Peered Vnets and Private Zone DNS

Question

I have Private DNS zone, Linked to 2 virtual networks each network on different subscription.

Those two networks are peered, when i try to ping VM2 on Vnet 2 from Vnet1 VM1 using name it does not work. although there is record on the Private DNS Zone.

And if i ping VM using Name and they are on the same network it works fine.

Answer 1

Hi Abdul,

When you have two virtual networks in different subscriptions that are peered and you're trying to ping a VM in one network from a VM in the other network using a Private DNS zone, there are several potential issues to consider. Here's a step-by-step troubleshooting guide to help you diagnose and resolve the problem:

DNS Configuration:

• Ensure that the Private DNS zone is correctly configured with the appropriate DNS records for the VMs in both virtual networks.
• Verify that the DNS record for VM2 in VNet2 is present and correctly configured in the Private DNS zone.

Network Peering:

• Double-check that the network peering between VNet1 and VNet2 is established correctly. Ensure that it's in the "Connected" state.
• Verify that the peering allows traffic between the two networks by setting the appropriate peering configurations like "Allow forwarded traffic" and "Allow gateway transit" as needed.

DNS Resolution Configuration:

• Make sure that the VMs in both virtual networks are configured to use the Private DNS zone for name resolution.
• Check the DNS settings on VM1 in VNet1 to confirm that it's using the Private DNS zone for resolution.

Network Security Groups (NSGs) and Firewall Rules:

• Ensure that there are no NSGs or firewall rules blocking traffic between the VMs in the two networks. Review the NSG rules to verify they allow the necessary communication.

Name Resolution Testing:

• On VM1 in VNet1, try to resolve the DNS name of VM2 in VNet2 using the nslookup or dig command. This can help verify if DNS resolution is working as expected from VM1.

Ping Testing:

• Attempt to ping VM2 from VM1 using its private IP address. This test will help you determine if there are any general connectivity issues between the two networks.

Routing and UDRs (User-Defined Routes):

• Check if there are any custom User-Defined Routes (UDRs) in place that might be affecting routing between the two networks. Make sure that the routes are correctly configured.

1. Azure Network Watcher:
   • Utilize Azure Network Watcher's troubleshooting and diagnostic tools to analyze network connectivity issues between virtual networks. It can help identify problems with routes, security groups, and other network-related settings.

Azure Portal Logs and Monitoring:

• Review Azure Portal logs and monitoring to check for any network-related errors or anomalies that could be affecting communication between VMs in different subscriptions.

Azure Support:

• If you've exhausted all troubleshooting steps and are still facing issues, consider reaching out to Azure support for assistance. They can help diagnose and resolve complex network issues.