VNet Peering

VNet Peering connects two Azure Virtual Networks so that resources in each VNet can communicate with each other as if they were on the same network. Traffic between peered VNets travels over the Microsoft backbone network, never touching the public internet. Peering is the primary method for connecting VNets in Azure.

---

Types of VNet Peering

Type	Description
Regional peering	Connects two VNets in the same Azure region.
Global peering	Connects two VNets in different Azure regions.

Both types provide the same low-latency, high-bandwidth connectivity via the Azure backbone. The only difference is the scope — same region versus cross-region.

---

Key Characteristics

Non-Transitive

VNet Peering is not transitive. If VNet A is peered with VNet B, and VNet B is peered with VNet C, VNet A and VNet C cannot communicate through VNet B — unless you explicitly peer A with C or route traffic through a network virtual appliance (NVA) or Azure Firewall in VNet B.

VNet A <--peered--> VNet B <--peered--> VNet C

A can reach B ✓
B can reach C ✓
A can reach C ✗ (not transitive)

Two-Way Configuration

Peering requires a link in both directions. When you create a peering from VNet A to VNet B, Azure creates a reciprocal link from VNet B to VNet A. Both links must be in the Connected state for traffic to flow.

Non-Overlapping Address Spaces

The address spaces of peered VNets must not overlap. If VNet A uses 10.0.0.0/16 and VNet B also uses 10.0.0.0/16, peering will fail. This is why careful IP address planning is critical.

---

How to Create a Peering

Azure Portal

1. Navigate to your VNet > Peerings > Add.
2. Name the peering link (e.g. vnet-hub-to-vnet-spoke1).
3. Select the remote VNet (can be in a different subscription or region).
4. Configure traffic forwarding and gateway transit options.
5. Add — Azure creates both peering links automatically.

Azure CLI

# Peer VNet A to VNet B
az network vnet peering create \
  --resource-group rgA \
  --name peer-a-to-b \
  --vnet-name vnetA \
  --remote-vnet /subscriptions/<sub>/resourceGroups/rgB/providers/Microsoft.Network/virtualNetworks/vnetB \
  --allow-vnet-access

# Peer VNet B to VNet A
az network vnet peering create \
  --resource-group rgB \
  --name peer-b-to-a \
  --vnet-name vnetB \
  --remote-vnet /subscriptions/<sub>/resourceGroups/rgA/providers/Microsoft.Network/virtualNetworks/vnetA \
  --allow-vnet-access

---

Peering Settings