Share via

Support Request: Problem in creating connection between resource in one vnet to resource in another vnet which are not directly peered with each other

Sahil Chaudhry 0 Reputation points
2025-11-19T14:46:37.8233333+00:00

I am trying to reach a storage account which is having a Private endpoint in VNET-D from Azure databricks connected to VNET-A.

I have setup following VNET peerings - VNET-A is peered with VNET-B which is peered with VNET-C which is peered with VNET-D

I have a Azure firewall in VNET-B where I have firewall policy to allow the traffic via network rules. Also I have associated UDRs with different subnets in various VNETs. But I am not able to reach the storage account which is having a Private endpoint in VNET-D from Azure databricks in VNET-A. Please help me troubleshoot/resolve this?

Azure Virtual Network
Azure Virtual Network
An Azure networking service that is used to provision private networks and optionally to connect to on-premises datacenters.

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Ganesh Patapati 10,385 Reputation points Microsoft External Staff Moderator
    2025-11-20T05:51:17.08+00:00

    Hello Sahil Chaudhry

    Your current setup will not work as expected because of how Azure Private Endpoints and VNet peering behave.

    A Private Endpoint creates a private IP in the target VNet (VNET-D) and is only reachable through that VNet or directly peered VNets.

    Transitive peering is not supported in Azure. So VNET-A → VNET-B → VNET-C → VNET-D does not allow traffic to flow across all hops.

    Even though you have UDRs pointing traffic to the firewall, the Private Endpoint traffic cannot traverse multiple peered VNets because Azure does not allow transitive routing between peered VNets.

    To make this work, you have one main option:

    Direct Peering:

    • Peer VNET-A directly with VNET-D.
    • Ensure DNS resolution for the Private Endpoint works (use Azure Private DNS Zones linked to VNET-A and VNET-D).
    • Update UDRs if needed to route traffic through the firewall (if you want inspection).

    Kindly let us know if the above helps or you need further assistance on this issue.

    Please click Accept Answer and upvote if the above was helpful.

    Thanks. Accepted answer

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.