แก้ไข

แชร์ผ่าน


Create a virtual network peering - Resource Manager, different subscriptions and Microsoft Entra tenants

In this tutorial, you learn to create a virtual network peering between virtual networks created through Resource Manager. The virtual networks exist in different subscriptions that might belong to different Microsoft Entra tenants. Peering two virtual networks enables resources in different virtual networks to communicate with each other with the same bandwidth and latency as though the resources were in the same virtual network. Learn more about Virtual network peering.

Depending on whether, the virtual networks are in the same, or different subscriptions the steps to create a virtual network peering are different. Steps to peer networks created with the classic deployment model are different. For more information about deployment models, see Azure deployment model.

Learn how to create a virtual network peering in other scenarios by selecting the scenario from the following table:

Azure deployment model Azure subscription
Both Resource Manager Same
One Resource Manager, one classic Same
One Resource Manager, one classic Different

A virtual network peering can't be created between two virtual networks deployed through the classic deployment model. If you need to connect virtual networks that were both created through the classic deployment model, you can use an Azure VPN Gateway to connect the virtual networks.

This tutorial peers virtual networks in the same region. You can also peer virtual networks in different supported regions. Familiarize yourself with the peering requirements and constraints before peering virtual networks.

Prerequisites

  • An Azure account or accounts with two active subscriptions. Create an account for free.

  • An Azure account with permissions in both subscriptions or an account in each subscription with the proper permissions to create a virtual network peering. For a list of permissions, see Virtual network peering permissions.

    • To separate the duty of managing the network belonging to each tenant, add the user from each tenant as a guest in the opposite tenant and assign them the Network Contributor role to the virtual network. This procedure applies if the virtual networks are in different subscriptions and Active Directory tenants.

    • To establish a network peering when you don't intend to separate the duty of managing the network belonging to each tenant, add the user from tenant A as a guest in the opposite tenant. Then, assign them the Network Contributor role to initiate and connect the network peering from each subscription. With these permissions, the user is able to establish the network peering from each subscription.

    • For more information about guest users, see Add Microsoft Entra B2B collaboration users in the Azure portal.

    • Each user must accept the guest user invitation from the opposite Microsoft Entra tenant.

  • Sign-in to the Azure portal.

In the following steps, learn how to peer virtual networks in different subscriptions and Microsoft Entra tenants.

You can use the same account that has permissions in both subscriptions or you can use separate accounts for each subscription to set up the peering. An account with permissions in both subscriptions can complete all of the steps without signing out and signing in to portal and assigning permissions.

The following resources and account examples are used in the steps in this article:

User account Resource group Subscription Virtual network
user-1 test-rg subscription-1 vnet-1
user-2 test-rg-2 subscription-2 vnet-2

Create virtual network - vnet-1

Note

If you are using a single account to complete the steps, you can skip the steps for logging out of the portal and assigning another user permissions to the virtual networks.

The following procedure creates a virtual network with a resource subnet.

  1. In the portal, search for and select Virtual networks.

  2. On the Virtual networks page, select + Create.

  3. On the Basics tab of Create virtual network, enter or select the following information:

    Setting Value
    Project details
    Subscription Select your subscription.
    Resource group Select Create new.
    Enter test-rg in Name.
    Select OK.
    Instance details
    Name Enter vnet-1.
    Region Select East US 2.

    Screenshot of Basics tab of Create virtual network in the Azure portal.

  4. Select Next to proceed to the Security tab.

  5. Select Next to proceed to the IP Addresses tab.

  6. In the address space box in Subnets, select the default subnet.

  7. In Edit subnet, enter or select the following information:

    Setting Value
    Subnet purpose Leave the default Default.
    Name Enter subnet-1.
  8. Leave the rest of the settings as their defaults. Select Save.

    Screenshot of default subnet rename and configuration.

  9. Select Save.

  10. Select Review + create at the bottom of the screen, and when validation passes, select Create.

Assign permissions for user-2

A user account in the other subscription that you want to peer with must be added to the network you previously created. If you're using a single account for both subscriptions, you can skip this section.

  1. Remain signed in to the portal as user-1.

  2. In the search box a the top of the portal, enter Virtual network. Select Virtual networks in the search results.

  3. Select vnet-1.

  4. Select Access control (IAM).

  5. Select + Add -> Add role assignment.

  6. In Add role assignment in the Role tab, select Network Contributor.

  7. Select Next.

  8. In the Members tab, select + Select members.

  9. In Select members in the search box, enter user-2.

  10. Select Select.

  11. Select Review + assign.

  12. Select Review + assign.

Obtain resource ID of vnet-1

  1. Remain signed in to the portal as user-1.

  2. In the search box a the top of the portal, enter Virtual network. Select Virtual networks in the search results.

  3. Select vnet-1.

  4. In Settings, select Properties.

  5. Copy the information in the Resource ID field and save for the later steps. The resource ID is similar to the following example: /subscriptions/<Subscription Id>/resourceGroups/test-rg/providers/Microsoft.Network/virtualNetworks/vnet-1.

  6. Sign out of the portal as user-1.

Create virtual network - vnet-2

In this section, you sign in as user-2 and create a virtual network for the peering connection to vnet-1.

Create a second virtual network with the following values by repeating the steps in the previous section.

