highIntermediateSymptom-first#vnet#peering#networking#routing#gateway

VNet peering traffic blocked — non-overlapping CIDR or gateway required

VMs in peered VNets cannot reach each other

Likely source:connectivityconfiguration

Focused incident mode — strips away everything but this runbook.

Symptoms

  • VMs in peered VNets cannot reach each other
  • az network vnet peering show shows peering state Connected but traffic is dropped
  • NSG logs show traffic being dropped between peered subnets

Evidence to grab

Collect these artifacts before you change anything — they prove (or rule out) each cause.

  • VNet peering status

    az network vnet peering list --resource-group <RG> --vnet-name <VNET1> --query "[].{name:name,state:state}" -o table

  • Subnet route tables

    az network route-table route list --resource-group <RG> --route-table-name <RT-NAME> --query "[].{name:name,nextHop:nextHopType,addressPrefix:addressPrefix}" -o table

Diagnostic flow

Run the steps in order, marking each claim confirmed or refuted. The evidence you gather feeds the ranked causes below.

Guided decision tree is ready.

Steps with commands, expected output, and pass/fail branches.

Ranked root causes

Evidence checklist

  • Peering state is Connected but traffic does not flow
  • az network vnet show shows overlapping addressSpace for both VNets

Confirm before fixing

az network vnet show --name <VNET1> --resource-group <RG> --query "addressSpace.addressPrefixes" -o tsv && az network vnet show --name <VNET2> --resource-group <RG> --query "addressSpace.addressPrefixes" -o tsv
READ

Compare address spaces of both VNets

Fix

az network vnet update --name <VNET1> --resource-group <RG> --address-space <NEW-CIDR>
CHANGE

Change the VNet address space to avoid overlap

Resolution runbook

Apply from top to bottom after the cause is confirmed. Review every command before running it — risk tags are shown on each.

1
az network vnet peering list --resource-group <RG> --vnet-name <VNET1> --query "[].{name:name,state:state}" -o table
READ

Confirm peering state

2
az network vnet show --name <VNET1> --resource-group <RG> --query "addressSpace" -o json && az network vnet show --name <VNET2> --resource-group <RG> --query "addressSpace" -o json
READ

Compare address spaces for overlap

3
az network vnet peering update --resource-group <RG> --vnet-name <VNET1> --name <PEERING-NAME> --set useRemoteGateways=false
CHANGE

Fix gateway peering setting if misconfigured

4
az network nsg rule create --nsg-name <NSG-NAME> --resource-group <RG> --name AllowPeeredVNet --priority 100 --access Allow --destination-address-prefixes <REMOTE-CIDR> --source-address-prefixes <REMOTE-CIDR>
CHANGE

Add NSG rule to allow peered traffic

Prevention

  • Design VNet address spaces to avoid overlap before creating any peering.
  • Document peering topology and gateway requirements in your network runbook.
  • Use Azure Network Watcher IP flow verify to test connectivity after peering.
  • Set up NSG flow log analytics to detect unexpected traffic denials.

Related runbooks

Same stack, same failure family — worth a skim.

Private DNS zone not resolving — VNet link missing or brokenhigh

nslookup for a private endpoint FQDN returns NXDOMAIN from a VM in the VNet

AzureIntermediate2 causes
Open runbook
Route table misconfiguration isolating a subnetcritical

VMs in a subnet cannot reach the internet or other subnets

AzureAdvanced2 causes
Open runbook

Commands marked READ CHANGE DESTRUCTIVE — never run DESTRUCTIVE commands against production data you cannot restore. Copy → verify → execute.