Spoke A and spoke B each peer to the hub. A harbor-pilot VM in A ca…

Question

Spoke A and spoke B each peer to the hub. A harbor-pilot VM in A cannot reach a water-lab VM in B. What should the security engineer conclude?

Accepted Answer

VNet peering is non-transitive; use a hub firewall/NVA hop, an AVNM mesh connectivity config, or an intentional spoke-spoke peer. — Hub-and-spoke peering isn’t a friendship bracelet—A doesn’t automatically reach B. Hairpin through the hub firewall, mesh with AVNM, or peer the spokes on purpose.

Answer

VNet peering already connects every spoke transitively, so the failure must be DNS only.

Answer

Overlapping address spaces are required before spoke-to-spoke traffic is allowed.

Answer

Peering encrypts spoke-to-spoke packets with IPsec automatically once both hubs are linked.

Spoke A and spoke B each peer to the hub. A harbor-pilot VM in A cannot reach a water-lab VM in B. What should the security engineer conclude?

Short Explanation

Full Explanation