Unable to ping azure vm1 to azure vm2

Question

I am trying to implement hub and spoke POC in azure playground. However all resources got implemented but I still can't ping vm1 to vm2 or vice versa. Below is the code. Please note that I have as pic I have allowed wild card in both vms nsg ports in inbound port. I have deployed vm1 in subnet1 and vm2 in subnet2

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "3.115.0"
    }
    tls = {
      source  = "hashicorp/tls"
      version = "~>4.0"
    }
  }
}

provider "azurerm" {
  
  features {}
  skip_provider_registration = true
}

data "azurerm_resource_group" "myrg" {
  name = "1-cace0afe-playground-sandbox"
}

# Hub VNet
resource "azurerm_virtual_network" "hub_vnet" {
  name                = "hub-vnet"
  address_space       = ["10.0.0.0/16"]
  location            = data.azurerm_resource_group.myrg.location
  resource_group_name = data.azurerm_resource_group.myrg.name
}

# Spoke 1 VNet
resource "azurerm_virtual_network" "spoke1_vnet" {
  name                = "spoke1-vnet"
  address_space       = ["10.1.0.0/16"]
  location            = data.azurerm_resource_group.myrg.location
  resource_group_name = data.azurerm_resource_group.myrg.name
}

# Spoke 2 VNet
resource "azurerm_virtual_network" "spoke2_vnet" {
  name                = "spoke2-vnet"
  address_space       = ["10.2.0.0/16"]
  location            = data.azurerm_resource_group.myrg.location
  resource_group_name = data.azurerm_resource_group.myrg.name
}

# Hub Subnet
resource "azurerm_subnet" "hub_subnet" {
  name                 = "hub-subnet"
  resource_group_name  = data.azurerm_resource_group.myrg.name
  virtual_network_name = azurerm_virtual_network.hub_vnet.name
  address_prefixes     = ["10.0.1.0/24"]
}

# Spoke 1 Subnet
resource "azurerm_subnet" "spoke1_subnet" {
  name                 = "spoke1-subnet"
  resource_group_name  = data.azurerm_resource_group.myrg.name
  virtual_network_name = azurerm_virtual_network.spoke1_vnet.name
  address_prefixes     = ["10.1.1.0/24"]
}

# Spoke 2 Subnet
resource "azurerm_subnet" "spoke2_subnet" {
  name                 = "spoke2-subnet"
  resource_group_name  = data.azurerm_resource_group.myrg.name
  virtual_network_name = azurerm_virtual_network.spoke2_vnet.name
  address_prefixes     = ["10.2.1.0/24"]
}

resource "azurerm_virtual_network_peering" "hub_to_spoke1" {
  name = "hub-to-spoke1"
  remote_virtual_network_id = azurerm_virtual_network.spoke1_vnet.id
  virtual_network_name = azurerm_virtual_network.hub_vnet.name
  resource_group_name = data.azurerm_resource_group.myrg.name
  allow_virtual_network_access =true 
  allow_gateway_transit = true
  allow_forwarded_traffic = true
  use_remote_gateways = false
}

resource "azurerm_virtual_network_peering" "spoke1_to_hub" {
  name = "spoke1-to-hub"
  remote_virtual_network_id = azurerm_virtual_network.hub_vnet.id
  virtual_network_name = azurerm_virtual_network.spoke1_vnet.name
  resource_group_name = data.azurerm_resource_group.myrg.name
  allow_virtual_network_access =true 
  allow_gateway_transit = false
  allow_forwarded_traffic = true
  use_remote_gateways = false
}


resource "azurerm_virtual_network_peering" "hub_to_spoke2" {
  name = "hub-to-spoke2"
  remote_virtual_network_id = azurerm_virtual_network.spoke2_vnet.id
  virtual_network_name = azurerm_virtual_network.hub_vnet.name
  resource_group_name = data.azurerm_resource_group.myrg.name
  allow_virtual_network_access =true 
  allow_gateway_transit = true
  allow_forwarded_traffic = true
  use_remote_gateways = false
}

resource "azurerm_virtual_network_peering" "spoke2_to_hub" {
  name = "spoke2-to-hub"
  remote_virtual_network_id = azurerm_virtual_network.hub_vnet.id
  virtual_network_name = azurerm_virtual_network.spoke2_vnet.name
  resource_group_name = data.azurerm_resource_group.myrg.name
  allow_virtual_network_access =true 
  allow_gateway_transit = false
  allow_forwarded_traffic = true
  use_remote_gateways = false
}

