Let's look at a hybrid cloud network topology that I created using Lucidchart.
We don't have to get into every moving piece on this picture,
I just want to show you some high‑level trends.
Here we have a site‑to‑site virtual private network.
This is an IPsec IKEv2 tunnel going over the public internet.
That provides a secure tunnel connection between the edge of your
on‑premises environment and a hub Azure virtual network,
you see?
Though, this site‑to‑site VPN,
or an alternative that doesn't use the internet would be ExpressRoute,
provide a way for you to extend your OSI Layer 3,
your on‑premises environment into Azure,
and that way you can use local administration tools
to govern your Azure‑based VMs, you can use Azure tools to govern your local VMs,
or you could truly use them both in a truly hybrid scenario.
You might wonder,
what do I have to set up with regard to routing within
a single virtual network in Azure?
And the answer is, at least initially, nothing.
I'll describe the Azure wire server in a little while,
but just suffice it to say that although we have separate subnets here that have
different IP ranges within the same overall address range,
we don't have to worry about routing.
Azure system routes take care of that traffic.
Same thing with name resolution, at least single label name resolution.
A common way to join virtual networks is to create peerings.
This opens up a routing path between two VNets that stays on the Azure backbone,
so you're not going out onto the internet.
And you should know that you can use peering to connect any two VNets.
They don't have to be in the same region,
they don't have to be in the same subscription,
they don't even have to be in the same Azure AD tenant,
believe it or not.
It's pretty convenient.
And this peering, this hub‑spoke architecture,
as it's called, opens up all sorts of useful conveniences like service chaining.
For example, you could deploy an AzureBastionSubnet,
which is a managed jump host in your hub VNet,
and you can go through that bastion to make a secure connection to, say, our system s1 in the s1 spoke VNet by transiting over that peering.