Connect virtual networks with virtual network peering using PowerShell

You can connect virtual networks to each other with virtual network peering. Once virtual networks are peered, resources in both virtual networks are able to communicate with each other, with the same latency and bandwidth as if the resources were in the same virtual network. In this article, you learn how to:

  • Create two virtual networks
  • Connect two virtual networks with a virtual network peering
  • Deploy a virtual machine (VM) into each virtual network
  • Communicate between VMs

If you don't have an Azure subscription, create a free account before you begin.

Launch Azure Cloud Shell

The Azure Cloud Shell is a free interactive shell that you can use to run the steps in this article. It has common Azure tools preinstalled and configured to use with your account. Just click the Copy to copy the code, paste it into the Cloud Shell, and then press enter to run it. There are a few ways to launch the Cloud Shell:

Click Try It in the upper right corner of a code block. Cloud Shell in this article
Open Cloud Shell in your browser.
Click the Cloud Shell button on the menu in the upper right of the Azure portal. Cloud Shell in the portal

If you choose to install and use PowerShell locally, this article requires the Azure PowerShell module version 5.4.1 or later. Run Get-Module -ListAvailable AzureRM to find the installed version. If you need to upgrade, see Install Azure PowerShell module. If you are running PowerShell locally, you also need to run Connect-AzureRmAccount to create a connection with Azure.

Create virtual networks

Before creating a virtual network, you have to create a resource group for the virtual network, and all other resources created in this article. Create a resource group with New-AzureRmResourceGroup. The following example creates a resource group named myResourceGroup in the eastus location.

New-AzureRmResourceGroup -ResourceGroupName myResourceGroup -Location EastUS

Create a virtual network with New-AzureRmVirtualNetwork. The following example creates a virtual network named myVirtualNetwork1 with the address prefix

$virtualNetwork1 = New-AzureRmVirtualNetwork `
  -ResourceGroupName myResourceGroup `
  -Location EastUS `
  -Name myVirtualNetwork1 `

Create a subnet configuration with New-AzureRmVirtualNetworkSubnetConfig. The following example creates a subnet configuration with a address prefix:

$subnetConfig = Add-AzureRmVirtualNetworkSubnetConfig `
  -Name Subnet1 `
  -AddressPrefix `
  -VirtualNetwork $virtualNetwork1

Write the subnet configuration to the virtual network with Set-AzureRmVirtualNetwork, which creates the subnet:

$virtualNetwork1 | Set-AzureRmVirtualNetwork

Create a virtual network with a address prefix and one subnet:

# Create the virtual network.
$virtualNetwork2 = New-AzureRmVirtualNetwork `
  -ResourceGroupName myResourceGroup `
  -Location EastUS `
  -Name myVirtualNetwork2 `

# Create the subnet configuration.
$subnetConfig = Add-AzureRmVirtualNetworkSubnetConfig `
  -Name Subnet1 `
  -AddressPrefix `
  -VirtualNetwork $virtualNetwork2

# Write the subnet configuration to the virtual network.
$virtualNetwork2 | Set-AzureRmVirtualNetwork

Peer virtual networks

Create a peering with Add-AzureRmVirtualNetworkPeering. The following example peers myVirtualNetwork1 to myVirtualNetwork2.

Add-AzureRmVirtualNetworkPeering `
  -Name myVirtualNetwork1-myVirtualNetwork2 `
  -VirtualNetwork $virtualNetwork1 `
  -RemoteVirtualNetworkId $virtualNetwork2.Id

In the output returned after the previous command executes, you see that the PeeringState is Initiated. The peering remains in the Initiated state until you create the peering from myVirtualNetwork2 to myVirtualNetwork1. Create a peering from myVirtualNetwork2 to myVirtualNetwork1.

