How to fix vNet peering template - azure

Question

I am using nested templates to create a hub and spoke Azure networking deployment. I have 3 nested templates and currently it creates 1 at a time. When I create the vNet peerings, the other virtual networks have not created, therefore the first nested template doesn't complete because it's trying to reference a vNet that doesn't exist. I have tried a depends on before the vNet peerings, although it fails saying the resources are never mentioned in the templates.
{
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/Microsoft.Resources.json",
"contentVersion": "1.0.0.0",
"parameters": {
"vnetName": {
"type": "string",
"metadata": {
"description": "VNet name"
}
},
"vnetAddressPrefix": {
"type": "string",
"metadata": {
"description": "Address prefix"
}
},
"internalvNetName": {
"type": "string",
"metadata": {
"description": "Internal vNet Name"
}
},
"internalvNetAddressPrefix": {
"type": "string",
"metadata": {
"description": "Internal vNet Address Prefix"
}
},
"internal-subnet1Prefix": {
"type": "string",
"metadata": {
"description": "Subnet 1 prefix"
}
},
"internal-subnet1": {
"type": "string",
"metadata": {
"description": "internal Subnet 1 Name"
}
},
"internal-NSG": {
"type": "string",
"metadata": {
"description": "internal NSG Name"
}
},
"DMZResourceGroup": {
"type": "string",
"metadata": {
"description": "resource group for DMZ environment"
}
},
"HUBResourceGroup": {
"type": "string",
"metadata": {
"description": "resource group for HUB environment"
}
},
"internalServersRG": {
"type": "string",
"metadata": {
"description": "resource group for Internal servers"
}
},
"DMZvnet": {
"type": "string",
"metadata": {
"description": "VNet for DMZ environment"
}
},
"DMZvnetAddressPrefix": {
"type": "string",
"metadata": {
"description": "DMZ VNet Address prefix"
}
},
"DMZFESubnet1Prefix": {
"type": "string",
"metadata": {
"description": "Subnet1 for DMZ environment. This is the Front-End subnet"
}
},
"DMZBESubnet2Prefix": {
"type": "string",
"metadata": {
"description": "Subnet1 for DMZ environment. This is the Back-End subnet"
}
},
"DMZNSG": {
"type": "string",
"metadata": {
"description": "NSG for DMZ environment"
}
},
"DMZFEsubnetName": {
"type": "string",
"metadata": {
"description": "Front-End subnet for DMZ environment"
}
},
"DMZBEsubnetName": {
"type": "string",
"metadata": {
"description": "Back-End subnet for DMZ environment"
}
},
"subnet1Prefix": {
"type": "string",
"metadata": {
"description": "Subnet 1 prefix"
}
},
"subnet1Name": {
"type": "string",
"metadata": {
"description": "Subnet 1 Name"
}
},
"subnet2Prefix": {
"type": "string",
"metadata": {
"description": "Subnet 2 Prefix"
}
},
"subnet2Name": {
"type": "string",
"metadata": {
"description": "Subnet 2 Name"
}
},
"subnet3Prefix": {
"type": "string",
"metadata": {
"description": "Subnet 3 Prefix"
}
},
"subnet3Name": {
"type": "string",
"metadata": {
"description": "Subnet 3 Name"
}
},
"networkSecurityGroupName": {
"type": "string"
}
},
"variables": {
"location": "West Europe",
"HUBvNettoDMZvNet": "[concat(parameters('VNetName'), '-', parameters('DMZvnet'))]",
"DMZvNettoHUBvNet": "[concat(parameters('DMZvnet'), '-', parameters('VNetName'))]"
},
"resources": [
{
"name": "[parameters('DMZResourceGroup')]",
"type": "Microsoft.Resources/resourceGroups",
"apiVersion": "2018-05-01",
"location": "[variables('Location')]",
"tags": {},
"properties": {}
},
{
"name": "[parameters('HUBResourceGroup')]",
"type": "Microsoft.Resources/resourceGroups",
"apiVersion": "2018-05-01",
"location": "[variables('Location')]",
"tags": {},
"properties": {}
},
{
"name": "[parameters('internalserversrg')]",
"type": "Microsoft.Resources/resourceGroups",
"apiVersion": "2018-05-01",
"location": "[variables('Location')]",
"tags": {},
"properties": {}
},
{
"apiVersion": "2017-05-10",
"name": "hubtemplate",
"type": "Microsoft.Resources/deployments",
"resourceGroup": "[parameters('Hubresourcegroup')]",
"dependsOn": [
"[resourceId('Microsoft.Resources/resourceGroups/', parameters('HUBResourceGroup'))]"
],
"properties": {
"mode": "incremental",
"template": {
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentversion": "1.0.0.0",
"parameters": {},
"variables": {},
"resources": [
{
