Routing between resource groups

Question

I am having an issue routing between Resource Groups/Subscriptions. I have VMs in separate resource groups/subscriptions that will not communicate. The IP Flow says the rules are good both ways. I have a route to the vnet and they are peered with each other and the peering says connected. Am I missing something simple here?

Answer 1

Hi - thanks for the question. Resource groups(s) and Subscription(s) are organisational, billing and control plane access boundaries

From a VNET perspective it's the peering that matters (for intra vnet communication on the private path). Now that being said if you're using different subscriptions (or tenants) you need to check the permissions - but you stated the peering is up and working which implies you did have permission.

In addition remember two peering links are required A=>B and B=>A https://learn.microsoft.com/en-us/azure/virtual-network/tutorial-connect-virtual-networks-portal#create-virtual-network-peer

To begin with it would be a good idea to check the troubleshooting guide for peering here https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-troubleshoot-peering-issues#configure-virtual-network-peering-between-two-virtual-networks

Once you're happy with the peering the next thing to check is the Virtual network interface on each VM. Check the routes advertised on each.
https://learn.microsoft.com/en-us/azure/virtual-network/diagnose-network-routing-problem#diagnose-using-azure-portal
Can you see a route advertised on VM-A nic towards VNET-B and visa versa for the other VM? Are there any other routes advertised which may be affecting the network traffic ?

Also check the network security groups (NSGs) if you have them. This can also be seen on the virtual network interface under "effective security rules". Could be an NSG rule is blocking traffic and this could apply in either direction.