# Lab 05: Implement Intersite Connectivity Connectivity between different vNets using peering and custom routes and Network Watcher for troubleshooting. **Scenario:** Your organization has segmented its IT infrastructure. Core services (like DNS) are in one VNet, and manufacturing systems are in another. You need to enable secure communication between these VNets. **Interactive Lab Simulations:** * [**Global Virtual Network Peering**](https://mslabs.cloudguides.com/guides/AZ-700%20Lab%20Simulation%20-%20Connect%20two%20Azure%20virtual%20networks%20using%20global%20virtual%20network%20peering): Connect two Azure virtual networks and test VM connections. * [**Monitoring vNets**](https://learn.microsoft.com/training/modules/configure-monitoring-virtual-networks/): Use Azure Network Watcher, flow logs, NSG diagnostics, and packet capture. * [**Intersite Connectivity**](https://mslabs.cloudguides.com/en-us/guides/AZ-104%20Exam%20Guide%20-%20Microsoft%20Azure%20Administrator%20Exercise%209): Create a virtual network infrastructure, configure peerings, and test connections. **Key Concepts:** * **VNet Peering:** Connects two Azure VNets, Traffic uses the Microsoft backbone. * **User-Defined Routes (UDRs):** Custom routes that override Azure's default system routes. * **Network Watcher:** A suite of tools for monitoring and diagnosing network issues in Azure. * **Virtual Network Appliance (NVA):** A virtual machine that performs network functions, such as a firewall or router. (This lab sets up the *route* for an NVA, but doesn't deploy the NVA itself.) ## Job skills * Task 1: Create a virtual machine in a virtual network. * Task 2: Create a virtual machine in a different virtual network. * Task 3: Use Network Watcher to test the connection between virtual machines. * Task 4: Configure virtual network peerings between different virtual networks. * Task 5: Use Azure PowerShell to test the connection between virtual machines. * Task 6: Create a custom route. ![Lab 05 architecture diagram](https://github.com/MicrosoftLearning/AZ-104-MicrosoftAzureAdministrator/raw/master/Instructions/media/az104-lab05-architecture.png align="left") **Task 1: Create Core Services VM and VNet** 1. **Sign In:** Log in to the Azure portal ([https://portal.azure.com](https://portal.azure.com/)) and **Create a VM:** * * Virtual machine name: `CoreServicesVM` * Public inbound ports: `None` * Virtual network: Click "Create new." * Name: `CoreServicesVnet` * Address range: `10.0.0.0/16` * Subnet Name: `Core` * Subnet address range: `10.0.0.0/24` * **Monitoring:** * Boot diagnostics: `Disable` **Task 2: Create Manufacturing VM and VNet** 1. **Create VM:** * * Virtual machine name: `ManufacturingVM` * Public inbound ports: `None` * Virtual network: Click "Create new." * Name: `ManufacturingVnet` * Address range: `172.16.0.0/16` * Subnet Name: `Manufacturing` * Subnet address range: `172.16.0.0/24` * **Monitoring:** * Boot diagnostics: `Disable` **Task 3: Test Connectivity (Network Watcher)** 1. **Open Network Watcher:** Search for and select "Network Watcher." 2. **Connection Troubleshoot:**under "Network diagnostic tools," select "Connection troubleshoot." * **Source:** * Source type: `Virtual machine` * Virtual machine: `CoreServicesVM` * **Destination:** * Destination type: `Virtual machine` * Virtual machine: `ManufacturingVM` * **Configuration:** * Preferred IP Version: `Both` * Protocol: `TCP` * Destination port: `3389` * Source port: (Leave blank) * Use default Diagnostic tests. * Click "Run diagnostic tests." 3. **Observe Results:**  a `Connectivity test` status of `Unreachable` as the VNets are not yet connected. **Task 4: Configure VNet Peering** 1. **Open CoreServicesVnet:** In the portal, search for and select `CoreServicesVnet`. 2. **Create Peering:** * Under "Settings," select "Peerings" and Click "+ Add." * **This virtual network:** * Peering link name: `CoreServicesVnet-to-ManufacturingVnet` * Allow ManufacturingVnet to access CoreServicesVnet: `selected (default)` * Allow ManufacturingVnet to receive forwarded traffic from CoreServicesVnet: `selected` * **Remote virtual network:** * Virtual network deployment model: `Resource Manager` * I know my resource ID: `Unchecked` * Peering Link Name: `ManufacturingVnet-to-CoreServicesVnet` * Virtual Network: Select `ManufacturingVnet (az104-rg5)` * Allow CoreServicesVnet to access the peered virtual network: `selected (default)` * Allow CoreservicesVnet to receive forwarded traffic from the peered virtual network: `selected` * Click "Add." 3. **Verify Peering (Both VNets):** * In `CoreServicesVnet` -> "Peerings," ensure the status of `CoreServicesVnet-to-ManufacturingVnet` is `Connected`. Refresh if needed. * Go to `ManufacturingVnet` -> "Peerings," and ensure the status of `ManufacturingVnet-to-CoreServicesVnet` is `Connected`. Refresh if needed. **Task 5: Test Connectivity (PowerShell) - (5 minutes)** 1. **Get CoreServicesVM Private IP:** * Go to the `CoreServicesVM` resource. * On the "Overview" blade, note the `Private IP address`. 2. **Run Command on ManufacturingVM:** * Go to the `ManufacturingVM` resource. * Under "Operations," select "Run command." * Choose "RunPowerShellScript." * Enter the following command, replacing `` with the actual IP: PowerShell ```powershell Test-NetConnection -port 3389 ``` * Click "Run." 3. **Observe Results:** The command will take a few minutes. This time, the `TcpTestSucceeded` result should be `True`, indicating successful connectivity over the VNet peering. **Task 6: Create a Custom Route** 1. **Add Perimeter Subnet:** * Go to `CoreServicesVnet`. * Under "Settings," select "Subnets." * Click "+ Subnet." * Name: `perimeter` * Subnet address range: `10.0.1.0/24` * Click "Save." 2. **Create Route Table:** * ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1740611030683/2426426c-1ec6-4cf2-a932-5b59873a5455.png align="center") Search for and select "Route tables" and click "Create." * Name: `rt-CoreServices` * Propagate gateway routes: `No` ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1740611238374/fda8092b-8998-4798-b1ff-fe93111a797a.png align="center") 1. **Create Route:** * In the route table (`rt-CoreServices`), under "Settings," select "Routes." and click "+ Add." * Route name: `PerimetertoCore` * Destination type: `IP Addresses` * Destination IP addresses/CIDR ranges: `10.0.0.0/16` (This is the `CoreServicesVnet` address space) * Next hop type: `Virtual appliance` * Next hop address: `10.0.1.7` (This is a *placeholder* for a future NVA's IP address) 2. **Associate Route with Subnet:** * In the route table (`rt-CoreServices`), under "Settings," select "Subnets." * Click "+ Associate." * Virtual network: `CoreServicesVnet` * Subnet: `Core` * Click "OK." ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1740611349509/48b76eea-df9d-4c8a-b53b-65e36a0fc4b9.png align="center")