resource "azurerm_public_ip" "pipip1" {
  allocation_method = "Static"
  location = data.azurerm_resource_group.myrg.location
  name = "pip1"
  resource_group_name = data.azurerm_resource_group.myrg.name
}

resource "azurerm_public_ip" "pipip2" {
  allocation_method = "Static"
  location = data.azurerm_resource_group.myrg.location
  name = "pip2"
  resource_group_name = data.azurerm_resource_group.myrg.name
}

resource "azurerm_network_interface" "nic1" {
  name = "nic1"
  resource_group_name = data.azurerm_resource_group.myrg.name
  location = data.azurerm_resource_group.myrg.location
  ip_configuration {
    name = "nic1-ip"
    private_ip_address_allocation = "Dynamic"
    subnet_id = azurerm_subnet.spoke1_subnet.id
    public_ip_address_id = azurerm_public_ip.pipip1.id
  }
}

resource "azurerm_network_interface" "nic2" {
  name = "nic2"
  resource_group_name = data.azurerm_resource_group.myrg.name
  location = data.azurerm_resource_group.myrg.location
  ip_configuration {
    name = "nic2-ip"
    private_ip_address_allocation = "Dynamic"
    subnet_id = azurerm_subnet.spoke2_subnet.id
    public_ip_address_id = azurerm_public_ip.pipip2.id
  }
}

resource "azurerm_linux_virtual_machine" "vm1" {
  name                = "vm1"
  resource_group_name = data.azurerm_resource_group.myrg.name
  location            = data.azurerm_resource_group.myrg.location
  size                = "Standard_B2s"
  admin_username      = "test"
  network_interface_ids = [
    azurerm_network_interface.nic1.id,
  ]

  admin_ssh_key {
    username   = "sharat"
    public_key = file("~/.ssh/id_rsa.pub")
  }

  os_disk {
    caching              = "ReadWrite"
    storage_account_type = "Standard_LRS"
  }

  source_image_reference {
    publisher = "Canonical"
    offer     = "0001-com-ubuntu-server-jammy"
    sku       = "22_04-lts"
    version   = "latest"
  }
}


resource "azurerm_linux_virtual_machine" "vm2" {
  name                = "vm2"
  resource_group_name = data.azurerm_resource_group.myrg.name
  location            = data.azurerm_resource_group.myrg.location
  size                = "Standard_B2s"
  admin_username      = "test"
  network_interface_ids = [
    azurerm_network_interface.nic2.id,
  ]

  admin_ssh_key {
    username   = "sharat"
    public_key = file("~/.ssh/id_rsa.pub")
  }

  os_disk {
    caching              = "ReadWrite"
    storage_account_type = "Standard_LRS"
  }

  source_image_reference {
    publisher = "Canonical"
    offer     = "0001-com-ubuntu-server-jammy"
    sku       = "22_04-lts"
    version   = "latest"
  }
}

Answer 1

The reason VM1 and VM2 are not communicating is that they are in different VNets, and you haven't enabled peering between Spoke VNet1 and Spoke VNet2

To establish communication between VM1 and VM2, you need to create a peering between Spoke1 VNet and Spoke2 VNet. Only then will VM1 and VM2 be able to communicate with each other.

When I tried using the same Terraform configuration that you are using, I also got the same error.

Make sure to enable peering. Add the following Terraform code to your configuration to enable peering between Spoke VNet1 and Spoke VNet2.

resource "azurerm_virtual_network_peering" "spoke1-to-spoke2" {
  name                      = "spoke1-to-spoke2"
  resource_group_name       = azurerm_resource_group.myrg.name
  virtual_network_name      = azurerm_virtual_network.spoke1_vnet.name
  remote_virtual_network_id = azurerm_virtual_network.spoke2_vnet.id
   allow_virtual_network_access =true 
  allow_gateway_transit = false
  allow_forwarded_traffic = true
  use_remote_gateways = false
}
resource "azurerm_virtual_network_peering" "spoke2-to-spoke1" {
  name                      = "spoke2-to-spoke1"
  resource_group_name       = azurerm_resource_group.myrg.name
  virtual_network_name      = azurerm_virtual_network.spoke2_vnet.name
  remote_virtual_network_id = azurerm_virtual_network.spoke1_vnet.id
   allow_virtual_network_access =true 
  allow_gateway_transit = false
  allow_forwarded_traffic = true
  use_remote_gateways = false
}

Terraform Apply

After enabling the peering, the both the VM's are started communicating each other.