{"id":1578,"date":"2019-03-12T00:00:00","date_gmt":"2019-03-12T00:00:00","guid":{"rendered":"https:\/\/azure.microsoft.com\/blog\/create-a-transit-vnet-using-vnet-peering"},"modified":"2025-06-18T03:41:43","modified_gmt":"2025-06-18T10:41:43","slug":"create-a-transit-vnet-using-vnet-peering","status":"publish","type":"post","link":"https:\/\/azure.microsoft.com\/en-us\/blog\/create-a-transit-vnet-using-vnet-peering\/","title":{"rendered":"Create a transit VNet using VNet peering"},"content":{"rendered":"\n

Azure Virtual Network (VNet) is the fundamental building block for any customer network. VNet lets you create your own private space in Azure, or as I call it your own network bubble. VNets are crucial to your cloud network as they offer isolation, segmentation, and other key benefits. Read more about VNet\u2019s key benefits in our documentation, \u201cWhat is Azure Virtual Network?<\/a>\u201d<\/p>\n\n\n\n

With VNets, you can connect your network in multiple ways. You can connect to on-premises using Point-to-Site (P2S), Site-to-Site (S2S) gateways or ExpressRoute gateways. You can also connect to other VNets directly using VNet peering.<\/p>\n\n\n\n

Customer network can be expanded by peering Virtual Networks to one another. Traffic sent over VNet peering is completely private and stays on the Microsoft Backbone. No extra hops or public Internet involved. Customers typically leverage VNet peering in the hub-and-spoke topology. The hub consists of shared services and gateways, and the spokes comprise business units or applications.<\/p>\n\n\n\n

Gateway transit<\/h2>\n\n\n\n

Today I\u2019d like to do a refresh of a unique and powerful functionality we\u2019ve supported from day one with VNet peering. Gateway transit enables you to use a peered VNet\u2019s gateway for connecting to on-premises instead of creating a new gateway for connectivity. As you increase your workloads in Azure, you need to scale your networks across regions and VNets to keep up with the growth. Gateway transit allows you to share an ExpressRoute or VPN gateway with all peered VNets and lets you manage the connectivity in one place. Sharing enables cost-savings and reduction in management overhead.<\/p>\n\n\n\n

With Gateway transit enabled on VNet peering, you can create a transit VNet that contains your VPN gateway, Network Virtual Appliance, and other shared services. As your organization grows with new applications or business units and as you spin up new VNets, you can connect to your transit VNet with VNet peering. This prevents adding complexity to your network and reduces management overhead of managing multiple gateways and other appliances.<\/p>\n\n\n\n

VNet peering works across regions, across subscriptions, across deployment models (classic to ARM), and across subscriptions belonging to different Azure Active Directory tenants.<\/p>\n\n\n\n

You can create a Transit VNet like one shown below.<\/p>\n\n\n\n

\"Creating<\/figure>\n\n\n\n

Easy to set up \u2013 just check a box!<\/h2>\n\n\n\n

To use this powerful capability, simply check a box.<\/p>\n\n\n\n

Create or update the virtual network peering from Hub-RM to Spoke-RM inside the Azure portal. Navigate to the Hub-RM VNet or the VNet with the gateway you\u2019d like to use for gateway transit, and select Peerings<\/strong>, then Add<\/strong>:<\/p>\n\n\n\n