VNet Peer across different tenat

Question

Hello,

I am looking to peer Vnet across different tenant. tenant A is third party tenant, and tenant B is my tenant with multiple spokes/subscriptions.

Tenant A - SubX

Tenant B - Subscriptoin Y (hub) and Subscription Z (spoke)

Peering will be between SubX (tenantA) and SubY (tenantB), I am aware that Transitive Peering is not available by default.

How can i make resources in SubX to communicate with SubZ and vise versa? We have Azure firewall available in out Hub Subscription/ SubY.

your support is highly appreciated.

Thanks.

Answer 1

One way to enable communication between Subscription Z (spoke) and Subscription X (in the third-party tenant A) is to leverage a hub-and-spoke network topology with Azure Firewall acting as the central traffic inspection point in the hub.

1. Set up VNet Peering between Hub (Sub Y) and Spoke (Sub Z)

• Peer the hub VNet in Subscription Y (Tenant B) with the spoke VNet in Subscription Z (Tenant B).
• Ensure proper route propagation by configuring the spoke’s route tables to point to the hub's Azure Firewall (via a User Defined Route or UDR).
  • Allow all necessary traffic from spoke to hub through the firewall rules.

2. Set up VNet Peering between Hub (Sub Y) and Third-Party VNet (Sub X)

• Create VNet peering between the hub VNet (Sub Y in Tenant B) and the VNet in the third-party tenant (Sub X in Tenant A).
• This will allow traffic to flow between the two VNets. Ensure the correct permissions are granted, such as the "Network Contributor" role on the VNets being peered.
• On Tenant A’s side, configure the necessary route tables and ensure they allow traffic to the hub network in Sub Y.

3. Configure User Defined Routes (UDR) for Cross-Communication

• In the spoke VNet (Sub Z), add UDRs with the next hop set to the Azure Firewall in the hub VNet.
• In the third-party VNet (Sub X), add UDRs directing traffic to the hub VNet (Sub Y), also with the next hop being the Azure Firewall.

4. Enable Azure Firewall to Route Traffic Between VNets

• Since the Azure Firewall supports traffic inspection and forwarding between peered VNets, configure network rules and NAT rules to allow and route traffic between Sub X (tenant A) and Sub Z (tenant B).
• For example, create firewall policies that allow:
• Sub X ↔ Sub Z traffic.
• Sub Z ↔ Hub VNet communication.

Note that this is just one way to accomplish your objective. In general, this should work with any other method that can be used to provide transitivity between two non-directly peered VNets in a single-tenant scenario, including:

1. Azure VPN Gateway
   • You can set up a VPN Gateway in the hub network to enable communication between on-premises networks or VNets across different tenants.
   • VNet-to-VNet (V2V) connections can be used between:
   • Sub X (Tenant A) <-> Hub (Tenant B)
   • Hub (Tenant B) <-> Spoke (Sub Z)
   • All traffic will flow through the hub, using VPN Gateway as the transit point.
   Drawback: Slightly more complex, and VPNs may introduce latency since traffic flows through encrypted tunnels.

---

1. Azure Route Server
   • Azure Route Server allows you to dynamically exchange routes between the hub VNet and connected VNets or network appliances.
   • This method works if you have network virtual appliances (NVAs) (such as routers or firewalls) deployed in the hub, allowing automatic route exchange to facilitate transitivity.
   • Example: You can connect Tenant A’s VNet to the hub, and the Route Server will manage routing to other connected VNets (like Sub Z).
   Benefit: Simplifies dynamic routing without needing static UDR configurations, reducing operational overhead.

---

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin