Transitive VNets

Question

I'm having some difficulties implementing some of the MS documentation and from other readings on setting up some networking. I have a hub vnet, vnetb, and two spokes, vneta and vnetc. A is peered to B, and B to C, but traffic won't flow from C to A (both to B are fine, and the network gateway in B routes to on-prem just fine and A, B, and C are visible). I know that peering isn't transitive, so I was told to add a UDR with a route from A's CIDR to B's CIDR, and vice versa. I know the proper approach is to use an NVA and set the hop to the firewall, or deploy a virtual WAN, but neither of those are an option (way too long to explain). From what I read this should work as long as you're going vnet to vnet, but it just doesn't work and I wanted to reach out and ask here before delving any further into an alternate solution (we also don't want to peer A and C directly, and we want to avoid more virtual network gateways). We want all traffic to have to flow through B so that if we do opt to set up a firewall, we've got the right place to put it. Each of the VNets are in a different subscription but same region.

Thanks!

Answer 1

Hi @Richard Duane Wolford Jr , you can achieve what you wanted using a VPN Gateway on vnet b. More info in my blog: https://medium.com/@siwibowo/azure-hub-and-spoke-1cd956a0cfaa