Azure VNet Peering
Tags: azure, vnet, peering, function
Published: 2021-01-03 13:40:31


## Table of Contents
1 [Current project situation](#currentprojectsituation)  
2 [Hub and Spoke network](#"hubspokenetwork)  
3 [VNet Peering](#vnetpeering)  
4 [Lab](#lab)  
4.1 [Lab Topology](#labtopology)  
4.2 [Lab VNet](#labvnet)  
4.2.1 [Lab VNet Peering](#labvnetpeering)  
4.3 [Lab Functions](#labfunctions)  
4.3.1 [Lab Functions - VNet ](#labfunctionsvnet)  
4.3.2 [Functions - Access Restrictions](#labfunctionsaccessrestrictions)  
4.4 [Lab API Management](#labapim)  
4.4.1 [Lab API Management - VNet](#labapimvnet)  
4.5 [Lab Data Flow and Requests](#labdataflow)  
4.5.1 [VM Cloud to On-Premise-Function ](#labdataflowcloudonpremise)  
4.5.2 [VM On-Premise to On-Premise-Function](#labdataflowonpremiseonpremise)  
4.5.3 [VM Cloud to Cloud-Function](#labdataflowcloudcloud)  
4.5.4 [VM On-Premise to Cloud-Function](#labdataflowonpremisecloud)  
5 [Code and Deployment](#codedeployment)  
6 [Further information](#furtherinformation)  


## 1 Current project situation <a id="currentprojectsituation"></a>

Our current project contains about 20 [Azure Functions Apps](https://docs.microsoft.com/en-us/azure/azure-functions/) in  [Premium Plan](https://docs.microsoft.com/en-us/azure/azure-functions/functions-scale#premium-plan). These Functions Apps are connected with an [Express Route](https://docs.microsoft.com/en-us/azure/expressroute/expressroute-introduction) to the On-Premise network and use a VNET subnet which is part of the On-Premise network.

This setup has a few drawbacks:
- Based on the permissions, network changes can only be done by the company network group and not by the project group.
- Because it's the same network, subnets and IP addresses are limited
- Azure Function Apps running in a Premium Plan can [scale out to 100 instances](https://docs.microsoft.com/en-us/azure/azure-functions/functions-scale#how-the-consumption-and-premium-plans-work). Which means up to 100 IPs will be required for running the Azure Function Apps.

## 2 Hub and Spoke network <a id="hubspokenetwork"></a>

![Hub and Spoke network](https://docs.microsoft.com/en-us/learn/modules/hub-and-spoke-network-architecture/media/2-hub-and-spoke.png)
[Implement a hub-spoke network topology on Azure](https://docs.microsoft.com/en-us/learn/modules/hub-and-spoke-network-architecture/2-implement-hub-spoke)


> The hub is a virtual network in Azure that acts as a central point of connectivity to your on-premises network. The spokes are virtual networks that peer with the hub, and can be used to isolate workloads. Traffic flows between the on-premises datacenter and the hub through an ExpressRoute or VPN gateway connection.

![Hub and Spoke network](https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/images/hub-spoke.png)
[Hub-spoke network topology in Azure](https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/hub-spoke)

## 3 VNet Peering <a id="vnetpeering"></a>

With [VNet Peering](https://docs.microsoft.com/de-de/azure/virtual-network/virtual-network-peering-overview), Azure [Virtual Networks](https://docs.microsoft.com/de-de/azure/virtual-network/virtual-networks-overview) can be connected:

> Azure supports the following types of peering:
- Virtual network peering: Connect virtual networks within the same Azure region.
- Global virtual network peering: Connecting virtual networks across Azure regions.

## 4 Lab <a id="lab"></a>

For evaluation purpose, a lab has to be created with the following resources:
- Azure Function Apps
- Azure API Management
- VNets
- VMs
  - for connection testing

All resources are deployed in the same region.

The lab simulates a Hub and Spoke network.
HTTP-Requests are made from VMs to test the data flow.


![peering-azure-resources.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1609666230598/gFnafsFFh.png)

### 4.1 Lab Topology <a id="labtopology"></a>

The lab consists of two VNets:
- vnet-cloud
  - 172.16.0.0/16
  - Spoke
- vnet-on-premise
  - 10.0.0.0/8
  - Hub and simulates the On-Premise-Network
    - simpler setup 

API Management provides HTTP-Endpoints which forwards the requests to the Functions.


