{"id":7517,"date":"2020-01-15T13:04:34","date_gmt":"2020-01-15T13:04:34","guid":{"rendered":"https:\/\/rax-stg-wp-aws.com\/blogs\/azure-paas-vnet-integration-with-a-hub-and-spoke-topology\/"},"modified":"2026-11-03T19:28:43","modified_gmt":"2026-11-03T19:28:43","slug":"azure-paas-vnet-integration-with-a-hub-and-spoke-topology","status":"publish","type":"blogs","link":"https:\/\/www.rackspace.com\/en-gb\/blogs\/azure-paas-vnet-integration-with-a-hub-and-spoke-topology\/","title":{"rendered":"Azure PaaS VNet integration with a hub-and-spoke topology"},"content":{"rendered":"<p><strong>Introduction<\/strong><\/p>\n<p>A colleague of mine sent me a message asking if I ever had an issue deploying an Azure\u00ae web app that routed through a hub-and-spoke topology. Trying to think back through the hundreds of deploys I have done, nothing came to me regarding any difficulties. Digging more into the problem with him, he explained that the web app could hit any virtual machine in the hub, but nothing in the spokes. This symptom sounded like a routing issue, with some oddities sprinkled on top.<\/p>\n<p>Without going into details of setting up virtual network (VNet) integration v1, here are the basic requirements:<\/p>\n<ul>\n<li>Have a standard <strong>App Service Plan<\/strong>.<\/li>\n<li>Have a VPN gateway provisioned with point-to-site configured with an address range&nbsp;to hand out to the web apps.&nbsp;<\/li>\n<\/ul>\n<p>&nbsp;<br \/>\nAfter you set up the VNet configuration within the Azure web app, it says <strong>connected<\/strong>. At this point, you&#8217;d expect that you are done, but nothing is ever that easy. After&nbsp;initially setting up the VNet integration, I accessed the KUDU console and used&nbsp;<strong>TCPPING&nbsp;<\/strong>to verify connectivity to the resource within the VNet that I needed to reach. TCPPING failed, and the network did not sync correctly. To manually sync the network to let initial connectivity happen, I used&nbsp;the following steps:<\/p>\n<p>\n1. Click on the <strong>App Service Plan<\/strong>&nbsp;of the web app where you configured VNet integration and select&nbsp;<strong>Networking<\/strong>&nbsp;from the blade. Select <strong>Click here<\/strong>&nbsp;to manage under <strong>VNet Integration<\/strong>.<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26427-body-navigation.png\" alt=\"Paas Pic 1\" \/><\/p>\n<p><em>Navigation<\/em><br \/>\n&nbsp; &nbsp;<br \/>\n2. Click on the VNet that is acting as the hub VNet.<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26427-body-drillDown.png\" alt=\"Paas pic 2\" \/><\/p>\n<p>&nbsp; &nbsp;<br \/>\n3. Click on <strong>Sync Network<\/strong>.<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26427-body-syncNetwork.png\" alt=\"Paas pic 3\" \/><\/p>\n<p>Back at the KUDU console, TCPPING should work when it is pointed to an IP address of a hub virtual machine.<br \/>\nHowever, trying to ping a virtual machine in the spoke VNet did not work. Within the <strong>App Service Plan<\/strong>&nbsp;where&nbsp;the sync network operation is, I scrolled to the bottom, and there was a table labeled&nbsp;<strong>IP ADDRESSES ROUTED TO VNet<\/strong>. I saw all three private RFC 1918 address ranges listed and was confused about why&nbsp;the routing was not working. I tried explicitly adding the address range for the spoke VNet&nbsp;and tried TCPPING again, which now succeeded.&nbsp;<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26427-body-addRoute.png\" alt=\"Paas Pic 4\" \/><\/p>\n<p>I exited out of the networking blade and went back in to see that my address range was gone! Even though it was gone, my TCPPING requests still worked. To verify what routes are in the app service plan, I browsed to Azure resources <a href=\"https:\/\/resources.azure.com\">here<\/a>. Then, I drilled down to the app service plan and into the <strong>virtualNetworkConnections<\/strong>. As the following image shows, my route type of&nbsp;static was still there. If I had to guess, I&#8217;d say this must be a bug with the user interface.&nbsp;<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26427-body-resources.azure_.com_.png\" alt=\"Paas pic 6 \" \/><\/p>\n<p>If you find yourself stuck figuring out why the routing doesn&#8217;t work, and you have verified that the virtual&nbsp;network peering settings are correct, try adding a route for the spoke VNet in the <strong>App Service Plan<\/strong>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Azure PaaS VNet integration with a hub-and-spoke topology<\/p>\n","protected":false},"author":2,"featured_media":7519,"menu_order":0,"comment_status":"open","ping_status":"open","template":"","format":"standard","meta":{"content-type":"","nid":"26427","content_type":"blog","created_by":"10130","authored_on":"2024-01-01T13:04:34+00:00","field_article_industries":"","tag_category":"Technical","field_blog_author_text":"by Rackspace Technology Staff","seo_description":"Explore backup compression and transparent data encryption (TDE) in SQL Server. Optimize cost savings and secure data.\r\n","field_featured_image":"","insights_image":"\/wp-content\/uploads\/2026\/blog_technical_images\/26427-insights_image-microsoft-technical-blog-1-insights.jpg","field_partners":"","rxt_platforms":"Microsoft Azure","product":"","publisheddate":"2020-01-15T13:04:34","rxt_solutions":"Cloud, Cloud Adoption & Migration, Cloud Management & Operations","opengraph_tag":"","x_tag":"","teaser_flag":"Technical Blog","seo_titile":"Azure PaaS VNet Integration | Rackspace Technology","field_topics":"","field_slug":"azure-paas-vnet-integration-routes","footnotes":""},"categories":[178],"tags":[204],"class_list":["post-7517","blogs","type-blogs","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-technical"],"_links":{"self":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs\/7517","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs"}],"about":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/types\/blogs"}],"author":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/comments?post=7517"}],"version-history":[{"count":3,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs\/7517\/revisions"}],"predecessor-version":[{"id":9514,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs\/7517\/revisions\/9514"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/media\/7519"}],"wp:attachment":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/media?parent=7517"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/categories?post=7517"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/tags?post=7517"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}