Virtual Networks, Peering and Routes

What it is

An Azure virtual network (VNet) is your private network in the cloud. Resources in it talk to each other using private IP addresses, and you decide how the network connects to others and to the internet.

This page covers building a VNet, connecting VNets with peering, public IP addresses, steering traffic with routes, and finding faults with Network Watcher.

How it works

Address space and subnets

A VNet has one or more address spaces written in CIDR form, such as 10.1.0.0/16. You divide it into subnets, such as 10.1.2.0/24, and resources get an address from their subnet. Subnets in one VNet cannot overlap.

Azure reserves five addresses in every subnet: the network address, the broadcast address and three for Azure services. A /29 subnet, with eight addresses, therefore has three usable ones.

VNet peering

Peering connects two VNets so that resources communicate over the Microsoft backbone, using private addresses.

• The address spaces of the two VNets must not overlap.
• Peering works across regions, which is called global peering, and across subscriptions.
• Peering is not transitive. If A is peered with B and B with C, then A and C cannot talk unless they are peered too, or traffic is routed through an appliance in B.
• Each side has its own peering link, so a complete peering has two links, and both must show Connected.
• A hub VNet can share its VPN or ExpressRoute gateway. The hub sets allow gateway transit, and the peered VNet sets use remote gateways.

To peer VNets in different tenants, the administrator needs the Network Contributor role, or equivalent permissions, on the remote VNet.

Public IP addresses

A public IP address lets a resource be reached from the internet. Use the Standard SKU. It is static, can be zone redundant and is secure by default, which means it is closed to inbound traffic until a network security group allows it. The Basic SKU has been retired.

User defined routes

Azure creates system routes so that subnets can reach each other and the internet. To change the path, you create a route table, add routes and associate it with a subnet.

Each route has an address prefix and a next hop type.

The most specific prefix wins, which is called longest prefix match. If two routes have the same prefix, a user defined route beats a BGP route, which beats a system route. A network virtual appliance must have IP forwarding turned on, or it will drop the traffic that is not addressed to it.

Troubleshooting connectivity

Azure Network Watcher has a tool for each question.

Working out usable addresses

Azure reserves five addresses in every subnet, so the usable count is the total minus five.

Peering settings

Public IP address options

The Basic SKU has been retired, so new designs use Standard.

A troubleshooting walk

A VM cannot reach another VM in a peered network. First check that both peering links show Connected and the address spaces do not overlap. Then use Network Watcher: IP flow verify shows whether an NSG blocks the packet, Next hop shows where the traffic is sent, and Effective routes shows the routes in force. A user defined route that points to a firewall without IP forwarding is a common cause.

How the exam asks about this

• "Spokes must reach each other through the hub." A route through a virtual appliance, since peering is not transitive.
• "Share the hub's gateway." Gateway transit on the hub and use remote gateways on the spoke.
• "Find which NSG rule drops a packet." IP flow verify.
• "Send all traffic through a firewall." A user defined route with a virtual appliance next hop.