Azure Learning

vnet-peering

Properties2
tagsnetworking, peering, vnet
aliasesVNet peering, virtual network peering

2 min read

Virtual Network Peering

What it is

Virtual Network Peering (VNet peering) is a direct, high-bandwidth, low-latency connection between two VNets over Microsoft’s backbone, enabling them to communicate as if directly connected — with no gateway, no public internet, no VPN tunnel.

Why it exists

Applications often span multiple VNets (per-tier, per-region, cross-subscription, or cross-tenant environments). Peering gives near‑local connectivity, lets peered VNets share routes, and enables hub-and-spoke designs — a cheap, low-latency alternative to VPN gateways for VNet-to-VNet traffic.

Key ideas

  • Peering is non-transitive by default: VNet A ⇄ B and B ⇄ C does NOT give A ⇄ C. Use hub-and-spoke with a UDR (”service chaining”) or Virtual WAN to route through.
  • Two directions: a peering link is created independently in each VNet (both sides must be enabled).
  • Can peer VNets in: same/different regions (global peering), same/different subscriptions, same/different tenants (limit/considerations apply).
  • Cannot overlap address spaces between peered VNets.
  • Gateway transit lets a spoke use the hub’s vpn-gateway/ExpressRoute gateway for outbound/hybrid connectivity (transit must be enabled on both sides) — a VPN Gateway in the hub makes spoke-to-on-prem possible via peering.
  • Traffic over peering is private and free of egress fees (peering data transfer billed as egress at reduced rates; see docs).

How it fits

              [hub VNet]
  spokeA ─────┘    │    └──── spokeB
  peer links on each side only
  (non-transitive: spokeA can't reach spokeB without UDR/NVA)

vnet-peering - Microsoft diagram

Diagrams courtesy of Microsoft Learn / Azure docs: virtual-network/virtual-network-peering-overview

Exam notes

  • Memorize non-transitivity — the classic exam gotcha.
  • Allow gateway transit + use remote gateways are peer-settings on the hub/spoke respectively.
  • Peering does not create overlapping-IP routing; ranges must not overlap.
  • Cross-region peering is called global peering; supported for most scenarios.

Home · vnet · subnet · route-table · vpn-gateway · virtual-wan

📘 Source: Microsoft Learn — Vnet Peering

Graph View

Backlinks