"apiVersion": "2017-06-01",
"type": "Microsoft.Network/virtualNetworks",
"name": "[parameters('vnetName')]",
"location": "[variables('Location')]",
"properties": {
"addressSpace": {
"addressPrefixes": [
"[parameters('vnetAddressPrefix')]"
]
},
"subnets": [
{
"name": "[parameters('subnet1Name')]",
"properties": {
"addressPrefix": "[parameters('subnet1Prefix')]"
}
},
{
"name": "[parameters('subnet2Name')]",
"properties": {
"addressPrefix": "[parameters('subnet2Prefix')]"
}
},
{
"name": "[parameters('subnet3Name')]",
"properties": {
"addressPrefix": "[parameters('subnet3Prefix')]"
}
}
]
}
},
{
"name": "[concat(parameters('vnetname'), '/peered-to-', parameters('dmzvnet'))]",
"type": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings",
"apiVersion": "2018-08-01",
"location": "[variables('location')]",
"dependsOn": [
"[concat('Microsoft.Network/virtualNetworks/', parameters('VNetName'))]"
],
"properties": {
"allowVirtualNetworkAccess": true,
"allowForwardedTraffic": true,
"allowGatewayTransit": true,
"useRemoteGateways": false,
"remoteVirtualNetwork": {
"id": "[concat(subscription().id, '/resourceGroups/', parameters('DMZresourcegroup'), '/providers/Microsoft.Network/virtualNetworks/', parameters('DMZvNet'))]"
}
}
},
{
"name": "[concat(parameters('vnetname'), '/peered-to-', parameters('internalvNetName'))]",
"type": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings",
"apiVersion": "2018-08-01",
"location": "[variables('location')]",
"dependsOn": [
"[concat('Microsoft.Network/virtualNetworks/', parameters('VNetName'))]"
],
"properties": {
"allowVirtualNetworkAccess": true,
"allowForwardedTraffic": true,
"allowGatewayTransit": true,
"useRemoteGateways": false,
"remoteVirtualNetwork": {
"id": "[concat(subscription().id, '/resourceGroups/', parameters('internalServersRG'), '/providers/Microsoft.Network/virtualNetworks/', parameters('internalvNetName'))]"
}
}
},
{
"apiVersion": "2015-06-15",
"type": "Microsoft.Network/networkSecurityGroups",
"name": "[parameters('networkSecurityGroupName')]",
"location": "[variables('location')]",
"properties": {
"securityRules": [
{
"name": "allow-rdp",
"properties": {
"description": "allow rdp",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "3389",
"sourceAddressPrefix": "*",
"destinationAddressPrefix": "10.1.1.0",
"access": "Allow",
"priority": 110,
"direction": "Inbound"
}
},
{
"name": "allow-smb",
"properties": {
"description": "allow smb",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "445",
"sourceAddressPrefix": "*",
"destinationAddressPrefix": "10.1.1.0",
"access": "Allow",
"priority": 112,
"direction": "Inbound"
}
}
]
}
}
],
"outputs": {}
}
}
},
{
"apiVersion": "2017-05-10",
"name": "dmztemplate",
"type": "Microsoft.Resources/deployments",
"resourceGroup": "[parameters('DMZresourcegroup')]",
"dependsOn": [
"[resourceId('Microsoft.Resources/resourceGroups/', parameters('DMZResourceGroup'))]",
"HUBTemplate"
],
"properties": {
"mode": "incremental",
"template": {
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentversion": "1.0.0.0",
"parameters": {},
"variables": {},
"resources": [
{
"apiVersion": "2017-06-01",
"type": "Microsoft.Network/virtualNetworks",
"name": "[parameters('DMZvNet')]",
"location": "[variables('Location')]",
"properties": {
"addressSpace": {
"addressPrefixes": [
"[parameters('DMZvNetaddressPrefix')]"
]
},
"subnets": [
{
"name": "[parameters('DMZFEsubnetName')]",
"properties": {
"addressPrefix": "[parameters('DMZFESubnet1Prefix')]"
}
},
{
"name": "[parameters('DMZBEsubnetName')]",
"properties": {
"addressPrefix": "[parameters('DMZBESubnet2Prefix')]"
}
}
]
}
},
{
"name": "[concat(parameters('dmzvnet'), '/peered-to-', parameters('vnetname'))]",
"type": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings",
"apiVersion": "2018-08-01",
"location": "[variables('location')]",
"dependsOn": [
"[concat('Microsoft.Network/virtualNetworks/', parameters('dmzvnet'))]"
],
"properties": {
"allowVirtualNetworkAccess": true,
"allowForwardedTraffic": true,
"allowGatewayTransit": true,
"useRemoteGateways": false,
"remoteVirtualNetwork": {
"id": "[concat(subscription().id, '/resourceGroups/', parameters('HUBResourceGroup'), '/providers/Microsoft.Network/virtualNetworks/', parameters('vnetname'))]"
}
}
},
{
