VNet Peering, VPN Gateway & ExpressRoute Concepts

Microsoft Azure Networking (AZ-700 track) Azure portal — free tier (GUI + CLI)

مکمل نشان زد کریںMark as completeMark as complete

مقصدObjectiveObjective

VNet peering، VPN Gateway اور ExpressRoute کو سمجھنا — اور لیب میں VNet-to-VNet peering بنانا۔VNet peering, VPN Gateway aur ExpressRoute ko samajhna — aur lab mein VNet-to-VNet peering banana.Understand VNet peering, VPN Gateway, and ExpressRoute — and create a VNet-to-VNet peering in the lab.

آسان مثالSimple AnalogySimple Analogy

VNet peering دو ہاؤسنگ سوسائٹیوں کے درمیان براہ راست گیٹ کھولنے جیسا ہے — ٹریفک عوامی سڑک پر جائے بغیر نجی طور پر بہتا ہے۔ VPN Gateway سڑک کے نیچے ایک guarded tunnel ہے؛ ExpressRoute صرف آپ کے لیے بنائی گئی private highway ہے۔VNet peering do housing societies ke darmiyan direct gate kholne jaisa hai — traffic public road par jaye baghair privately behta hai. VPN Gateway road ke neeche ek guarded tunnel hai; ExpressRoute sirf aap ke liye banayi gayi private highway hai.VNet peering is like opening a direct gate between two housing societies — traffic flows privately without going through the public road. VPN Gateway is a guarded tunnel under the road; ExpressRoute is a private highway built just for you.

سیٹ اپLab SetupLab Setup

وہی resource group rg-netsec-lab استعمال کریں۔ دوسرا VNet vnet-east (10.3.0.0/16، subnet 10.3.1.0/24) بنائیں تاکہ آپ اسے vnet-core سے peer کر سکیں۔Wohi resource group rg-netsec-lab use karein. Doosra VNet vnet-east (10.3.0.0/16, subnet 10.3.1.0/24) banayein taake aap use vnet-core se peer kar saken.Use the same resource group rg-netsec-lab. Create a second VNet vnet-east (10.3.0.0/16, subnet 10.3.1.0/24) so you can peer it with vnet-core.

اقداماتStepsSteps

Step 1

دوسرا VNet vnet-east (10.3.0.0/16) بنائیں۔ اس کا address space vnet-core (10.1.0.0/16، 10.2.0.0/16) سے اوورلیپ نہیں ہونا چاہیے ورنہ peering ناکام ہوگی۔Doosra VNet vnet-east (10.3.0.0/16) banayein. Us ka address space vnet-core (10.1.0.0/16, 10.2.0.0/16) se overlap nahi hona chahiye warna peering fail hogi.Create a second VNet named vnet-east (10.3.0.0/16). Its address space must not overlap vnet-core (10.1.0.0/16, 10.2.0.0/16) or peering will fail.

az network vnet create --resource-group rg-netsec-lab --name vnet-east --address-prefix 10.3.0.0/16 --subnet-name snet-web --subnet-prefix 10.3.1.0/24 --location southeastasia

🖱️ Virtual networks > Create — vnet-east بنائیں address space 10.3.0.0/16 کے ساتھVirtual networks > Create — vnet-east banayein address space 10.3.0.0/16 ke saathVirtual networks > Create — build vnet-east with address space 10.3.0.0/16

Step 2

vnet-core سے vnet-east تک peering بنائیں۔ نوٹ کریں: peering ایک طرفہ ہوتی ہے — reverse peering بھی بنانا ضروری ہے۔vnet-core se vnet-east tak peering banayein. Note karein: peering ek-tarfa hoti hai — reverse peering bhi banana zaroori hai.Create a peering from vnet-core to vnet-east. Note: a peering is one-directional — you must create the reverse peering too.

az network vnet peering create --resource-group rg-netsec-lab --name core-to-east --vnet-name vnet-core --remote-vnet vnet-east --allow-vnet-access

🖱️ Virtual networks > vnet-core > Peerings > Add — vnet-east سے peer کریںVirtual networks > vnet-core > Peerings > Add — vnet-east se peer kareinVirtual networks > vnet-core > Peerings > Add — peer to vnet-east

Step 3

vnet-east سے vnet-core تک reverse peering بنائیں۔ ٹریفک بہنے سے پہلے دونوں directions Connected ہونی چاہئیں۔vnet-east se vnet-core tak reverse peering banayein. Traffic behne se pehle dono directions Connected honi chahiyein.Create the reverse peering from vnet-east to vnet-core. Both directions must be Connected before traffic flows.

az network vnet peering create --resource-group rg-netsec-lab --name east-to-core --vnet-name vnet-east --remote-vnet vnet-core --allow-vnet-access

🖱️ Virtual networks > vnet-east > Peerings > Add — vnet-core سے peer کریںVirtual networks > vnet-east > Peerings > Add — vnet-core se peer kareinVirtual networks > vnet-east > Peerings > Add — peer to vnet-core

Step 4

تصدیق کریں کہ دونوں peerings Connected اسٹیٹس دکھاتی ہیں۔ اب دونوں VNets Azure کے private backbone پر ایک دوسرے کو route کر سکتے ہیں۔Verify karein ke dono peerings Connected status dikhati hain. Ab dono VNets Azure ke private backbone par ek doosre ko route kar sakte hain.Verify both peerings show Connected status. Now the two VNets can route to each other over Azure's private backbone.

az network vnet peering list --resource-group rg-netsec-lab --vnet-name vnet-core --output table

