Hub-and-Spoke VNet Peering Topology

A core routing concept is that VNet Peering is non-transitive. This means you cannot route traffic through an intermediate peered network to reach a third network. To connect multiple networks, you must peer each pair directly or implement a hub-and-spoke design where all "spokes" peer only with a central "hub" network. Gateway Transit is a key property in this topology, allowing the hub's gateway to provide on-premises connectivity for all the spokes.

There are important constraints to evaluate. With Global VNet Peering, resources cannot communicate with the front-end IP of a Basic Load Balancer in the remote network. While you can resize a peered network's address space, you must synchronize the peering connection afterward for the change to take effect. Also, name resolution across peered networks requires either Azure Private DNS or a custom DNS server. Finally, data transferred over a peering link incurs nominal ingress and egress charges, so traffic should be monitored for cost management.