![peering-azure-topology.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1609673547510/lR8zkC3tY.png)


### 4.2 Lab VNet <a id="labvnet"></a>

_vnet-cloud_ with three subnets:

- snet-vnet-cloud-backends
  - 172.16.64.0/19
  - for VM for making Http-requests
- snet-vnet-cloud-apim
  - 172.16.252.0/22
  - for API Management
- snet-vnet-cloud-resources
  - 172.16.32.0/19 
  - for Azure Function App

![peering-vnet-cloud-subnet.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1609612833469/cON8xmN1y.png)

_vnet-on-premise_ with two subnets:

- snet-vnet-on-premise-backends
  - 10.96.0.0/11
  - for VM for making Http-requests
- snet-vnet-on-premise
  - 10.128.0.0/9
  - for Azure Function App which represents a on-premise system

![peering-vnet-onpremise-subnet.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1609612896571/3F2tE0vBu.png)

#### 4.2.1 Lab VNet Peering <a id="labvnetpeering"></a>

Both VNet Peerings are created with an ARM Template in the same subscription.
Please check the [How-To Guide](https://docs.microsoft.com/en-us/azure/virtual-network/) if you want to create VNet Peering in different Subscriptions or with different deployment models.

![peering-vnet-cloud-peering.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1609613054849/qRTpDw1kI.png)

![peering-vnet-on-premise-peering.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1609613040497/nsrPbr8Ux.png)



### 4.3 Lab Functions <a id="labfunctions"></a>

[Azure Functions networking options](https://docs.microsoft.com/de-de/azure/azure-functions/functions-networking-options)
> VNet Integration depends on use of a dedicated subnet. When you provision a subnet, the Azure subnet loses 5 IPs for from the start.

Two Azure Functions Apps with HttpTrigger are deployed in the different VNets:

- [https://func-cloud.azurewebsites.net/api/cloudtrigger](https://func-cloud.azurewebsites.net/api/cloudtrigger)
- [https://func-on-premise.azurewebsites.net/api/onpremisetrigger](https://func-on-premise.azurewebsites.net/api/onpremisetrigger)


Function _func-on-premise_ in VNET *vnet-on-premise* simualtes a On-Premise-System with Http-Endpoint.

#### 4.3.1 Lab Functions - VNet <a id="labfunctionsvnet"></a>

At least the Azure Function [Premium Plan](https://docs.microsoft.com/en-us/azure/azure-functions/functions-networking-options) has to be used to configure Functions Apps with [VNet integration](https://docs.microsoft.com/en-us/azure/azure-functions/functions-create-vnet).

![peering-func-cloud-vnet.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1609611511675/txdANiJ8-.png)

The storage accounts are also part of the (VNet)[https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security]:


![peering-storageaccount-cloud-vnet.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1609661158895/6iZiLXeS1.png)

#### 4.3.2 Functions - Access Restrictions <a id="labfunctionsaccessrestrictions"></a>

Following [Access Restrictions](https://docs.microsoft.com/en-us/azure/app-service/app-service-ip-restrictions) are configured for the Function App to allow only requests from API Management:

![peering-function-cloud-accessrestrictions.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1609611492697/WXLgqJy55.png)

So, the Function App can only be accessed from Subnet _snet-vnet-cloud-apim_ _172.16.252.0/22_.

![peering-function-cloud-forbidden-shell.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1609611779407/oq6LXDlnF.png)


![peering-function-cloud-forbidden-shell-vm-oncloud.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1609611765183/lbLOc0vNB.png)


![peering-function-cloud-forbidden-shell-vm-onpremise.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1609611771131/lwkoGvk0L.png)

### 4.4 Lab API Management <a id="labapim"></a>

[API Management](https://docs.microsoft.com/en-us/azure/api-management/) has one API with two operations which forwards the requests to the Azure Function Apps:

![peering-apim-apis.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1609612281418/QbPniTMXg.png)

**Policies**:

*/evaluation/cloud*

cloud-function: https://func-cloud.azurewebsites.net/api
```xml
    <inbound>
        <base />
        <set-backend-service base-url="{{cloud-function}}" />
        <rewrite-uri template="/CloudTrigger" copy-unmatched-params="true" />
    </inbound>
```

*/evaluation/onpremise*:

on-premise-function: https://func-on-premise.azurewebsites.net/api
```xml
    <inbound>
        <base />
        <set-backend-service base-url="{{on-premise-function}}" />
        <rewrite-uri template="/OnPremiseTrigger" copy-unmatched-params="true" />
    </inbound>
```

#### 4.4.1 Lab API Management - VNet <a id="labapimvnet"></a>

API Management is part of the [VNet](https://docs.microsoft.com/en-us/azure/api-management/api-management-using-with-vnet) subnet _snet-vnet-cloud-apim_ and deployed as an [internal VNet](https://docs.microsoft.com/en-us/azure/api-management/api-management-using-with-internal-vnet).

