Skip to content

Commit

Permalink
Merge pull request #28421 from NarayanAnnamalai/vnet-peering-updates
Browse files Browse the repository at this point in the history
Minor updates
  • Loading branch information
KatieCumming authored Aug 4, 2016
2 parents b2f56e1 + b6242bd commit a5d58cd
Show file tree
Hide file tree
Showing 5 changed files with 102 additions and 106 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ Requirements and key aspects with VNet peering:
## Connectivity
Once two VNets are peered, a virtual machine (web/worker role) in the Vnet can directly connect with other virtual machines in the peered VNet. They will have full IP level connectivity. The network latency for round trip between two Virtual machines in peered Vnets will be the same as within the local VNet. The network throughput will be based on the bandwidth allowed for the Virtual machine proportional to its size, there won’t be any additional restriction on allowed bandwidth. The traffic between the Virtual machines in peered Vnets are routed directly, through Azure’s backend infrastructure and not through a gateway.

Virtual machines in a VNet will be able to access the Internal load balanced endpoints (ILB) in the peered VNet. Network Security Groups can be applied in either Vnet to block access to other Vnet or subnet if desired. When user configures peering they will have choice to either open or close the Network Security Group rules between the VNets. If the user chooses to open full connectivity between peered VNets (default option), they can then use NSGs on specific subnets or Virtual machines to block or deny speicifc access.
Virtual machines in a VNet will be able to access the Internal load balanced endpoints (ILB) in the peered VNet. Network Security Groups can be applied in either Vnet to block access to other Vnet or subnet if desired. When user configures peering they will have choice to either open or close the Network Security Group rules between the VNets. If the user chooses to open full connectivity between peered VNets (default option), they can then use NSGs on specific subnets or Virtual machines to block or deny specific access.

Azure provided internal DNS name resolution for Virtual machines will not work across peered VNets. Virtual machines will have internal DNS names that is resolvable only within the local Virtual Network. However, users can configure Virtual machines running in peered Vnets as DNS servers for a Virtual network.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,8 @@
ms.topic="hero-article"
ms.tgt_pltfrm="na"
ms.workload="infrastructure-services"
ms.date="03/15/2016"
ms.author="telmos"/>
ms.date="08/02/2016"
ms.author="narayanannamalai"/>

# Create a virtual network peering using the Azure portal

Expand Down Expand Up @@ -63,7 +63,7 @@ Click **Browse** > **choose Virtual Networks**

10. NOTE: VNET peering is only established if both links are connected.

There are a few configurable properties for each Link:
There are a few configurable properties for each link:

|Option|Description|Default|
|:-----|:----------|:------|
Expand All @@ -78,33 +78,33 @@ Each link in VNet peering has a set of above properties. From portal, you can cl

1. From a browser, navigate to http://portal.azure.com and, if necessary, sign in with your Azure account.
2. In this example we will use two subscriptions A and B and two users UserA and UserB with privileges in the subscriptions respectively
2. On the portal, Click Browse, choose Virtual Networks. Click the VNET and click Add.
3. On the portal, Click Browse, choose Virtual Networks. Click the VNET and click Add.

![Scenario 2 Browse](./media/virtual-networks-create-vnetpeering-arm-portal/figure09.png)

3. On the Add access blade, click select a role and choose Network Contributor, click Add Users, type the UserB sign in name, and click OK.
4. On the Add access blade, click select a role and choose Network Contributor, click Add Users, type the UserB sign in name, and click OK.

![RBAC](./media/virtual-networks-create-vnetpeering-arm-portal/figure10.png)

This is not a requirement, peering can be established even if users individually raise peering requests for thier respective Vnets as long as the requests match. Adding privileged user of the other VNet as users in the local VNet makes it easier to do setup in portal.
This is not a requirement, peering can be established even if users individually raise peering requests for thier respective Vnets as long as the requests match. Adding privileged user of the other VNet as users in the local VNet makes it easier to do setup in portal.

4. Then login to Azure portal with UserB who is the privilege user for SubscriptionB. Follow above steps to add UserA as Network Contributor.
5. Then login to Azure portal with UserB who is the privilege user for SubscriptionB. Follow above steps to add UserA as Network Contributor.

![RBAC2](./media/virtual-networks-create-vnetpeering-arm-portal/figure11.png)

NOTE: you can log off and log on both user sessions in browser to ensure the authorization is enabled successfully.
NOTE: You can log off and log on both user sessions in browser to ensure the authorization is enabled successfully.

5. Login to the portal as UserA, navigate to the VNET3 blade, click Peering, check ‘I Know my resource ID” checkbox and type the resource ID for VNET5 in below format.
6. Login to the portal as UserA, navigate to the VNET3 blade, click Peering, check ‘I Know my resource ID” checkbox and type the resource ID for VNET5 in below format.

/subscriptions/<Subscription- ID>/resourceGroups/<ResourceGroupName>/providers/Microsoft.Network/VirtualNetwork/<VNET name>

![Resource ID](./media/virtual-networks-create-vnetpeering-arm-portal/figure12.png)

6. Login to the portal as UserB and follow above step to create peering link from VNET5 to VNet3.
7. Login to the portal as UserB and follow above step to create peering link from VNET5 to VNet3.

![Resource ID 2](./media/virtual-networks-create-vnetpeering-arm-portal/figure13.png)

7. Peering will be established and any Virtaul machine in VNet3 should be able to communicate with any virtual machine in VNet5
8. Peering will be established and any Virtaul machine in VNet3 should be able to communicate with any virtual machine in VNet5

[AZURE.INCLUDE [virtual-networks-create-vnet-scenario-transit-include](../../includes/virtual-networks-create-vnetpeering-scenario-transit-include.md)]

Expand Down
Loading

0 comments on commit a5d58cd

Please sign in to comment.