question

AntonioRostaing avatar image
0 Votes"
AntonioRostaing asked TravisCragg-MSFT answered

Site-2-Site between 2 Azure VNETs

Configuring a VNet-to-VNet connection is the preferred option to easily connect VNets if you need a secure tunnel using IPsec/IKE. In this case the documentation said that traffic between VNEts is routed through the Microsoft backbone infrastructure.

According to the documentation, a Site-to-Site connection is also possible:

If you are working with a complicated network configuration, you may prefer to connect your VNets using the Site-to-Site steps, instead the VNet-to-VNet steps. When you use the Site-to-Site steps, you create and configure the local network gateways manually.

In this case we have control over the configuration of the virtual local network address space, but we need expose public IPs. Documentation don´t says nothing about where the traffic goes (azure internal or public internet)

My question is, in this scenario, S2S between VNets, the traffic is routed through azure infrastructure as in the case of VNet-to-VNet or the comunication is done through public internet?




azure-virtual-networkazure-vpn-gateway
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

MalleswarReddy avatar image
0 Votes"
MalleswarReddy answered MalleswarReddy commented

Hi,

S2S traffic is routed public internet. if you are looking for some exclusive line, you will need to take express route.

https://docs.microsoft.com/en-us/azure/expressroute/expressroute-routing


You can also have a look at the private link, but it is still in preview.

https://docs.microsoft.com/en-us/azure/private-link/private-link-overview

· 4
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hi @MalleswarReddy-3494,


Because you refer Express Route, your answer seems to be associated to a VNet - On premise context.
I´m talking about S2S between VNets, so express route don´t fix well here. The question is if S2S traffic is routed public internet also in this scenario.


Regarding private link, its a good option to enable access to services over a private endpoint, thanks for the info.


Regards, Antonio


0 Votes 0 ·

Hi,

I just wanted to check if you have any more questions and if you could find private link as one matching

Regards,
Eshwar

0 Votes 0 ·

Hi Eshwar,

The question is not about the different ways of connecting VNets, the question is if the traffic in a S2S between VNets is routed through Microsoft backbone and is private or not.

Thanks,
Antonio

0 Votes 0 ·
Show more comments
$$ANON_USER$$ avatar image
1 Vote"
$$ANON_USER$$ answered AntonioRostaing commented

Hi Antonio,

Do you require IPSEC communication between the VNets? And are the VNets in different Azure Tenants or same?


The reason I ask is because Vnet peering for example is much faster and easier, but it requires the Vnets to be in the same Azure AD in a multiple subscription scenario or in the same subscription.

If IPSec is required you would need the Site-to-Site approach. The Public IPs are public but since it's all Azure and probably in the same region it will run over the Azure Backbone. But still public internet.

Regards
Pascal

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Thanks Pascal,

Yes, that is exactly the scenario, IPSEC communication between 2 VNets in different subscriptions and different tenants. How the traffic will run over Azure Backbone but still public internet? As far as I understand, the traffic will run over one or another.

Regards, Antonio

0 Votes 0 ·
TravisCragg-MSFT avatar image
1 Vote"
TravisCragg-MSFT answered
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.