Virtual network peering and routing
Almost every Azure network design is a set of virtual networks joined together and steered by routes. If you know how peering and routing behave, most hub-and-spoke questions become simple.
Virtual network peering
Peering connects two Azure Virtual Network instances over the Microsoft backbone. Traffic stays private, has low latency, and does not use a gateway. It works within a region (regional peering) and across regions (global peering).
Key rules:
- Address spaces must not overlap.
- Peering is not transitive. If A peers with B and B peers with C, A cannot reach C.
- A peering must be created in both directions. The portal does this for you; PowerShell and CLI need two calls.
- Peering can connect virtual networks in different subscriptions and Microsoft Entra tenants.
Peering settings
| Setting | What it does |
|---|---|
| Allow virtual network access | Lets the two networks talk. Default is on. |
| Allow forwarded traffic | Accepts traffic that did not originate in the peer, for example traffic sent by a network virtual appliance (NVA). |
| Allow gateway transit | Lets the peer use this network’s VPN or ExpressRoute gateway. |
| Use remote gateways | Uses the peer’s gateway. Cannot be set if this network has its own gateway. |
In a hub-and-spoke design, the hub sets gateway transit and each spoke sets use remote gateways. After you change the address space of a peered network, resync the peering.
System routes and user-defined routes
Azure creates system routes automatically: the virtual network address space, 0.0.0.0/0 to the internet, and routes for peering and gateways. You override them with a route table containing user-defined routes (UDRs), associated with a subnet.
Next hop types: Virtual network gateway, Virtual network, Internet, Virtual appliance, None. None drops the traffic.
Route selection is by longest prefix match. If prefixes are equal, the order is UDR, then BGP, then system route.
Forcing traffic through a firewall
To inspect traffic, add a UDR for 0.0.0.0/0 with next hop Virtual appliance and the private IP of Azure Firewall or the NVA. For spoke-to-spoke traffic, add a UDR in each spoke that points to the hub appliance.
Forced tunneling on a VPN gateway sends internet-bound traffic back to on-premises. You do this by setting a default site on the gateway, or with a UDR with next hop Virtual network gateway.
BGP and route propagation
Gateways learn on-premises routes through BGP. A route table has a setting called Propagate gateway routes. Turn it off to stop on-premises routes from being added to the subnet, which is how you keep a 0.0.0.0/0 BGP route from overriding your UDR.
Exam traps
- Peering does not give transit between spokes. You need a UDR to an NVA or Azure Firewall, or Azure Virtual WAN.
- “Allow forwarded traffic” is needed for NVA scenarios, not “Allow gateway transit”.
- Gateway transit goes on the network with the gateway; remote gateways goes on the spoke.
- Next hop type None drops traffic; Internet sends it to the public internet.
- A route table only affects subnets it is associated with.
Practice questions
Choose an answer, then review the explanation to check your understanding.
1. VNet1 contains a VPN gateway to the on-premises network. VNet2 is peered with VNet1 and must use that gateway. Which two peering settings are required?
Show answer
Answer: B.The network that owns the gateway sets Allow gateway transit. The spoke that wants to use it sets Use remote gateways.
2. Spoke VNet2 and spoke VNet3 are both peered with hub VNet1, which runs a network virtual appliance. VNet2 must reach VNet3 through the appliance. What do you configure?
Show answer
Answer: B.Peering is not transitive. A user-defined route with next hop Virtual appliance sends traffic to the hub, and the peering to the hub needs Allow forwarded traffic.
3. You need all internet-bound traffic from a subnet to go to a firewall at 10.0.1.4. Which route do you add to the route table?
Show answer
Answer: B.A 0.0.0.0/0 user-defined route overrides the default system route to the internet and forwards traffic to the appliance.
4. Two virtual networks have the address spaces 10.1.0.0/16 and 10.1.128.0/17. What happens when you try to peer them?
Show answer
Answer: B.Peered virtual networks must have non-overlapping address spaces.