Realize cross tenant Vnet connection through azure virtual Wan

Span Tenant Of VNET Interconnection is generally not particularly common , But it's not an invisible scene , A long time ago, I actually wrote an article about how to cross tenant establish VNET Peering Of blog, It introduces the cross tenant How to create VNET Peering, If you are interested, take a look

​ ​ Span tenant establish Azure Global Private Peering ​​

And in addition to this way , You can also pass another Azure Network services for - Azure Virtual WAN To achieve this cross tenant Of VNET Interconnection requirements , In essence, they are all built behind VNET Peering, It's just that for users, the entry and application scenarios are different

Suppose there are only individuals VNET There is a need , In fact, it doesn't matter which way you use , But for large-scale network models , Use Virtual WAN It can greatly simplify the complexity of deployment and maintenance

And this is also Virtual WAN One of its biggest advantages

About Virtual WAN, This is a service that has appeared in recent twoorthree years , It should be more mature now ,Virtual WAN Count as Azure One of the core services in large-scale networking , It can well integrate complex network architecture , Simplify complex problems , It seems to be familiar before ER、Site2Site VPN、P2S VPN,VNET Peering This common networking service can be integrated into Virtual WAN in , And flexibly control route propagation

In addition to large-scale networking, it is recommended to use Virtual WAN outside , Small scale applications are also applicable , Because we also need to consider the scalability of the organization , If the architectural level leaves room from the beginning , It will be much easier to expand in the future , So for some enterprises that can obviously see expansion opportunities in the future , You can try to use it from the beginning Virtual WAN networking

Back to this topic , This time it's just a simple demo, Let's demonstrate through Virtual WAN Put the two in different region, Different tenant Of VNET Connect together , The general structure is as follows

Basically very simple , Don't need too much introduction , If you want to let Tenant A Under the VNET A and Tenant B Under the VNET B If connected , Just put two VNET All connected to Virtual WAN Medium HUB that will do , Two VNET Can automatically create peering Connect , If there are more VNET, Only need to add to Hub, You can realize multi-party interconnection , No need to be like VNET Peering That is restricted by non transitivity

First of all, I need to give tenant A User authorization in Tenant B Medium VNET B, Only in this way can VNET B Connect to Virtual WAN Medium hub, This is through the Azure AD B2B Realized , And previous span tenant establish VNET Peering It's the same thing

Switch directories in another account , You can see the authorized resource

At present, this kind of cross tenant There is still no way to connect portal perform , So only through PowerShell perhaps CLI To do it

stay Tenant A Give orders , First switch to Tenant B Get VNET Information

Log in and copy

      
      

       
       Connect-AzAccount 
       
       -
       
       SubscriptionId 
       
       "TenantB_SUB_ID" 
       
       -
       
       TenantId 
       
       "TenantB ID" 
       
       -
       
       UseDeviceAuthentication
       
       

       
       Get-AzVirtualNetwork 
       
       |
       
       ft 
       
       name
      
      
      
      

       
       
1.
       
       
2.
      
      

obtain VNET Information

Log in and copy

      
      

       
       $VNET 
       
       = 
       
       Get-AzVirtualNetwork
      
      
      
      

       
       
1.
      
      

Switch back to the Tenant A, You can see that it is different from Tenant B,Tenant A There are three below VNET

Log in and copy

      
      

       
       Connect-AzAccount 
       
       -
       
       SubscriptionId 
       
       "TenantA_SUB_ID" 
       
       -
       
       TenantId 
       
       "TenantA ID" 
       
       -
       
       UseDeviceAuthentication
       
       

       
       Get-AzVirtualNetwork
       
       |
       
       Measure-Object
      
      
      
      

       
       
1.
       
       
2.
      
      

Create to Virtual Hub Of Connection

Log in and copy

      
      

       
       New-AzVirtualHubVnetConnection 
       
       -
       
       ResourceGroupName 
       
       VWAN 
       
       -
       
       VirtualHubName 
       
       'VHub' 
       
       -
       
       Name 
       
       "EastAsiaCon" 
       
       -
       
       RemoteVirtualNetwork 
       
       $VNET
      
      
      
      

       
       
1.
      
      

You can see the connection

VM You can also normally access the opposite end VNET