无法通过对等 VNET 访问 Azure 应用程序网关

Question

I have two peered VNETs in Azure and I also have an Application Gateway in one of them. I have a couple VMs inside both VNETs and I want to access the Application Gateway from the VMs by its private IP (which is set up). This works from the VNET that the gateway resides in but I can't access it from the other peered network. I can access all the VMs between the networks by their private IPs no problem. What can I be missing? (I am not really that familiar with networking, so it can be something basic...). Thank you for any suggestion!

Answer 1

You can check if the two peered virtual networks are located in a different region.

If you are using a Global Vnet peering(Vnet to Vnet region is different), there are some limitations that you can not use Global Vnet peering to communicate with VIPs of load balancers in another region. Application Gateway is actually a layer-7 load balancer.

Resources in one virtual network cannot communicate with the IP address of an Azure internal load balancer in the peered virtual network. The load balancer and the resources that communicate with it must be in the same virtual network.

References: How to setup Global VNet peering in Azure

Answer 2

APIM is a service based on Azure Load balancer. For Stv1 APIM Azure uses Basic Load balancer which does not allow traffic via global peering. [Refer this][1] In order to facilitate traffic via global peering need to use stv2 APIM.[Refer this][2] [1]: https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-manage-peering?tabs=peering-portal#requirements-and-constraints [2]: https://learn.microsoft.com/en-us/azure/api-management/virtual-network-concepts?tabs=stv1.network-resource-requirements