{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-162-check-the-limits-of-sdn-virtual-network-peering/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260908-162-check-the-limits-of-sdn-virtual-network-peering/", "slug": "dse-20260908-162-check-the-limits-of-sdn-virtual-network-peering", "url": "https://update.dsesecurity.com/updates/dse-20260908-162-check-the-limits-of-sdn-virtual-network-peering/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260908-162-check-the-limits-of-sdn-virtual-network-peering.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-162-check-the-limits-of-sdn-virtual-network-peering/" }, "title": "Check the limits of SDN virtual network peering", "summary": "Which connections must be configured explicitly when SDN virtual networks are peered?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-08T18:14:29+00:00", "modified_at": "2026-09-08T18:26:31+00:00", "reviewed_on": "2026-09-08", "reading_minutes": 1, "word_count": 220, "potentially_affected": "Administrators designing peering between Windows Server SDN virtual networks.", "dse_recommendation": "Draw the intended connections as explicit network pairs.", "primary_source": { "name": "Virtual network peering", "url": "https://learn.microsoft.com/en-us/windows-server/networking/sdn/vnet-peering/sdn-vnet-peering", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft describes peered virtual machines communicating over private addresses through the underlying infrastructure, without an internet connection or gateway for that communication. Peering does not extend transitively: connecting the first network to a second, and the second to a third, does not connect the first and third. Access control lists can restrict communication between peered networks, subnets, or individual virtual machines. Microsoft Learn.

\n

Applicability

\n

List every network pair that the application requires. Identify the relevant SDN implementation before applying this behavior to another networking product. Treat peering reachability, permitted application flows, and on-premises gateway use as separate design entries.

\n

DSE recommendation

\n

Draw the intended connections as explicit network pairs. Beside each pair, identify the initiating workload, destination service, and permitted traffic. Have the network owner approve any broad connectivity before the application team enables it. Include a deliberately unpeered pair in the acceptance plan so an indirect relationship cannot silently become the assumed route. Preserve the prior peering and filtering configuration.

\n

Verification

\n

Test an allowed flow and a prohibited flow across each configured pair. Then test between the first and third networks in the three-network example. Record the actual routes, applied access rules, and results from both ends. Resolve unexpected connectivity before extending the design to additional tenants.

\n

Official references

\n

Microsoft Learn: Virtual network peering. Source reviewed September 8, 2026.

", "content_text": "Source facts\nMicrosoft describes peered virtual machines communicating over private addresses through the underlying infrastructure, without an internet connection or gateway for that communication. Peering does not extend transitively: connecting the first network to a second, and the second to a third, does not connect the first and third. Access control lists can restrict communication between peered networks, subnets, or individual virtual machines. Microsoft Learn.\nApplicability\nList every network pair that the application requires. Identify the relevant SDN implementation before applying this behavior to another networking product. Treat peering reachability, permitted application flows, and on-premises gateway use as separate design entries.\nDSE recommendation\nDraw the intended connections as explicit network pairs. Beside each pair, identify the initiating workload, destination service, and permitted traffic. Have the network owner approve any broad connectivity before the application team enables it. Include a deliberately unpeered pair in the acceptance plan so an indirect relationship cannot silently become the assumed route. Preserve the prior peering and filtering configuration.\nVerification\nTest an allowed flow and a prohibited flow across each configured pair. Then test between the first and third networks in the three-network example. Record the actual routes, applied access rules, and results from both ends. Resolve unexpected connectivity before extending the design to additional tenants.\nOfficial references\nMicrosoft Learn: Virtual network peering. Source reviewed September 8, 2026.", "content_markdown": "## Source facts\n\nMicrosoft describes peered virtual machines communicating over private addresses through the underlying infrastructure, without an internet connection or gateway for that communication. Peering does not extend transitively: connecting the first network to a second, and the second to a third, does not connect the first and third. Access control lists can restrict communication between peered networks, subnets, or individual virtual machines. [Microsoft Learn](https://learn.microsoft.com/en-us/windows-server/networking/sdn/vnet-peering/sdn-vnet-peering).\n\n## Applicability\n\nList every network pair that the application requires. Identify the relevant SDN implementation before applying this behavior to another networking product. Treat peering reachability, permitted application flows, and on-premises gateway use as separate design entries.\n\n## DSE recommendation\n\nDraw the intended connections as explicit network pairs. Beside each pair, identify the initiating workload, destination service, and permitted traffic. Have the network owner approve any broad connectivity before the application team enables it. Include a deliberately unpeered pair in the acceptance plan so an indirect relationship cannot silently become the assumed route. Preserve the prior peering and filtering configuration.\n\n## Verification\n\nTest an allowed flow and a prohibited flow across each configured pair. Then test between the first and third networks in the three-network example. Record the actual routes, applied access rules, and results from both ends. Resolve unexpected connectivity before extending the design to additional tenants.\n\n## Official references\n\n[Microsoft Learn: Virtual network peering](https://learn.microsoft.com/en-us/windows-server/networking/sdn/vnet-peering/sdn-vnet-peering). Source reviewed September 8, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260908-162-check-the-limits-of-sdn-virtual-network-peering/", "url": "https://update.dsesecurity.com/updates/dse-20260908-162-check-the-limits-of-sdn-virtual-network-peering/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-08" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260908-162-check-the-limits-of-sdn-virtual-network-peering/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Check the limits of SDN virtual network peering", "item": "https://update.dsesecurity.com/updates/dse-20260908-162-check-the-limits-of-sdn-virtual-network-peering/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260908-162-check-the-limits-of-sdn-virtual-network-peering/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260908-162-check-the-limits-of-sdn-virtual-network-peering/", "url": "https://update.dsesecurity.com/updates/dse-20260908-162-check-the-limits-of-sdn-virtual-network-peering/", "headline": "Check the limits of SDN virtual network peering", "description": "Which connections must be configured explicitly when SDN virtual networks are peered?", "abstract": "Which connections must be configured explicitly when SDN virtual networks are peered?", "articleBody": "Source facts\nMicrosoft describes peered virtual machines communicating over private addresses through the underlying infrastructure, without an internet connection or gateway for that communication. Peering does not extend transitively: connecting the first network to a second, and the second to a third, does not connect the first and third. Access control lists can restrict communication between peered networks, subnets, or individual virtual machines. Microsoft Learn.\nApplicability\nList every network pair that the application requires. Identify the relevant SDN implementation before applying this behavior to another networking product. Treat peering reachability, permitted application flows, and on-premises gateway use as separate design entries.\nDSE recommendation\nDraw the intended connections as explicit network pairs. Beside each pair, identify the initiating workload, destination service, and permitted traffic. Have the network owner approve any broad connectivity before the application team enables it. Include a deliberately unpeered pair in the acceptance plan so an indirect relationship cannot silently become the assumed route. Preserve the prior peering and filtering configuration.\nVerification\nTest an allowed flow and a prohibited flow across each configured pair. Then test between the first and third networks in the three-network example. Record the actual routes, applied access rules, and results from both ends. Resolve unexpected connectivity before extending the design to additional tenants.\nOfficial references\nMicrosoft Learn: Virtual network peering. Source reviewed September 8, 2026.", "datePublished": "2026-09-08T18:14:29+00:00", "dateModified": "2026-09-08T18:26:31+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260908-162-check-the-limits-of-sdn-virtual-network-peering/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260908-162-check-the-limits-of-sdn-virtual-network-peering/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Check the limits of SDN virtual network peering" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 220, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Virtual network peering", "url": "https://learn.microsoft.com/en-us/windows-server/networking/sdn/vnet-peering/sdn-vnet-peering" } } ] } }