Search code examples
azurevpngatewaytunnel

Connect 2 virtual machines in different countries through Azure cloud

I want to connect 2 virtual machines, one is in North America and the other one in Asia.

When I say I want to connect 2 virtual machines, it is simply that once this tunnel is established, they can talk to each other by IP and connect/talk to each other as if in the same network. Only these 2 machines will talk to each other.

I would like this connection to pass through the Azure cloud as such:

  • Machine in North America will connect to the Azure cloud in North America.
  • Machine in Asia will connect to the Azure could in Asia.
  • Data between North America and Asia will be Azure cloud to Azure cloud only.

I have read on bastion, gateway and other Azure network offerings but I am not certain of what I need to actually make this happen. I feel a bit overwhelmed with all the products Azure offers and I am not sure what I should be using to do what I need.

Solution

  • • Since you want to deploy one of your virtual machines in North America region and the other one in Asia, and further you want the communication between them to happen over Azure cloud itself, then would suggest you to please use the ‘Global VNET peering’ option for this purpose. As you will deploy virtual machines in the respective region’s virtual network which are managed by Azure service fabric’s network resource provider, you can peer these virtual networks which are deployed in their respective regions over Azure’s backbone network itself and accordingly open the ports through the virtual machine’s independent network security group. An illustration of the above scenario is given below: -

    Global VNET peering

    • A second way to connect two VNETs in different locations is by using a VNET-to-VNET connection. A VNET-to-VNET connection is essentially a VPN between the two different Azure locations. The VNET-to-VNET connection is established on a VPN gateway. This means your traffic will incur two additional traffic hops as compared to global VNET peering (the two gateways on each end). This also means that you will incur additional latency, and the VPN gateways can become a bandwidth chokepoint. The one benefit of using a VNET-to-VNET connection is that the traffic between the different Azure regions will be encrypted using IPSEC. VNET peering runs over the Microsoft backbone unencrypted, while a VNET-to-VNET connection uses IPSEC to connect the two VNETs together. An illustration of the above said is given below: -

    VNET-to-VNET connection

    • Also, you can use ‘Expressroute’ to connect VNETs in multiple Azure regions together. Each VNET that is connected to an Expressroute circuit, becomes part of the same routing domain. This means that each VNET that is connected to Expressroute, regardless of whether it is in the same region or in a different region, will have connectivity to each other. The downside of this connection model is that all the traffic is hair pinned over the Expressroute peering location. This means you introduce additional network latency. The connection between the two gateways would happen at the peering location but would not go over the peered network. Meaning, the connection stays on the Microsoft network, but the hairpin happens at the peering location. An illustration of the above said is given below: -

    Expressroute