Peering Seperate vNET with Azure AVS

Question

Hi All,

Greetings of the Day!

1. we have a customer requirement where we wanted to peer a separate vNET with AVS Private Cloud (like traditional vNET to vNET Peering). Please let us know if it can be achieved without configuring the ExpressRoute gateway in the separate vNET.
2. Customer expectation is to transfer all traffic via HUB (where we have deployed NVA's). AVS Private Cloud is connected to HUB vNET via ExpressRoute and On-Prem is also connected to HUB via ExpressRoute. In this scenario can VM's in On-Prem can communicate to VM's in AVS without additional Configuration (assuming UDR's are in place).

Awaiting, for your responses at the earliest. Please reach out to me for further clarifications if necessary. Please do the needful.

Thanks & Regards,

Ashok Chandra Dev V.

+91 - 8050040640.

Answer 1

Hello Ashok Chandra Venkumahanti (Microland),

Greetings! Welcome to Microsoft Q&A Platform.

Azure VMware Solution offers a private cloud environment accessible from on-premises sites and Azure-based resources. Services such as Azure ExpressRoute, VPN connections, or Azure Virtual WAN deliver the connectivity. However, these services require specific network address ranges and firewall ports for enabling the services. Your AVS Private Cloud is connected to the hub vnet via ExpressRoute. This provides a dedicated, private connection between your on-premises network and Azure.

You can use an existing ExpressRoute Gateway to connect to Azure VMware Solution as long as it does not exceed the limit of four ExpressRoute circuits per virtual network. However, to access Azure VMware Solution from on-premises through ExpressRoute, you must have ExpressRoute Global Reach since the ExpressRoute gateway does not provide transitive routing between its connected circuits.

ExpressRoute Global Reach allows you to connect multiple ExpressRoute circuits in different regions, including your AVS Private Cloud, to the same peering location and this enables communication across these circuits. However, by default, there is no transit connectivity between VPN and ExpressRoute gateways in the hub vNET. To achieve this transit connectivity, you can use either Azure Route Server or a third-party Network Virtual Appliance (NVA).

refer - https://learn.microsoft.com/en-us/azure/architecture/solution-ideas/articles/azure-vmware-solution-foundation-networking, https://learn.microsoft.com/en-us/azure/azure-vmware/architecture-networking

To enable communication between VMs in your on-premises environment and VMs in AVS Private Cloud, consider the following options:

Overlay with BGP: Implement a public Site-to-Site VPN with Border Gateway Protocol (BGP) to dynamically advertise AVS or other non-overlapping IP address spaces. This approach allows communication between on-premises and AVS.

ExpressRoute Termination: The AVS ExpressRoute is bundled as part of the private cloud cost, and no egress/ingress charges apply between AVS and the vNet where the ExpressRoute terminates. You can connect the AVS ExpressRoute to up to 10 different virtual network gateways.

Ensure that you have appropriate UDRs in place to route traffic between the different networks (on-premises, AVS, and hub vNET) and define the necessary routes to direct traffic through the desired path (e.g., via ExpressRoute or VPN connections).

Hope this answer helps! Please let us know if you have any further queries. I’m happy to assist you further.

---

Please "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.