4.1AZ-104Advanced
Est: ~15 mins•Verified: 2026-08

Virtual Networks: Subnets & VNet Peering

Architect Azure Virtual Networks, design non-overlapping IP address spaces, configure VNet Peering, Gateway Transit, and User Defined Routes (UDR).

Tags:#Networking#VNet#Peering#Gateway Transit#Routing#AZ-104
01

Overview

Azure Virtual Network (VNet) is the fundamental building block for private networks in Microsoft Azure. Connecting isolated VNets requires VNet Peering:

  1. Virtual Network Peering: Connects two VNets in the same region or globally (Global VNet Peering) across Azure backbones with microsecond latency and zero public internet exposure.
  2. Non-Transitive Nature: VNet peering is non-transitive by default. If VNet A peers with VNet B, and VNet B peers with VNet C, VNet A cannot communicate with VNet C unless a Network Virtual Appliance (NVA) and User Defined Routes (UDR) or Azure Virtual WAN are deployed.
  3. Gateway Transit: Allows spoke VNets to share an on-premises VPN/ExpressRoute gateway deployed in a central hub VNet.

---

02

When to Use: Hub-and-Spoke Topology

Network ArchetypeRecommended ConfigurationOperational Rationale
Hub VNetCentral Firewall + VPN GatewayHosts shared services, inspection firewalls, and on-premises connectivity.
Spoke VNetsPeered to Hub (Use Remote Gateways)Hosts distinct workloads (Production, Development); routes internet traffic via Hub.
Cross-Region ConnectivityGlobal VNet PeeringInterconnects US and European application tiers across private Microsoft fiber.

---

03

Prerequisites

IP Address Space Constraints:

  • Peered Virtual Networks MUST NOT have overlapping IP address spaces (e.g., if VNet A is 10.0.0.0/16, VNet B cannot overlap with any part of 10.0.0.0/16).
  • Network Contributor or Owner role on both subscriptions.

---

04

Portal Path

TEXT
Azure Portal (https://portal.azure.com)
└── Virtual networks > [Hub Virtual Network]
    ├── Address space (Configure CIDR blocks)
    ├── Subnets (Segment subnets)
    └── Peerings (Add bidirectional peering link to Spoke VNet)

---

05

Step-by-Step Implementation

Step 1: Configure Virtual Network Peering with Gateway Transit

  1. Open the Hub Virtual Network (vnet-hub-eastus).
  2. Under Settings, select Peerings > Click + Add.
  3. Configure the Hub-to-Spoke link:
  • Peering link name: hub-to-spoke1.
  • Traffic to remote virtual network: Allow (default).
  • Traffic forwarded from remote virtual network: Allow.
  • Virtual network gateway: Select Use this virtual network's gateway.
  1. Configure the Spoke-to-Hub link (same blade):
  • Peering link name: spoke1-to-hub.
  • Virtual network: Select vnet-spoke1-eastus.
  • Traffic to remote virtual network: Allow.
  • Traffic forwarded from remote virtual network: Allow.
  • Virtual network gateway: Select Use the remote virtual network's gateway (Enables Gateway Transit).
  1. Click Add.

---

06

PowerShell Automation

Create Virtual Network Peering via Azure PowerShell:

PowerShell
# Retrieve VNet objects
$VNetHub = Get-AzVirtualNetwork -ResourceGroupName "rg-network" -Name "vnet-hub"
$VNetSpoke = Get-AzVirtualNetwork -ResourceGroupName "rg-network" -Name "vnet-spoke"

# Create Hub to Spoke Peering
Add-AzVirtualNetworkPeering -Name "hub-to-spoke" `
    -VirtualNetwork $VNetHub `
    -RemoteVirtualNetworkId $VNetSpoke.Id `
    -AllowGatewayTransit

# Create Spoke to Hub Peering
Add-AzVirtualNetworkPeering -Name "spoke-to-hub" `
    -VirtualNetwork $VNetSpoke `
    -RemoteVirtualNetworkId $VNetHub.Id `
    -UseRemoteGateways

---

07

Verification Checklist

VERIFICATION CHECKLIST
0/4 (0%)
Both sides of the peering display status Connected.
VM in Spoke 1 can ping or reach private IP address of VM in Hub.
IP address spaces between VNets have 0 CIDR overlap.
Effective Routes on VM network interface reflect VNetPeering next hop.
08

Troubleshooting Matrix

Error Code / SymptomRoot CauseExact Resolution
Peering status shows "Initiated"Only one side of the peering link was created.Both reciprocal peering links must be established before status transitions to Connected.
Cannot create peering (Overlapping IP)One or more subnets or address spaces conflict between the two VNets.Re-address one of the VNets or delete the conflicting address range.
Spoke cannot reach on-prem networkAllowGatewayTransit is missing on Hub or UseRemoteGateways missing on Spoke.Enable Gateway Transit on Hub and Use Remote Gateways on Spoke peering settings.

---

09

AZ-104 Exam Notes

Exam Blueprint & High-Yield Traps

High-Frequency Exam Objectives & Traps:

  1. Non-Transitive Peering: VNet A cannot talk to VNet C through VNet B via peering alone. To route traffic through B, you must deploy an NVA/Firewall and a Route Table (UDR) with Next Hop = VirtualAppliance.
  2. Address Space Changes: You can now add or remove address spaces on peered VNets without tearing down peering links.
  3. Reserved Azure IPs: In every Azure subnet, 5 IP addresses are reserved by Azure (.0 network, .1 default gateway, .2 and .3 DNS mapping, and .255 broadcast).

---

10

Official Documentation

PREVIOUS TOPIC3.2 Azure VM Scale Sets (VMSS) & Azure App ServicesNEXT TOPIC4.2 Network Security Groups (NSG) & Application Security Groups (ASG)