway Transit on the spoke VNets and set the Allow Gateway Transit option to True.
5. On the hub VNet, enable Allow Gateway Transit to True.
6. If connecting to on-premises, deploy a VPN gateway or ExpressRoute gateway in the hub VNet.

VPN Gateway for Transit

Azure VPN Gateway can be used to connect VNets together (VNet-to-VNet connection) or to connect your on-premises network to your Azure VNets. This service can act as a transit point.

VNet-to-VNet connectivity:

You can establish a VNet-to-VNet connection by creating a VPN gateway in each VNet and configuring them to connect to each other. This approach can be complex to manage for many VNets.

Hub-and-Spoke with VPN Gateway:

A more scalable approach is to deploy a VPN gateway in a central hub VNet. Spoke VNets can then connect to the hub's VPN gateway, either through VNet peering with gateway transit or by establishing VNet-to-VNet connections directly to the hub.

Azure Virtual WAN

Azure Virtual WAN is a networking service that brings together networking, security, and routing functionalities into a single operational interface. It's designed for large-scale, distributed environments.

Benefits:

• Simplified global transit connectivity.
• Automated VNet-to-VNet and VNet-to-branch routing.
• Integration with Azure Firewall and security partners.
• Centralized management and monitoring.

Virtual WAN provides a managed transit hub that simplifies the complexity of connecting multiple VNets and on-premises sites.

Hub-Spoke Architecture

The hub-spoke topology is a popular design pattern for transit connectivity. In this model:

• Hub VNet: Contains shared services like VPN gateways, firewalls, and other central network infrastructure.
• Spoke VNets: Contain application workloads and connect to the hub VNet for transit.

This architecture allows for centralized management of security and routing, making it easier to enforce policies and control traffic flow.

Key Considerations

• IP Address Space: Ensure non-overlapping IP address spaces for all connected VNets.
• Performance and Bandwidth: Choose the right VPN gateway SKU or Virtual WAN tier based on your bandwidth requirements.
• Security: Implement network security groups (NSGs), Azure Firewall, or third-party security appliances in the hub VNet to inspect and filter traffic.
• Cost: Evaluate the costs associated with VNet peering, VPN gateways, and Virtual WAN, as these vary based on usage and configuration.
• Management Complexity: For a large number of VNets, Virtual WAN often offers a more manageable solution than manual VNet peering or VPN gateway configurations.
• Latency: Global VNet peering can introduce latency compared to regional peering. Consider the geographical distribution of your resources.