Do allowGatewayTransit and useRemoteGateways need to be set to the same value on both sides of a peering?

No, they need to be set as opposing, complementary settings: the VNet that owns the gateway sets allowGatewayTransit to true on its side of the peering, while the VNet that wants to use that gateway sets useRemoteGateways to true on its own side. Setting both to true on both sides, or both to false when gateway sharing is intended, doesn't work, this is a directional relationship, not a mirrored setting.

What happens if the remote VNet adds a new address space after peering is already established, and syncRemoteAddressSpace isn't enabled?

The peering can retain a stale view of the remote VNet's address space, meaning traffic to the newly-added address range may not route correctly across the peering until the peering configuration is manually refreshed or recreated. Enabling syncRemoteAddressSpace avoids this drift by having the peering automatically pick up address space changes on the remote side without manual intervention.

Does allowVirtualNetworkAccess need to be true on both sides for peering to work at all?

Yes, this is the most basic peering permission, allowing resources in each VNet to communicate with resources in the other VNet at all. Unlike allowGatewayTransit/useRemoteGateways (which are intentionally asymmetric), allowVirtualNetworkAccess is typically set to true symmetrically on both sides for a functioning bidirectional peering, though it can be set to false on one side for a deliberately one-way-only connectivity relationship in less common scenarios.

Azure VNet Peering Config Builder

NetworkingAzure

Build VNet peering configs with gateway transit, forwarded traffic, cross-subscription peering, and hub-spoke topology settings.

Azure Virtual Network Peering Configuration

Build VNet peering configs with gateway transit, forwarded traffic, cross-subscription peering, and hub-spoke topology settings.

Required Fields

peeringNamelocalVirtualNetwork.nameremoteVirtualNetwork.namelocalPeeringSettings.allowVirtualNetworkAccessremotePeeringSettings.allowVirtualNetworkAccess

{
  "peeringName": "peer-hub-to-spoke-app",
  "resourceGroup": "rg-networking",
  "localVirtualNetwork": {
    "name": "vnet-hub-prod",
    "resourceGroup": "rg-networking",
    "addressSpace": ["10.0.0.0/16"]
  },
  "remoteVirtualNetwork": {
    "name": "vnet-spoke-app",
    "resourceGroup": "rg-app-networking",
    "subscriptionId": "b2c3d4e5-f6a7-8901-bcde-f23456789012",
    "addressSpace": ["10.1.0.0/16"]
  },
  "localPeeringSettings": {
    "allowVirtualNetworkAccess": true,
    "allowForwardedTraffic": true,
    "allowGatewayTransit": true,
    "useRemoteGateways": false
  },
  "remotePeeringSettings": {
    "allowVirtualNetworkAccess": true,
    "allowForwardedTraffic": true,
    "allowGatewayTransit": false,
    "useRemoteGateways": true
  },
  "peeringSync": {
    "syncRemoteAddressSpace": true
  },
  "additionalPeerings": [
    {
      "peeringName": "peer-hub-to-spoke-data",
      "remoteVnetName": "vnet-spoke-data",
      "remoteResourceGroup": "rg-data-networking",
      "remoteAddressSpace": ["10.2.0.0/16"],
      "allowGatewayTransit": true
    },
    {
      "peeringName": "peer-hub-to-spoke-mgmt",
      "remoteVnetName": "vnet-spoke-mgmt",
      "remoteResourceGroup": "rg-mgmt-networking",
      "remoteAddressSpace": ["10.3.0.0/16"],
      "allowGatewayTransit": true
    }
  ]
}

Generated Output

Output will appear here...

What This Tool Does

Build an Azure VNet peering configuration with asymmetric localPeeringSettings/remotePeeringSettings, since peering settings like allowGatewayTransit and useRemoteGateways are configured independently per direction and must be set as logical opposites to work (the hub sets allowGatewayTransit true while the spoke sets useRemoteGateways true, not both sides setting the same field), a mismatched pair on either side of a peering silently fails to provide gateway transit rather than erroring clearly about the misconfiguration. peeringSync.syncRemoteAddressSpace matters specifically when the remote VNet's address space changes after peering is established, without it, the peering can retain a stale view of the remote VNet's address ranges even after the remote side adds or removes address blocks.

Technical Details

The builder validates that peeringName, localVirtualNetwork.name, remoteVirtualNetwork.name, and both localPeeringSettings.allowVirtualNetworkAccess and remotePeeringSettings.allowVirtualNetworkAccess resolve before accepting the JSON as a valid combined peering definition (covering both directions of the peering relationship); it can't verify the two VNets' address spaces don't actually overlap (which would reject the peering) or that a cross-subscription remote VNet reference is actually accessible with the credentials being used, those checks happen only against the live API.

Common Use Cases

1Setting the hub VNet's localPeeringSettings.allowGatewayTransit to true and the spoke's remotePeeringSettings.useRemoteGateways to true (as opposing settings on each side, not the same setting mirrored), so the spoke can route through the hub's VPN/ExpressRoute gateway without needing its own gateway deployed.
2Enabling peeringSync.syncRemoteAddressSpace so a later addition of a new address space to the remote VNet automatically reflects in this peering's routing, rather than requiring a manual peering update to pick up the change.
3Using additionalPeerings to define a hub-and-spoke topology with several spoke VNets from one central configuration reference, rather than treating each spoke peering as a fully separate, disconnected configuration exercise.
4Setting allowForwardedTraffic to true specifically when traffic transiting through a network virtual appliance in one VNet needs to reach resources in the peered VNet, since without it, only traffic originating directly from the peered VNet (not forwarded/routed traffic) is allowed across the peering.

