Could anyone help me understand Vnet-to-Vnet dynamic communication?

sweatlord 1 Reputation point

I am setting up a hub and spoke topology and I want transitive communication between spokes, which are peered to my hub. I am having a tough time figuring out what a few settings do and the requirements here. I understand that I need to have UDR's on each spoke that point to the hub's NVA/gateway. Some settings confuse me in here though.

"Use this/remote virtual network's gateway or Route Server" setting in peering config - what will this do and is it related to BGP?
"Propagate gateway routes" section in routing table config - Does this propagate routes INTO the spoke's routing table, or will it propagate the spoke's routes OUT to other routing tables?
"Enable BGP" in the VGW or NVA config - Do I even need BGP if I'm not connecting to on prem?

Could anyone clarify how these settings interoperate with each other and what is necessary vs what is optional?

Azure VPN Gateway
Azure VPN Gateway
An Azure service that enables the connection of on-premises networks to Azure through site-to-site virtual private networks.
969 questions
Azure Virtual Network
Azure Virtual Network
An Azure networking service that is used to provision private networks and optionally to connect to on-premises datacenters.
1,394 questions
{count} votes

1 answer

Sort by: Most helpful
  1. Bas Pruijn 846 Reputation points

    By default VNET peerings are not transitive, as you already know. Setting up a VPN Gateway to do the routing between spokes in your hub-and-spoke setup is expensive and capacity-limited and cumbersome to set up.. I think there are better solutions to achieve the transitive communication:
    Create a mesh network, by peering all spokes directly
    use Virtual Network Manager (
    Use Azure Firewall to route all allowed traffic

    If you want to know more about network manager, see this excellent video:

    0 comments No comments