Use the hub's VPN gateway from a spoke

The hub's VPN gateway, vgw-hub, connects Azure to the on-premises site. vm-spoke1 needs srv-onprem, a server on-premises, on 443. Let the spoke use the hub's gateway instead of building its own.

1. Look at vm-spoke1's routes. Nothing points on-premises yet.

   az network nic show-effective-route-table -g rg-lab --name vm-spoke1-nic -o tableType it
   What's this?

   Lists every route that applies to a VM's network interface: system routes, gateway routes and your route tables, and which are active.

   • -g the resource group the resources live in
   • --name the name of the thing to look at or change

2. Let the hub's gateway serve its peers.

   az network vnet peering update -g rg-lab --vnet-name vnet-hub --name hub-to-spoke1 --allow-gateway-transit trueType it
   What's this?

   Connects two virtual networks, or changes what the connection allows. A peering needs a link from each side.

   • -g the resource group the resources live in
   • --vnet-name the virtual network
   • --name the name of the thing to look at or change
   • --allow-gateway-transit true on the hub's side of the peering

3. Let the spoke use it.

   az network vnet peering update -g rg-lab --vnet-name vnet-spoke1 --name spoke1-to-hub --use-remote-gateways trueType it
   What's this?

   Connects two virtual networks, or changes what the connection allows. A peering needs a link from each side.

   • -g the resource group the resources live in
   • --vnet-name the virtual network
   • --name the name of the thing to look at or change
   • --use-remote-gateways true on the spoke's side, after the hub allows transit

4. Look at the routes again.

   az network nic show-effective-route-table -g rg-lab --name vm-spoke1-nic -o tableType it
   What's this?

   Lists every route that applies to a VM's network interface: system routes, gateway routes and your route tables, and which are active.

   • -g the resource group the resources live in
   • --name the name of the thing to look at or change

5. Connect to vm-spoke1.

   ssh vm-spoke1Type it
   What's this?

   Opens a shell on vm-spoke1, so the next commands run on that VM. In this lab it's a shortcut. In real Azure you'd connect through something like Azure Bastion, or SSH to an address you can reach.

6. Test srv-onprem on 443. Type exit when done.

   nc -zv 192.168.10.5 443Type it
   What's this?

   netcat, a standard Linux tool. Tries to open a TCP connection and reports whether it worked.

   • -z only check whether the port answers. Send no data
   • -v print the result in words
   • 192.168.10.5 where to connect
   • 443 the port to try

7. Answer the question below.

   What next hop type do the on-premises routes show in vm-spoke1's effective routes?

   Next hop

   Where Azure sends a packet next, such as a virtual appliance, the local network, or the internet.

   On-premises

   Your own network outside Azure, such as an office or a datacenter.

   Effective routes

   Every route that applies to a network interface, after Azure combines its own routes and yours.

   Check