![peering-apim-vnet.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1609612632359/_vkE2uHUQ.png)

### 4.5 Lab Data Flow and Requests <a id="labdataflow"></a>


#### 4.5.1 VM Cloud to On-Premise-Function <a id="labdataflowcloudonpremise"></a>

A request from the Cloud-VNet to API Management forwards the request to the Function in the On-Premise-VNet:



![peering-cloud-onpremise-mermaid-diagram-20210102172827.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1609605012252/3aS2kw8-0.png)

[Mermaid](https://mermaid-js.github.io/mermaid-live-editor/#/edit/eyJjb2RlIjoic2VxdWVuY2VEaWFncmFtXG4gICAgTm90ZSBsZWZ0IG9mIFZNIENsb3VkOjE3Mi4xNi42NC4wLzE5XG4gICAgVk0gQ2xvdWQtPj5BUElNOiBHRVQgL2V2YWx1YXRpb24vb25wcmVtaXNlXG4gICAgTm90ZSBsZWZ0IG9mIEFQSU06MTcyLjE2LjI1Mi4wLzIyXG4gICAgQVBJTS0-PmZ1bmMtb24tcHJlbWlzZTogR0VUIC9hcGkvb25wcmVtaXNldHJpZ2dlclxuICAgIE5vdGUgbGVmdCBvZiBmdW5jLW9uLXByZW1pc2U6MTAuMTI4LjAuMC85XG4gICAgZnVuYy1vbi1wcmVtaXNlLT4-QVBJTTogMjAwXG4gICAgQVBJTS0tPj5WTSBDbG91ZDogMjAwXG5cbiAgICAgICAgICAgICIsIm1lcm1haWQiOnt9LCJ1cGRhdGVFZGl0b3IiOmZhbHNlfQ)

```bash
curl https://apim-eval-peering.azure-api.net/evaluation/onpremise
```

![peering-curl-cloud-on-premise.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1609664635578/potzgz7u1.png)

#### 4.5.2 VM On-Premise to On-Premise-Function <a id="labdataflowonpremiseonpremise">

A request from the On-Premise-VNet to API Management forwards the request to the Function in the On-Premise-VNet:

![peering-onpremise-onpremise-mermaid-diagram-20210102172344.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1609605400592/fpyOXjlWh.png)

[Mermaid](https://mermaid-js.github.io/mermaid-live-editor/#/edit/eyJjb2RlIjoic2VxdWVuY2VEaWFncmFtXG4gICAgTm90ZSBsZWZ0IG9mIFZNIE9uLVByZW1pc2U6MTAuOTYuMC4wLzExXG4gICAgVk0gT24tUHJlbWlzZS0-PkFQSU06IEdFVCAvZXZhbHVhdGlvbi9vbnByZW1pc2VcbiAgICBOb3RlIGxlZnQgb2YgQVBJTToxNzIuMTYuMjUyLjAvMjJcbiAgICBBUElNLT4-ZnVuYy1vbi1wcmVtaXNlOiBHRVQgL2FwaS9vbnByZW1pc2V0cmlnZ2VyXG4gICAgTm90ZSBsZWZ0IG9mIGZ1bmMtb24tcHJlbWlzZToxMC4xMjguMC4wLzlcbiAgICBmdW5jLW9uLXByZW1pc2UtPj5BUElNOiAyMDBcbiAgICBBUElNLS0-PlZNIE9uLVByZW1pc2U6IDIwMFxuXG4gICAgICAgICAgICAiLCJtZXJtYWlkIjp7fSwidXBkYXRlRWRpdG9yIjpmYWxzZX0)

```bash
curl https://apim-eval-peering.azure-api.net/evaluation/onpremise
```

![peering-curl-on-premise-on-premise.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1609664704255/YqdoN5rv3.png)

#### 4.5.3 VM Cloud to Cloud-Function <a id="labdataflowcloudcloud">

A request from the Cloud-VNet to API Management forwards the request to the Function in the Cloud-VNet:

![peering-cloud-cloud-mermaid-diagram-20210102180822.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1609607354340/t2UEQfIY5.png)
[Mermaid](https://mermaid-js.github.io/mermaid-live-editor/#/edit/eyJjb2RlIjoic2VxdWVuY2VEaWFncmFtXG4gICAgTm90ZSBsZWZ0IG9mIFZNIENsb3VkOjE3Mi4xNi42NC4wLzE5XG4gICAgVk0gQ2xvdWQtPj5BUElNOiBHRVQgL2V2YWx1YXRpb24vY2xvdWRcbiAgICBOb3RlIGxlZnQgb2YgQVBJTToxNzIuMTYuMjUyLjAvMjJcbiAgICBBUElNLT4-ZnVuYy1jbG91ZDogR0VUIC9hcGkvY2xvdWR0cmlnZ2VyXG4gICAgTm90ZSBsZWZ0IG9mIGZ1bmMtY2xvdWQ6MTcyLjE2LjMyLjAvMTlcbiAgICBmdW5jLWNsb3VkLT4-QVBJTTogMjAwXG4gICAgQVBJTS0tPj5WTSBDbG91ZDogMjAwXG5cbiAgICAgICAgICAgICIsIm1lcm1haWQiOnt9LCJ1cGRhdGVFZGl0b3IiOmZhbHNlfQ)

```bash
curl https://apim-eval-peering.azure-api.net/evaluation/cloud
```

![peering-curl-cloud-cloud.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1609665585360/HyXR_yGnm.png)

#### 4.5.4 VM On-Premise to Cloud-Function <a id="labdataflowonpremisecloud">

A request from the On-Premise-VNet to API Management forwards the request to the Function in the Cloud-VNet:


![peering-onpremise-cloud-mermaid-diagram-20210102180117.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1609607070695/5HlHb91Wv.png)
[Mermaid](https://mermaid-js.github.io/mermaid-live-editor/#/edit/eyJjb2RlIjoic2VxdWVuY2VEaWFncmFtXG4gICAgTm90ZSBsZWZ0IG9mIFZNIE9uLVByZW1pc2U6MTAuOTYuMC4wLzExXG4gICAgVk0gT24tUHJlbWlzZS0-PkFQSU06IEdFVCAvZXZhbHVhdGlvbi9jbG91ZFxuICAgIE5vdGUgbGVmdCBvZiBBUElNOjE3Mi4xNi4yNTIuMC8yMlxuICAgIEFQSU0tPj5mdW5jLWNsb3VkOiBHRVQgL2FwaS9jbG91ZHRyaWdnZXJcbiAgICBOb3RlIGxlZnQgb2YgZnVuYy1jbG91ZDoxNzIuMTYuMzIuMC8xOVxuICAgIGZ1bmMtY2xvdWQtPj5BUElNOiAyMDBcbiAgICBBUElNLS0-PlZNIE9uLVByZW1pc2U6IDIwMFxuXG4gICAgICAgICAgICAiLCJtZXJtYWlkIjp7fSwidXBkYXRlRWRpdG9yIjpmYWxzZX0)

```bash
curl https://apim-eval-peering.azure-api.net/evaluation/cloud
```

![peering-curl-on-premise-cloud.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1609665626835/fHQaEtH1_.png)

## 5 Code and Deployment <a id="codedeployment">

The entire code can be found in [GitHub](https://github.com/MarkusMeyer13/Azure-VNet-Peering).

All the resources (Azure resources, Function Apps, VMs) can be deployed with a script:

```bash
bash deploy.sh
```
Deploy only Azure resources:

[![Deploy To Azure](https://raw.githubusercontent.com/Azure/azure-quickstart-templates/master/1-CONTRIBUTION-GUIDE/images/deploytoazure.svg?sanitize=true)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FMarkusMeyer13%2FAzure-VNet-Peering%2Fmaster%2Fazuredeploy.json)  [![Visualize](https://raw.githubusercontent.com/Azure/azure-quickstart-templates/master/1-CONTRIBUTION-GUIDE/images/visualizebutton.svg?sanitize=true)](http://armviz.io/#/?load=https%3A%2F%2raw.githubusercontent.com%2FMarkusMeyer13%2FAzure-VNet-Peering%2Fmaster%2Fazuredeploy.json)


## 6 Further information <a id="furtherinformation">


[Choosing between Azure VNet Peering and VNet Gateways](https://azure.microsoft.com/de-de/blog/vnet-peering-and-vpn-gateways/)
- VNet peering - connecting VNets within the same Azure region
- Global VNet peering - connecting VNets across Azure regions


[Enable containers to use Azure Virtual Network capabilities](
https://docs.microsoft.com/en-us/azure/virtual-network/container-networking-overview)