Setting Value
Subscription subscription-2
Resource group test-rg-2
Name vnet-2
Address space 10.1.0.0/16
Subnet name subnet-1
Subnet address range 10.1.0.0/24

Assign permissions for user-1

A user account in the other subscription that you want to peer with must be added to the network you previously created. If you're using a single account for both subscriptions, you can skip this section.

  1. Remain signed in to the portal as user-2.

  2. In the search box a the top of the portal, enter Virtual network. Select Virtual networks in the search results.

  3. Select vnet-2.

  4. Select Access control (IAM).

  5. Select + Add -> Add role assignment.

  6. In Add role assignment in the Role tab, select Network Contributor.

  7. Select Next.

  8. In the Members tab, select + Select members.

  9. In Select members in the search box, enter user-1.

  10. Select Select.

  11. Select Review + assign.

  12. Select Review + assign.

Obtain resource ID of vnet-2

The resource ID of vnet-2 is required to set up the peering connection from vnet-1 to vnet-2. Use the following steps to obtain the resource ID of vnet-2.

  1. Remain signed in to the portal as user-2.

  2. In the search box a the top of the portal, enter Virtual network. Select Virtual networks in the search results.

  3. Select vnet-2.

  4. In Settings, select Properties.

  5. Copy the information in the Resource ID field and save for the later steps. The resource ID is similar to the following example: /subscriptions/<Subscription Id>/resourceGroups/test-rg-2/providers/Microsoft.Network/virtualNetworks/vnet-2.

  6. Sign out of the portal as user-2.

Create peering connection - vnet-1 to vnet-2

You need the Resource ID for vnet-2 from the previous steps to set up the peering connection.

  1. Sign in to the Azure portal as user-1. If you're using one account for both subscriptions, change to subscription-1 in the portal.

  2. In the search box a the top of the portal, enter Virtual network. Select Virtual networks in the search results.

  3. Select vnet-1.

  4. Select Peerings.

  5. Select + Add.

  6. Enter or select the following information in Add peering:

    Setting Value
    Remote virtual network summary
    Peering link name vnet-2-to-vnet-1
    Virtual network deployment model Resource Manager
    I know my resource ID Select the box
    Resource ID Enter the Resource ID for vnet-2
    Directory Select the Microsoft Entra ID directory that corresponds with vnet-2 and user-2
    Remote virtual network peering settings
    Allow 'the peered virtual network' to access 'vnet-1' Leave the default of Enabled
    Allow 'the peered virtual network' to receive forwarded traffic from 'vnet-1' Select the box
    Local virtual network summary
    Peering link name vnet-1-to-vnet-2
    Local virtual network peering settings
    Allow 'vnet-1' to access 'the peered virtual network' Leave the default of Enabled
    Allow 'vnet-1' to receive forwarded traffic from 'the peered virtual network' Select the box
  7. Select Add.

    Screenshot of peering from vnet-1 to vnet-2.

  8. Sign out of the portal as user-1.

The peering connection shows in Peerings in a Initiated state. To complete the peer, a corresponding connection must be set up in vnet-2.

Create peering connection - vnet-2 to vnet-1

You need the Resource IDs for vnet-1 from the previous steps to set up the peering connection.

  1. Sign in to the Azure portal as user-2. If you're using one account for both subscriptions, change to subscription-2 in the portal.

  2. In the search box a the top of the portal, enter Virtual network. Select Virtual networks in the search results.

  3. Select vnet-2.

  4. Select Peerings.

  5. Select + Add.

  6. Enter or select the following information in Add peering:

    Setting Value
    Remote virtual network summary
    Peering link name vnet-1-to-vnet-2
    Virtual network deployment model Resource Manager
    I know my resource ID Select the box
    Resource ID Enter the Resource ID for vnet-2
    Directory Select the Microsoft Entra ID directory that corresponds with vnet-1 and user-1
    Remote virtual network peering settings
    Allow 'the peered virtual network' to access 'vnet-1' Leave the default of Enabled
    Allow 'the peered virtual network' to receive forwarded traffic from 'vnet-1' Select the box
    Local virtual network summary
    Peering link name vnet-1-to-vnet-2
    Local virtual network peering settings
    Allow 'vnet-1' to access 'the peered virtual network' Leave the default of Enabled
    Allow 'vnet-1' to receive forwarded traffic from 'the peered virtual network' Select the box
  7. Select Add.

  8. In the pull-down box, select the Directory that corresponds with vnet-1 and user-1.

  9. Select Authenticate.

    Screenshot of peering from vnet-2 to vnet-1.

  10. Select Add.

The peering is successfully established after you see Connected in the Peering status column for both virtual networks in the peering. Any Azure resources you create in either virtual network are now able to communicate with each other through their IP addresses. If you're using Azure name resolution for the virtual networks, the resources in the virtual networks aren't able to resolve names across the virtual networks. If you want to resolve names across virtual networks in a peering, you must create your own DNS (Domain Name System) server or use Azure DNS.

Important

If you update the address space in one of the members of the peer, you must resync the connection to reflect the address space changes. For more information, see Update the address space for a peered virtual network using the Azure portal

For more information about using your own DNS for name resolution, see, Name resolution using your own DNS server.

For more information about Azure DNS, see What is Azure DNS?.

Next steps