Add-AzureRmVirtualNetworkPeering `
  -Name myVirtualNetwork2-myVirtualNetwork1 `
  -VirtualNetwork $virtualNetwork2 `
  -RemoteVirtualNetworkId $virtualNetwork1.Id

In the output returned after the previous command executes, you see that the PeeringState is Connected. Azure also changed the peering state of the myVirtualNetwork1-myVirtualNetwork2 peering to Connected. Confirm that the peering state for the myVirtualNetwork1-myVirtualNetwork2 peering changed to Connected with Get-AzureRmVirtualNetworkPeering.

Get-AzureRmVirtualNetworkPeering `
  -ResourceGroupName myResourceGroup `
  -VirtualNetworkName myVirtualNetwork1 `
  | Select PeeringState

Resources in one virtual network cannot communicate with resources in the other virtual network until the PeeringState for the peerings in both virtual networks is Connected.

Create virtual machines

Create a VM in each virtual network so that you can communicate between them in a later step.

Create the first VM

Create a VM with New-AzureRmVM. The following example creates a VM named myVm1 in the myVirtualNetwork1 virtual network. The -AsJob option creates the VM in the background, so you can continue to the next step. When prompted, enter the user name and password you want to log in to the VM with.

New-AzureRmVm `
  -ResourceGroupName "myResourceGroup" `
  -Location "East US" `
  -VirtualNetworkName "myVirtualNetwork1" `
  -SubnetName "Subnet1" `
  -ImageName "Win2016Datacenter" `
  -Name "myVm1" `

Create the second VM

New-AzureRmVm `
  -ResourceGroupName "myResourceGroup" `
  -Location "East US" `
  -VirtualNetworkName "myVirtualNetwork2" `
  -SubnetName "Subnet1" `
  -ImageName "Win2016Datacenter" `
  -Name "myVm2"

The VM takes a few minutes to create. Do not continue with later steps until Azure creates the VM and returns output to PowerShell.

Communicate between VMs

You can connect to a VM's public IP address from the internet. Use Get-AzureRmPublicIpAddress to return the public IP address of a VM. The following example returns the public IP address of the myVm1 VM:

Get-AzureRmPublicIpAddress `
  -Name myVm1 `
  -ResourceGroupName myResourceGroup | Select IpAddress

Use the following command to create a remote desktop session with the myVm1 VM from your local computer. Replace <publicIpAddress> with the IP address returned from the previous command.

mstsc /v:<publicIpAddress>

A Remote Desktop Protocol (.rdp) file is created, downloaded to your computer, and opened. Enter the user name and password (you may need to select More choices, then Use a different account, to specify the credentials you entered when you created the VM), and then click OK. You may receive a certificate warning during the sign-in process. Click Yes or Continue to proceed with the connection.

On the myVm1 VM, enable the Internet Control Message Protocol (ICMP) through the Windows firewall so you can ping this VM from myVm2 in a later step, using PowerShell:

New-NetFirewallRule –DisplayName “Allow ICMPv4-In” –Protocol ICMPv4

Though ping is used to communicate between VMs in this article, allowing ICMP through the Windows Firewall for production deployments is not recommended.

To connect to the myVm2 VM, enter the following command from a command prompt on the myVm1 VM:

mstsc /v:

Since you enabled ping on myVm1, you can now ping it by IP address from a command prompt on the myVm2 VM:


You receive four replies. Disconnect your RDP sessions to both myVm1 and myVm2.

Clean up resources

When no longer needed, use Remove-AzureRmResourcegroup to remove the resource group and all of the resources it contains.

Remove-AzureRmResourceGroup -Name myResourceGroup -Force

Next steps

In this article, you learned how to connect two networks in the same Azure region, with virtual network peering. You can also peer virtual networks in different supported regions and in different Azure subscriptions, as well as create hub and spoke network designs with peering. To learn more about virtual network peering, see Virtual network peering overview and Manage virtual network peerings.

You can connect your own computer to a virtual network through a VPN, and interact with resources in a virtual network, or in peered virtual networks. For reusable scripts to complete many of the tasks covered in the virtual network articles, see script samples.