Understanding Azure Transit Gateways – Insights and Sample Scenario

Introduction

This blog aims to demystify the concept of transit gateways, breaking it down into easy-to-understand components. We’ll explore what transit gateways are, how they work within Azure’s networking framework, and why they are needed.

Core Networking Concepts: The Basics

Before diving into transit gateways, let’s establish some foundational networking concepts in Azure:

Virtual Networks (VNets)

Think of VNets as isolated containers in Azure where we can launch our cloud resources, like virtual machines and applications. They are our private network in the cloud.

Peering and the Hub-Spoke Model

• Peering: This is the process of linking two VNets so that resources in one can communicate with those in the other, just like they’re in the same network.
• Hub-Spoke Model: This is a popular network topology in Azure. Imagine a bicycle wheel where the hub is the central VNet connected to all other VNets (the spokes). 

What is a Transit Gateway in Azure?

In Azure,a transit gateway not a separate service or resource but a feature within the VNet peering service, known as ‘Gateway Transit’. The Gateway transit feature enables one virtual network to use the VPN gateway in another virtual network for cross-premises connectivity.

Gateway Transit: The Bridge

Gateway transit is about sharing resources, specifically network gateways between peered netweorks. A network gateway in Azure is like a door that connects our Azure network to another network (like your on-premises network).

Scenario Without Gateway Transit

Imagine we have several VNets (spokes) that all need to access our on-premises network. Without gateway transit, each VNet would need its own gateway, leading to increased complexity and cost.

Enter Gateway Transit

With gateway transit enabled, one VNet (the hub) houses the gateway to our on-premises network. The other VNets (spokes) use this gateway to access the on-premises network without needing their own gateways. It’s like having a central bus station in a city where all buses converge, making travel more efficient.

Key Benefits of Using Gateway Transit

1. Cost Efficiency: Reduces the need for multiple gateways.
2. Simplified Management: Centralizes network management.
3. Scalability: Easily add new VNets without worrying about individual gateways.

Sample Scenario: Demonstrating Gateway Transit in Azure

In this section, we’ll outline a practical scenario to demonstrate how Gateway Transit works in Azure using a hub-and-spoke network model. 

Setup Overview

1. Network Configuration
   • VNet A and VNet B: These are our spoke VNets. They represent separate network segments that need to communicate with each other and potentially access external resources.
   • VNet C (The Hub): This VNet acts as the central hub in our scenario. It contains the VPN gateway, which provides connectivity to external networks, like our on-premises network.
2. Gateway Deployment
   • In VNet C: Deploy a VPN gateway (or ExpressRoute gateway, depending on your connectivity requirements). This gateway will serve all the VNets in the setup.
3. VNet Peering
   • Peering VNet A and VNet B with VNet C: Create a peering connection between each spoke VNet (A and B) and the hub VNet (C).
     • Ensure we enable the “Use remote gateways” option in the peering settings for VNets A and B. E.g. Enable ‘VNetA’ to use the peered virtual networks’ remote gateway.
     • Ensure we check the “Allow gateway transit” option in VNet C’s peering settings. E.g. Allow gateway in ‘VNetC’ to forward traffic to the peered virtual network.
4. Route Table Configuration
   • For VNet A and VNet B: Set up the route tables to ensure that traffic destined for external networks is routed to VNet C.
5. Testing Connectivity
   • Deploy VMs: Place virtual machines in VNets A and B.
   • Connectivity Test: Perform tests to verify that VMs in VNet A and B can communicate with each other and with external resources through VNet C’s gateway.

Considerations for the Scenario

• Non-Overlapping IP Ranges: Ensure that VNets A, B, and C have unique IP address ranges to avoid routing conflicts.
• Network Security: Configure Network Security Groups (NSGs) to permit the required traffic between the VNets.
• Monitoring Tools: Utilize Azure’s Network Watcher for monitoring network traffic and for troubleshooting any issues.

Conclusion

Understanding transit gateways in Azure is crucial for building efficient, scalable, and cost-effective peered networks. By leveraging the gateway transit feature, we can simplify our network architecture, reduce costs, and ensure seamless connectivity across our cloud and on-premises environments. In our sample scenario, we demonstrated the utility and efficiency of Azure’s Gateway Transit feature in a hub-and-spoke network architecture. 

See also

Read about configuring VPN gateway transit for virtual network peering: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-peering-gateway-transit