Routing traffic in Azure VPN

3
votes

I have 3 VNets, 3 Point-2-Site VPN Gateways, one for each Vnet, and VNet peering is setup as below image.

enter image description here

What I want to achieve is:

  1. If I use VPN1, I can ping all VMs in all 3 VNets.
  2. If I use VPN2, I can only ping VMs in VNet 2 and 1.
  3. If I use VPN3, I can only ping VMs in VNet 3 and 1.

As I understand, to achieve 1, I have to allow forwarded traffic in both peering. But then, 2 and 3 cannot be fulfilled - I can ping all VMs regardless what VPN I use. Is that correct?

What should be the right way to do this?

Update: For more details, here's my use case:

In VNet 1, I have an Intranet server, which should be available for everyone.

In VNet 2, I have a development server.

In VNet 3, I have a test server.

A manager should be able to access all servers --> VPN1.

A developer should be able to access the Intranet and the Dev server --> VPN2

A tester should be able to access the Intranet and the Test server --> VPN3

1
azurevpntrafficnetwork-trafficazure-vpn

1 Answers

2
votes

For your requirements, I believe you could achieve it via configuring VPN gateway transit for virtual network peering a hub-and-spoke network architecture. In this network architecture, you need to deploy one VPN gateway in the VNet1(as the hub) and peer with the other two VNets(as the spoke) instead of deploying VPN gateways in every spoke virtual network. Routes to the gateway-connected virtual networks or on-premises networks will propagate to the routing tables for the peered virtual networks using gateway transit.

The following diagram shows how gateway transit works with virtual network peering. enter image description here

In this case, you could configure the VNet1 peers with VNet2 and VNet1 peers with VNet3 each other.

On the peering from VNet1 to VNet2 and VNet1 to VNet3, enable the Allow gateway transit option. On the peering from VNet2 to VNet1 and VNet3 to VNet1, set the Use remote gateways option.