Finally Azure allow peering between different subscription and I can implement my desired routing easy by vnet peering. I followed the instruction below to set up peering between different subscription and create a routing table attached to vnetB to direct traffic to vmx100 in vnetA. I also defined vnetB subnet in vmx100 site2site vpn setting as one of the local network. https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview   Andy ... View more

thank you Mrcur.   That's what I did but still not work. But if changing vnet-to-vnet connection to vnet peering, it works immediately and my on-prem can ping to vnet2 without issues. ... View more