Azure Virtual Network Gateway - Access resources in other resource groups

1
votes

Let's take the following scenario:

  • I have a resource group in the East Region with 1 VM
  • I have a resource group in the West Region with 1 VM

Both of these VMs are only accessible via Private IP addresses. RDP via Public IP address is not an option. One would assume that in order for me to RDP to these machines, I would have to VPN into Azure's gateway first. However, I don't want to create a virtual gateway in every single resource group.

Is it possible for me to vpn into one resource (in one resource group), and access all of the machines in all other resource groups?

2
azureazure-virtual-network

2 Answers

1
votes

You can use vnet peering with Use remote gateways checkbox enabled. You need to peer the vnets together and check use remote gateways on the second vnet (one without gateway).

Reading:
https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/hub-spoke
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview

1
votes

Yes, It's possible to do this with VNet peering(connecting VNets within the same Azure region). You could follow this to implement a hub-spoke network topology in Azure. In this case, the hub VNet is a peering VNet with allow gateway transit enabled and the spoke VNet is a peering VNet with use remote gateways enabled.

please note that you cannot use remote gateways or allow gateway transit with global peering(connecting VNets across Azure regions). Refer to requirements and constraints about global peering.

To use remote gateways or allow gateway transit, peered virtual networks in must be in the same region.

so you have to move the peering VNets in the same region if the two VNets in each resource group are not in the same region.

Another option will create a separate VPN gateway in another resource group but this is not your expectation. Note that

A Point-to-Site client can only connect to resources in the VNet in which the virtual network gateway resides.

Refer to VPN gateway FAQ.