Virtual Network Peering

What is Virtual Network Peering?

Azure Virtual Network (VNet) peering enables you to seamlessly connect Azure virtual networks. Once peered, virtual networks are connected through the Azure backbone network. This allows resources in each virtual network to communicate with each other as if they were within the same network. Traffic between peered virtual networks is private and stays on the Microsoft Azure backbone network; it does not traverse the public internet.

Key Benefits of VNet Peering:

• Low Latency, High Bandwidth: Communication happens over the Azure backbone, ensuring efficient data transfer.
• Simplified Management: No need for complex NAT or VPN gateways for inter-network communication.
• Secure and Private: Traffic remains within the Azure network, enhancing security.
• Seamless Integration: Allows for gradual migration and distributed application architectures.
• Cost-Effective: Avoids the costs associated with VPN gateways for inter-VNet connectivity.

How VNet Peering Works

When you create a VNet peering connection between two VNets (VNet A and VNet B):

1. A peering connection is established from VNet A to VNet B.
2. A corresponding peering connection must also be established from VNet B to VNet A.
3. Each VNet retains its own resource management and subscription.
4. Resources within each VNet can communicate with resources in the other VNet using their private IP addresses.

Types of VNet Peering:

• VNet Peering: Connects VNets within the same Azure region.
• Global VNet Peering: Connects VNets across different Azure regions. This allows resources in VNets located in different geographic locations to communicate privately.

Peering Scenarios:

VNet peering is essential for various architectural patterns:

• Hub-and-Spoke Architecture: Connecting spoke VNets to a central hub VNet for centralized network services.
• Dev/Test to Production: Connecting development and testing environments to production environments.
• Disaster Recovery: Enabling communication between primary and disaster recovery VNets.
• Application Tier Connectivity: Connecting different application tiers (e.g., web tier to database tier) residing in separate VNets.

Considerations and Limitations:

While powerful, VNet peering has certain considerations:

• VNets must have non-overlapping address spaces.
• Peering is not transitive. If VNet A is peered with VNet B, and VNet B is peered with VNet C, VNet A cannot communicate with VNet C directly through VNet B. To enable this, VNet A and VNet C must be peered directly, or you can use a hub-and-spoke model with a hub VNet for transitive routing.
• You cannot peer a VNet with itself.
• For global peering, ensure that supported services are available in both regions.

Configuring VNet Peering

VNet peering can be configured through the Azure portal, Azure CLI, or Azure PowerShell. The process typically involves:

1. Navigating to the virtual network you want to peer.
2. Selecting the "Peerings" option.
3. Clicking "Add" and providing details for the remote VNet.
4. Specifying whether to allow gateway transit from the remote VNet and whether to forward traffic from the local VNet to the remote gateway.

For example, using Azure CLI:

az network vnet peering create --name <PeeringName> --resource-group <ResourceGroupName> --vnet-name <VNetName> --remote-vnet <RemoteVNetId> --allow-vnet-access
            

Monitoring and Troubleshooting

Azure Monitor and Network Watcher provide tools to monitor VNet peering connections and troubleshoot connectivity issues. Common issues include overlapping IP address spaces or misconfigured NSGs.