Peering configuration traffic flow

Use Azure’s network diagnostic tools to trace how traffic between AllianceVMXSupernet and on-premises domain controllers is routed.

1. Verify effective routes on the NICs
   • For a VM in AllianceVMXSupernet, open its network interface in the Azure portal.
   • View Effective routes to see:
     • System routes for virtual network peering.
     • Routes learned from VPN/ExpressRoute (BGP).
     • Any user-defined routes (UDRs).
   • This shows whether traffic to the on-premises DC prefixes is using:
     • The VPN/ExpressRoute gateway as next hop, or
     • A peered VNet (hub) and then a gateway (gateway transit), or
     • An NVA.
2. Check for peering and gateway transit
   • For the VNet containing AllianceVMXSupernet, check Peering settings:
     • Confirm if Use remote gateways is enabled.
   • On the hub VNet (if using hub-and-spoke), check if:
     • A VPN/ExpressRoute gateway exists.
     • Allow gateway transit is enabled on the peering.
   • In such designs, traffic between peered VNets and on-premises flows over the Azure backbone via the peering, using the hub gateway as transit.
3. Use Network Watcher “Next hop”
   • Enable Network Watcher in the region.
   • Use Next hop from a VM in AllianceVMXSupernet to an on-premises DC IP.
   • The result will show the actual next hop type:
     • VirtualNetworkGateway (VPN/ExpressRoute gateway),
     • VirtualNetworkPeering (traffic first goes to a peered VNet), or
     • VirtualAppliance (NVA).
   • This confirms whether the traffic is going directly via the gateway, via a hub VNet, or via an NVA.
4. Check for route conflicts/overrides
   • If an NVA or custom routing is used, review any route tables associated with AllianceVMXSupernet subnets:
     • Ensure no UDR is unintentionally overriding the expected gateway/peering route.
   • If BGP is used from on-premises, verify that advertised prefixes do not overlap with peered VNet address spaces in a way that confuses diagnostics; confirm peering system routes take precedence.
5. Confirm on-premises path
   • On the on-premises side, inspect the VPN/ExpressRoute configuration and routing to see which Azure VNet prefixes are advertised and how return traffic is sent.

These steps together (Effective routes + Next hop + peering/gateway settings) will show the exact path that domain controller traffic takes between AllianceVMXSupernet and on-premises.

References:

• Troubleshoot virtual network peering route propagation and sync problems
• Troubleshoot virtual network peering issues
• Troubleshoot virtual network peering problems
• Azure virtual network peering