Virtual WAN

prasantc 936

Is it true that Connection between the virtual hub cannot be secured by Azure firewall and only the traffic between the spoke and vhub is secured by Az firewall premium? Or this limitation has been fixed now

Luke Murray 11,091 Reputation points MVP

2023-07-23T22:21:44.23+00:00

Hello, happy to help, but just need some clarification - Spoke, and vhub can be secured by Azure Firewall Premium. Are you meaning vhub to vhub (ie cross region)?
prasantc 936 Reputation points

2023-07-23T23:22:32.36+00:00

Yes, secured vhub to vhub across the region? Does that limitation still apply?
prasantc 936 Reputation points

2023-07-23T23:24:19.87+00:00

Yes. I am planning to propose a solution to secure vHub to Vhub across the region secured by AZ firewall. If it cannot be secured, is there an option to integrate the path with third party NVA like Palo A?
GitaraniSharma-MSFT 49,581 Reputation points Microsoft Employee

2023-07-24T13:08:48.8133333+00:00

Hello @prasantc ,

As mentioned by @Luke Murray below, secured hub to secured hub connectivity across regions topology is supported with Routing Intent.

Refer: https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-global-transit-network-architecture#security

https://learn.microsoft.com/en-us/azure/virtual-wan/routing-deep-dive#scenario-2-global-reach-and-hub-routing-preference

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

Accepted answer

Luke Murray 11,091 Reputation points MVP

2023-07-23T23:30:05.7+00:00
You can deploy a secured vhub to vhub connection with Routing Intent.

Hub 1 configuration:

Private Traffic Policy with Next Hop Hub 1 Azure Firewall, NVA or SaaS solution

Internet Traffic Policy with Next Hop Hub 1 Azure Firewall, NVA or SaaS solution

Hub 2 configuration:

Private Traffic Policy with Next Hop Hub 2 Azure Firewall, NVA or SaaS solution

Internet Traffic Policy with Next Hop Hub 2 Azure Firewall, NVA or SaaS solution
Please sign in to rate this answer.
prasantc 936 Reputation points

2023-07-24T15:13:48.5133333+00:00

For NVA or SaaS solution is it limited to barracuda or other three appliance or it will support Palo Alto?

Luke Murray 11,091 Reputation points MVP

2023-07-24T19:33:03.7266667+00:00

At the time of writing, it looks like these are supported:

Network Virtual Appliances (NVAs) can only be specified as the next hop resource for routing intent if they're Next-Generation Firewall or dual-role Next-Generation Firewall and SD-WAN NVAs. Currently, checkpoint, fortinet-ngfw and fortinet-ngfw-and-sdwan are the only NVAs eligible to be configured to be the next hop for routing intent.

If you have a support case with Palo Alto etc, then it would be worth checking their roadmap for this support.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Virtual WAN

0 additional answers

Your answer