Why vnet peering is not transitive in Azure

Shivank Sharma 20 Reputation points
2023-07-20T07:40:26.7066667+00:00

Everywhere it is mentioned that transitive vnet peering is not supported by microsoft azure but why? if it is supported will it create any issue. Please explain?

Azure Virtual Network
Azure Virtual Network
An Azure networking service that is used to provision private networks and optionally to connect to on-premises datacenters.
2,024 questions
{count} votes

Accepted answer
  1. KapilAnanth-MSFT 31,606 Reputation points Microsoft Employee
    2023-07-21T05:10:15.91+00:00

    @Shivank Sharma

    Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

    I understand that you would like to know why Transitive Connectivity is not supported in Azure Vnet Peering.

    Put simply, this is by design.

    • This is how the product was developed and the recommendation was always to use a NVA in the Hub Vnet to route traffic across Spoke1 to Spoke2 .
    • There might be a good number of reasons for the Product Team to do so, however, I don't think it will be shared to public.

    One reason I can think of is that,

    • Consider Multi Tenant VNet Peering.
    • CustomerA - Hub
    • CustomerB - Spoke1
    • CustomerC - Spoke2
    • And only A should be connected with both B and C
    • And B and C should only be connected to A
    • In this case, it's better to not have Transit connectivity by default
    • This way, we can secure/prevent access between B and C

    If you are looking for this functionality, then I suggest you use

    Kindly let us know if this helps or you need further assistance on this issue.

    Thanks,

    Kapil


    Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

    1 person found this answer helpful.
    0 comments No comments

0 additional answers

Sort by: Most helpful