Skip to main content
This article explains inter-site connectivity options in Azure, covering two broad scenarios:
  • Azure-to-Azure connectivity
  • Azure-to-on-premises connectivity
Each scenario offers multiple approaches—choose based on latency, bandwidth, security, cost, and management overhead.

​
Azure-to-Azure connectivity

By default, VNets are isolated. If you have two virtual networks (for example, VNet-A and VNet-B), VMs in different VNets cannot communicate until you explicitly connect them. Two common methods are:
  • VPN gateway (VNet-to-VNet)
  • VNet peering

​
VPN gateway (VNet-to-VNet)

Deploy a VPN gateway resource into a subnet named GatewaySubnet in each VNet to establish an encrypted IPsec/IKE tunnel between VNets. This provides secure, site-to-site style encryption and can also be used to connect VNets to on‑premises networks.
The GatewaySubnet must be named exactly GatewaySubnet. Allocate enough IP addresses (a /27 or larger is commonly recommended) so the VPN gateway has room for scale and future features.

​
VNet peering

VNet peering connects two VNets directly over the Azure backbone, delivering low-latency, high-bandwidth connectivity without a VPN gateway. Peering works within a region or across regions (global VNet peering).
VNet peering is not transitive. Traffic will not automatically route from VNet-A to VNet-C through VNet-B unless you explicitly configure gateway transit or use routing appliances/UDRs to enable that path.
A diagram of Azure-to-Azure intersite connectivity showing two virtual networks (VNet-A and VNet-B), each containing a subnet and a gatewaySubnet. The VNets are linked by peering and a VNet-to-VNet gateway connection with the IP ranges shown for each network.
Both approaches are valid; choose based on requirements:

​
Azure-to-on-premises connectivity

Connecting Azure to an on-premises datacenter typically uses one of the following:
  • Site-to-site VPN
  • ExpressRoute
  • Point-to-site (P2S) VPN

​
Site-to-site VPN

A site-to-site (S2S) VPN creates an encrypted IPSec/IKE tunnel between your on-premises VPN device and the Azure VPN gateway deployed in GatewaySubnet. It uses the public internet and is suitable for secure connectivity between datacenters or branch offices and Azure.

​
ExpressRoute

ExpressRoute provides a private, dedicated connection between your on‑premises network and Azure via a connectivity provider (telecom or networking partner). Benefits include higher throughput, more consistent latency, and an SLA-backed service. The physical path is provisioned through the provider—it’s not a single “cable” you plug directly into Azure.

​
Point-to-site (P2S)

Point-to-site establishes a secure VPN from an individual client machine (developer laptop, remote worker) to an Azure VNet. P2S is typically authenticated using certificates or Azure AD and is ideal when you need secure, per-user access without a site at the other end.
A network diagram titled "Intersite Connectivity – Azure-to-On-Premises Connectivity" showing an Azure VNet (with Subnet, GatewaySubnet and ERSubnet) linked to an on‑premises network via Site-to-Site VPN and ExpressRoute, plus a Point-to-Site connection for remote users. Example CIDR ranges (VNet-A 192.16.0.0/16, subnets 192.16.1.0/24, .0/24, .2.0/24; on‑prem 192.17.0.0/16) are shown.
Compare Azure-to-on-premises options:

​
Summary

  • Azure-to-Azure:
    • GatewaySubnet + VPN gateway: encrypted VNet-to-VNet tunnels; useful when you need encrypted links or on‑premises integration.
    • VNet peering: direct Azure-backbone connectivity giving low latency and high throughput; simpler setup but non-transitive by default.
  • Azure-to-on-premises:
    • Site-to-site VPN: encrypted IPSec/IKE tunnel over the internet using an Azure VPN gateway.
    • ExpressRoute: private provider-backed circuits for predictable performance and SLAs.
    • Point-to-site (P2S): secure client-to-Azure connectivity for individual users using certificates or Azure AD.
Choose the connectivity option based on required latency, bandwidth, security, and cost. For hybrid scenarios that traverse multiple networks, verify routing, gateway transit, and NVA/UDR configurations when using VNet peering.
Detailed configuration steps, routing considerations, and feature comparisons for VPN gateways, VNet peering, site-to-site, point-to-site, and ExpressRoute are available in the linked Microsoft documentation.

Watch Video