I have a Microsoft Azure account with 2 subscriptions.

In "subscription 1" I have a VNet with a Virtual Network Gateway with Point-To-Site configuration. I can VPN to this network from my local PC and enjoy its empty beauty. To fill this in I added a Virtual Machine into this network without a public access and only a private IP. And I can ssh into this VM when connected to VPN - all as expected.

Now, inside the "subscription 2" I have another VNet with a VM. No gateways. How can I allow ssh access to that 2nd VM when I have VPN to my 1st network?

I tried to add VNet peering between those 2 VNets - from both ends, but with no luck. Those 2 subnets are in 2 different locations, because of that "Allow gateway transit" and "Use remote gateways" checkboxes for peering are not available.

Is there a way to configure it correctly? Or do I need to recreate the VPN network in the same location as the 2nd one?


Tried to add a 3rd VNet in the same location as the VPN one. With them I am able to setup peering with "Allow Gateway transit" and "Use remote gateways" on separate ends of this connection. And with this I can see the VM inside the 3rd VNet while connected via VPN to the 1st one.

So the clarification I need - is this the only viable option? To have VNets created in the same location?

  • 1
    Vnet peering between 2 regions has some restrictions today... I tried what you did and did the same in the same region, it worked for the test in the same region. – MouIdri Nov 9 '18 at 9:49

Currently, the official doc states this constraint on vNet peering with different regions:

You cannot use remote gateways or allow gateway transit. To use remote gateways or allow gateway transit, peered virtual networks in must be in the same region.

So you need to create a vNet with the same region with global peering in the second subscription if you do not want to add another gateway.


The VNet Peering should have worked. Did you add the address space of the peer VNet to your local routing?

Your local environment needs to know to send traffic for peered address space to Azure gateway.

  • No, I have not done anything about local routing. And I thought that you dont need to. Also, why it worked for vnet1-vnet3 situation (where both of them are in the same location) – JleruOHeP Nov 9 '18 at 4:34
  • AHH!!! Point-To-Site, Sorry confused response with another. But, you might need to regenerate (Download) new application after peering to include new routes (address space) or add routes manually. – Hannel Nov 9 '18 at 4:44
  • No worries :) There is no application yet - I am trying to do everything from command line for now. Connect from local PC to VNet1 using VPN, then ping/ssh into VM that is hosted inside VNet2/3. – JleruOHeP Nov 9 '18 at 4:49
  • By application i might VPN application/connection, that is what sets the local routes on PC – Hannel Nov 9 '18 at 4:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.