"name": "[concat(parameters('dmzvnet'), '/peered-to-', parameters('internalvNetName'))]",
"type": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings",
"apiVersion": "2018-08-01",
"location": "[variables('location')]",
"dependsOn": [
"[concat('Microsoft.Network/virtualNetworks/', parameters('dmzvnet'))]"
],
"properties": {
"allowVirtualNetworkAccess": true,
"allowForwardedTraffic": true,
"allowGatewayTransit": true,
"useRemoteGateways": false,
"remoteVirtualNetwork": {
"id": "[concat(subscription().id, '/resourceGroups/', parameters('internalServersRG'), '/providers/Microsoft.Network/virtualNetworks/', parameters('internalvNetName'))]"
}
}
},
{
"apiVersion": "2015-06-15",
"type": "Microsoft.Network/networkSecurityGroups",
"name": "[parameters('DMZNSG')]",
"location": "[variables('location')]",
"properties": {
"securityRules": [
{
"name": "allow-rdp",
"properties": {
"description": "allow rdp",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "3389",
"sourceAddressPrefix": "*",
"destinationAddressPrefix": "10.0.1.0",
"access": "Allow",
"priority": 110,
"direction": "Inbound"
}
}
]
}
}
],
"outputs": {}
}
}
},
{
"apiVersion": "2017-05-10",
"name": "internalserverstemplate",
"type": "Microsoft.Resources/deployments",
"resourceGroup": "[parameters('internalserversrg')]",
"dependsOn": [
"[resourceId('Microsoft.Resources/resourceGroups/', parameters('internalserversrg'))]",
"DMZTemplate"
],
"properties": {
"mode": "incremental",
"template": {
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentversion": "1.0.0.0",
"parameters": {},
"variables": {},
"resources": [
{
"apiVersion": "2017-06-01",
"type": "Microsoft.Network/virtualNetworks",
"name": "[parameters('internalvNetName')]",
"location": "[variables('Location')]",
"properties": {
"addressSpace": {
"addressPrefixes": [
"[parameters('internalvNetAddressPrefix')]"
]
},
"subnets": [
{
"name": "[parameters('internal-subnet1')]",
"properties": {
"addressPrefix": "[parameters('internal-subnet1Prefix')]"
}
}
]
}
},
{
"name": "[concat(parameters('internalvNetName'), '/peered-to-', parameters('dmzvnet'))]",
"type": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings",
"apiVersion": "2018-08-01",
"location": "[variables('location')]",
"dependsOn": [
"[concat('Microsoft.Network/virtualNetworks/', parameters('internalvNetName'))]"
],
"properties": {
"allowVirtualNetworkAccess": true,
"allowForwardedTraffic": true,
"allowGatewayTransit": true,
"useRemoteGateways": false,
"remoteVirtualNetwork": {
"id": "[concat(subscription().id, '/resourceGroups/', parameters('DMZresourceGroup'), '/providers/Microsoft.Network/virtualNetworks/', parameters('DMZvNet'))]"
}
}
},
{
"name": "[concat(parameters('internalvNetName'), '/peered-to-', parameters('vnetname'))]",
"type": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings",
"apiVersion": "2018-08-01",
"location": "[variables('location')]",
"dependsOn": [
"[concat('Microsoft.Network/virtualNetworks/', parameters('internalvNetName'))]"
],
"properties": {
"allowVirtualNetworkAccess": true,
"allowForwardedTraffic": true,
"allowGatewayTransit": true,
"useRemoteGateways": false,
"remoteVirtualNetwork": {
"id": "[concat(subscription().id, '/resourceGroups/', parameters('HUBresourceGroup'), '/providers/Microsoft.Network/virtualNetworks/', parameters('vnetname'))]"
}
}
},
{
"apiVersion": "2015-06-15",
"type": "Microsoft.Network/networkSecurityGroups",
"name": "[parameters('internal-NSG')]",
"location": "[variables('location')]",
"properties": {
"securityRules": [
{
"name": "allow-rdp",
"properties": {
"description": "allow rdp",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "3389",
"sourceAddressPrefix": "*",
"destinationAddressPrefix": "10.0.1.0",
"access": "Allow",
"priority": 110,
"direction": "Inbound"
}
}
]
}
}
],
"outputs": {}
}
}
}
]
}

Answer 1

I would do almost exactly what you are doing, but I would create nested templates for peerings, because you have chicken and egg problem. you need to create vnet, wait for its neighbour vnet to come up and then create peering. but in a deployment you can only wait for the resources in the same deployment, so its essentially impossible, unless you create all the vnets "at once" and only start to peer things together once all the vnets are ready.