🖱️ Virtual networks > vnet-core > Peerings — Peering status = Connected چیک کریںVirtual networks > vnet-core > Peerings — Peering status = Connected check kareinVirtual networks > vnet-core > Peerings — check Peering status = Connected

Step 5

Virtual network gateways > Create کھولیں اور gateway types کا موازنہ کریں: Vpn بمقابلہ ExpressRoute، اور VPN types RouteBased بمقابلہ PolicyBased۔ یہ صرف concepts ہیں — deploy نہ کریں؛ gateways کی لاگت ہوتی ہے۔Virtual network gateways > Create kholein aur gateway types compare karein: Vpn vs ExpressRoute, aur VPN types RouteBased vs PolicyBased. Yeh sirf concepts hai — deploy na karein; gateways ki cost hoti hai.Open Virtual network gateways > Create and compare gateway types: Vpn vs ExpressRoute, and VPN types RouteBased vs PolicyBased. This is concepts-only — do not deploy; gateways cost money.

🖱️ Virtual network gateways > Create — VPN Gateway بمقابلہ ExpressRoute gateway types کا موازنہ کریںVirtual network gateways > Create — VPN Gateway vs ExpressRoute gateway types compare kareinVirtual network gateways > Create — compare VPN Gateway vs ExpressRoute gateway types

Step 6

ExpressRoute کا بہاؤ نوٹ کریں: connectivity provider سے circuit order کریں، پھر private peering enable کریں۔ یہ private ہے — عوامی انٹرنیٹ شامل نہیں۔ExpressRoute ka flow note karein: connectivity provider se circuit order karein, phir private peering enable karein. Yeh private hai — public internet shamil nahi.Note the ExpressRoute flow: order a circuit with a connectivity provider, then enable the private peering. It is private — no public internet involved.

🖱️ Home > Help > Learn — ExpressRoute circuit ordering flow پڑھیںHome > Help > Learn — ExpressRoute circuit ordering flow parheinHome > Help > Learn — read about ExpressRoute circuit ordering flow

تصدیقVerifyVerify

دو peerings موجود ہیں: core-to-east اور east-to-core، دونوں Connected۔ vnet-core اور vnet-east ایک دوسرے کو نجی طور پر route کر سکتے ہیں۔Do peerings maujood hain: core-to-east aur east-to-core, dono Connected. vnet-core aur vnet-east ek doosre ko privately route kar sakte hain.Two peerings exist: core-to-east and east-to-core, both Connected. vnet-core and vnet-east can route privately to each other.

az network vnet peering list --resource-group rg-netsec-lab --vnet-name vnet-core --output table

خرابی دور کرناTroubleshootingTroubleshooting

⚠️ Peering status Initiated پر رکی ہوئیPeering status Initiated par ruki huiPeering status stuck at Initiated

✅ آپ نے صرف ایک direction بنائی۔ Remote VNet پر matching peering بھی بنائیں — Connected اسٹیٹس کے لیے دونوں sides ضروری ہیں۔Aap ne sirf ek direction banayi. Remote VNet par matching peering bhi banayein — Connected status ke liye dono sides zaroori hain.You created only one direction. Create the matching peering on the remote VNet — both sides must exist for Connected status.

⚠️ Overlapping address space کی وجہ سے peering ناکامOverlapping address space ki wajah se peering failPeering creation fails with overlapping address space

✅ Peered VNets میں کوئی address range مشترک نہیں ہو سکتی۔ پہلے ایک VNet کا address space تبدیل کریں (Virtual networks > vnet-east > Address space)۔Peered VNets mein koi address range mushtarik nahi ho sakti. Pehle ek VNet ka address space tabdeel karein (Virtual networks > vnet-east > Address space).Peered VNets cannot share any address range. Change one VNet's address space first (VPNets > vnet-east > Address space).

انٹرویو سوالاتInterview Q&AInterview Q&A

❓ VPN Gateway کی بجائے VNet peering کب استعمال کرنی چاہیے؟VPN Gateway ki bajaye VNet peering kab use karni chahiye?When should you use VNet peering instead of VPN Gateway?

Peering دو VNets کے درمیان براہ راست، low-latency، private connection ہے — VPN سے سستا اور تیز۔ On-premises نیٹ ورک کو انٹرنیٹ پر جوڑنے کے لیے VPN Gateway استعمال کریں؛ یہ ٹریفک کو encrypt کرتا ہے۔Peering do VNets ke darmiyan direct, low-latency, private connection hai — VPN se sasta aur tez. On-premises network ko internet par jorne ke liye VPN Gateway use karein; yeh traffic encrypt karta hai.Peering is a direct, low-latency, private connection between two VNets — cheaper and faster than a VPN. Use VPN Gateway to connect on-premises networks over the internet; it encrypts traffic.

❓ ExpressRoute کیا ہے اور VPN سے کیسے مختلف ہے؟ExpressRoute kya hai aur VPN se kaise mukhtalif hai?What is ExpressRoute and how does it differ from VPN?

ExpressRoute connectivity provider کے ذریعے on-premises سے Azure تک private، dedicated connection ہے — عوامی انٹرنیٹ پر نہیں۔ یہ VPN سے زیادہ bandwidth، کم latency اور قابلِ پیشگوئی کارکردگی دیتا ہے۔ExpressRoute connectivity provider ke zariye on-premises se Azure tak private, dedicated connection hai — public internet par nahi. Yeh VPN se zyada bandwidth, kam latency aur predictable performance deta hai.ExpressRoute is a private, dedicated connection from on-premises to Azure through a connectivity provider — not over the public internet. It offers higher bandwidth, lower latency, and more predictable performance than VPN.