Your company has a hub-and-spoke network topology in Azure consisting of three virtual networks: `Hub-VNet` (), `Spoke-VNet1` (), and `Spoke-VNet2` (). Virtual machines are deployed in subnets within all three virtual networks to establish data plane connectivity.
You configure virtual network peering between `Hub-VNet` and `Spoke-VNet1`, and between `Hub-VNet` and `Spoke-VNet2`. No virtual network gateways or virtual appliances are deployed.
Which configuration is required to allow virtual machines in `Spoke-VNet1` to communicate directly with virtual machines in `Spoke-VNet2` over the Azure backbone network?
- AEnable 'Allow gateway transit' on the peering from `Hub-VNet` to both spokes.
- Configure a direct virtual network peering between `Spoke-VNet1` and `Spoke-VNet2`.Answer
- CEnable 'Use remote gateways' on the peering from the spokes to `Hub-VNet`.
- DEnable 'Allow forwarded traffic' on all peerings to automatically route traffic between the spokes.
Answer
Configure a direct virtual network peering between `Spoke-VNet1` and `Spoke-VNet2`.
The correct answer is configuring a direct virtual network peering between the two spokes. Since Azure virtual network peering is non-transitive, traffic cannot flow from one spoke to another through a hub VNet without a transit routing mechanism such as a Network Virtual Appliance (NVA) and User-Defined Routes (UDRs). Peerings must be established directly between the communicating virtual networks to allow direct communication over the Azure backbone network.
Step-by-Step Solution
Key Concept
Azure virtual network peering is non-transitive. To route traffic between two spokes in a hub-and-spoke topology without deploying a network virtual appliance in the hub, a direct virtual network peering link must be established between the two spokes.