Skip to main content
Enabling cross‑VNet connectivity In this lesson we’ll learn how to connect Azure virtual networks (VNets) so they can communicate privately and securely. VNet peering creates a fast, low‑latency, private connection between VNets without routing traffic over the public internet. Learning objectives
  • Understand how to connect virtual networks for high‑speed, private communication.
  • Learn the difference between regional peering and global peering.
  • Learn the steps and settings involved when creating a peering connection in Azure.
  • Understand permission requirements and important peering options such as traffic forwarding and gateway transit.
  • Learn how to share a single gateway across multiple VNets when needed.
What is VNet peering? Azure VNet peering connects two virtual networks so resources in the VNets can communicate directly using private IPs. Peering behaves like a network-level link; it does not require routing through the public internet and provides the same network performance as intra-VNet traffic. Regional vs global peering
  • Regional peering: connects VNets within the same Azure region.
  • Global peering: connects VNets across different Azure regions (including different geographies).
Choosing between regional and global peering depends on network topology, latency tolerance, and inter-region data transfer costs. Comparison
FeatureRegional PeeringGlobal Peering
ScopeSame Azure regionDifferent Azure regions
LatencyLowest within regionHigher, region-dependent
Data transfer costTypically lowerTypically higher (inter-region rates)
Use casesMulti-subnet apps within a regionMulti-region apps, disaster recovery, global services
Peering configuration options When creating a VNet peering you configure several options that control traffic flow and gateway usage:
OptionDescription
Allow virtual network accessEnables connectivity between the two VNets (required for basic peering)
Allow forwarded trafficAllows traffic that is forwarded by network virtual appliances (NVAs) to traverse the peering
Allow gateway transitAllows a peered VNet to use the other VNet’s gateway (useful for shared VPN/ExpressRoute gateways)
Use remote gatewaysConfigures the VNet to use the peer’s gateway instead of creating its own (requires the peer to allow gateway transit)
High-level steps to create a VNet peering
  1. Verify VNets have non-overlapping address spaces.
  2. Ensure you have the required permissions on both VNets (see the Permissions section below).
  3. Decide whether you need regional or global peering.
  4. Configure peering options: allowVnetAccess, allowForwardedTraffic, allowGatewayTransit, useRemoteGateways.
  5. Create the peering from both sides if required (management plane or portal may create the reverse peering automatically depending on method).
  6. Validate connectivity and routing (NSGs, UDRs, and NVAs may affect traffic flow).
Example: create peering with Azure CLI 
# Create peering from VNetA to VNetB
az network vnet peering create \
  --resource-group MyResourceGroup \
  --vnet-name VNetA \
  --name VNetA-to-VNetB \
  --remote-vnet /subscriptions/<subId>/resourceGroups/PeerRg/providers/Microsoft.Network/virtualNetworks/VNetB \
  --allow-vnet-access true \
  --allow-forwarded-traffic true \
  --allow-gateway-transit true

# Create reverse peering from VNetB to VNetA (if needed)
az network vnet peering create \
  --resource-group PeerRg \
  --vnet-name VNetB \
  --name VNetB-to-VNetA \
  --remote-vnet /subscriptions/<subId>/resourceGroups/MyResourceGroup/providers/Microsoft.Network/virtualNetworks/VNetA \
  --allow-vnet-access true \
  --use-remote-gateways true
Permissions and roles Creating or managing a VNet peering requires permissions scoped to the virtual network resource. Typical actions required include Microsoft.Network/virtualNetworks/* operations on the VNets involved. Common built-in roles that permit peering management include:
RoleScope
Network ContributorResource group or subscription (can manage VNets and peerings)
OwnerSubscription or resource group (full access)
If you encounter permission errors, ask your administrator to assign an appropriate role on the VNets or resource groups. Using a single gateway across multiple VNets You can share a single VPN or ExpressRoute gateway across peered VNets by configuring gateway transit and remote gateway options:
  • The VNet that hosts the gateway must have allowGatewayTransit enabled on its peering.
  • VNets that want to use that gateway enable useRemoteGateways on their peering.
  • Gateway sharing is useful to reduce cost and simplify on‑premises connectivity, but remember that performance and throughput limits of the gateway apply to all VNets using it.
Important constraints to keep in mind: VNet peering is non‑transitive (traffic does not automatically flow through a peered VNet to a third VNet), and peered VNets must not have overlapping address spaces.
Troubleshooting tips
  • If connectivity fails, check network security groups (NSGs), user-defined routes (UDRs), and NVA rules that might block traffic.
  • Confirm both sides of the peering exist and are in the Connected state.
  • Verify that allowForwardedTraffic, allowGatewayTransit, and useRemoteGateways flags are set as required for your topology.
  • For cross-region issues, confirm global peering is supported between the selected regions and check data transfer costs.
Links and references So, with this overview in place, let’s start with how to link virtual networks.

Watch Video