Common Questions

Do allowGatewayTransit and useRemoteGateways need to be set to the same value on both sides of a peering?: No, they need to be set as opposing, complementary settings: the VNet that owns the gateway sets allowGatewayTransit to true on its side of the peering, while the VNet that wants to use that gateway sets useRemoteGateways to true on its own side. Setting both to true on both sides, or both to false when gateway sharing is intended, doesn't work, this is a directional relationship, not a mirrored setting.
What happens if the remote VNet adds a new address space after peering is already established, and syncRemoteAddressSpace isn't enabled?: The peering can retain a stale view of the remote VNet's address space, meaning traffic to the newly-added address range may not route correctly across the peering until the peering configuration is manually refreshed or recreated. Enabling syncRemoteAddressSpace avoids this drift by having the peering automatically pick up address space changes on the remote side without manual intervention.
Does allowVirtualNetworkAccess need to be true on both sides for peering to work at all?: Yes, this is the most basic peering permission, allowing resources in each VNet to communicate with resources in the other VNet at all. Unlike allowGatewayTransit/useRemoteGateways (which are intentionally asymmetric), allowVirtualNetworkAccess is typically set to true symmetrically on both sides for a functioning bidirectional peering, though it can be set to false on one side for a deliberately one-way-only connectivity relationship in less common scenarios.

Expert Tips

TIP

Never mirror allowGatewayTransit and useRemoteGateways as the same value on both peering sides, they're a directional pair (transit-provider sets one, transit-consumer sets the other), a common misconfiguration that fails silently rather than with a clear error.

TIP

Enable syncRemoteAddressSpace by default for any peering where the remote VNet's address space might reasonably change over time, the alternative is a manual peering refresh every time, which is easy to forget after the initial setup.

TIP

allowForwardedTraffic needs to be explicitly considered whenever a network virtual appliance or route-based forwarding is part of the architecture, the default expectation (only directly-originated traffic crossing the peering) silently blocks forwarded/routed traffic patterns unless this is turned on.

Related Learning Guides

Virtual Network Architecture28 min read
Azure Networking Deep Dive30 min read

Was this tool helpful?

Disclaimer: This tool runs entirely in your browser. No data is sent to our servers. Always verify outputs before using them in production. AWS, Azure, and GCP are trademarks of their respective owners.

Azure VNet Peering Config Builder

NetworkingAzure

Build VNet peering configs with gateway transit, forwarded traffic, cross-subscription peering, and hub-spoke topology settings.

Azure Virtual Network Peering Configuration

Build VNet peering configs with gateway transit, forwarded traffic, cross-subscription peering, and hub-spoke topology settings.

Required Fields

peeringNamelocalVirtualNetwork.nameremoteVirtualNetwork.namelocalPeeringSettings.allowVirtualNetworkAccessremotePeeringSettings.allowVirtualNetworkAccess

Generated Output

Output will appear here...

What This Tool Does

Technical Details

Common Use Cases

1Setting the hub VNet's localPeeringSettings.allowGatewayTransit to true and the spoke's remotePeeringSettings.useRemoteGateways to true (as opposing settings on each side, not the same setting mirrored), so the spoke can route through the hub's VPN/ExpressRoute gateway without needing its own gateway deployed.
2Enabling peeringSync.syncRemoteAddressSpace so a later addition of a new address space to the remote VNet automatically reflects in this peering's routing, rather than requiring a manual peering update to pick up the change.
3Using additionalPeerings to define a hub-and-spoke topology with several spoke VNets from one central configuration reference, rather than treating each spoke peering as a fully separate, disconnected configuration exercise.
4Setting allowForwardedTraffic to true specifically when traffic transiting through a network virtual appliance in one VNet needs to reach resources in the peered VNet, since without it, only traffic originating directly from the peered VNet (not forwarded/routed traffic) is allowed across the peering.

Common Questions

Do allowGatewayTransit and useRemoteGateways need to be set to the same value on both sides of a peering?: No, they need to be set as opposing, complementary settings: the VNet that owns the gateway sets allowGatewayTransit to true on its side of the peering, while the VNet that wants to use that gateway sets useRemoteGateways to true on its own side. Setting both to true on both sides, or both to false when gateway sharing is intended, doesn't work, this is a directional relationship, not a mirrored setting.
What happens if the remote VNet adds a new address space after peering is already established, and syncRemoteAddressSpace isn't enabled?: The peering can retain a stale view of the remote VNet's address space, meaning traffic to the newly-added address range may not route correctly across the peering until the peering configuration is manually refreshed or recreated. Enabling syncRemoteAddressSpace avoids this drift by having the peering automatically pick up address space changes on the remote side without manual intervention.
Does allowVirtualNetworkAccess need to be true on both sides for peering to work at all?: Yes, this is the most basic peering permission, allowing resources in each VNet to communicate with resources in the other VNet at all. Unlike allowGatewayTransit/useRemoteGateways (which are intentionally asymmetric), allowVirtualNetworkAccess is typically set to true symmetrically on both sides for a functioning bidirectional peering, though it can be set to false on one side for a deliberately one-way-only connectivity relationship in less common scenarios.

Expert Tips

TIP

Related Learning Guides

Virtual Network Architecture28 min read
Azure Networking Deep Dive30 min read

Was this tool helpful?