How can I enforce Azure Firewall using Hub & Spoke with multiple subscriptions?

Question

Hello,

we are using classic hub/spoke with Express Route and want to manage a central firewall instance for all connections to on-prem.

We have setup a dedicated subscription hosting an Express route, Hub VNet & Azure Firewall. The spokes peered with the hub are distributed in multiple subscriptions. As far as I understood, a Route table with an entry 0.0.0.0/0 pointing to the Azure Firewall must be setup for each subnet of the spokes in order to force traffic routed to the Azure Firewall.

Is there a better solution or how can we force this route table on every subnet connected to the hub?
Is it possible to have an Azure Policy to auto-deploy the route table?

Anyone had a similar issue and found a smart solution?
Happy to get your thoughts on this.

Best regards & Thanks

Answer 1

@Stawik, Lukas ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you have a requirement to validate that every subnet in your Hub Spoke architecture (excluding FirewallSubnet, GatewaySubnet) has a Route Table with a User Defined Route to nextHop as the Firewall.

Wrt, "As far as I understood, a Route table with an entry 0.0.0.0/0 pointing to the Azure Firewall must be setup for each subnet of the spokes in order to force traffic routed to the Azure Firewall."

• The 0.0.0.0/0 route is used to force Internet Bound traffic or "default" traffic to the Azure Firewall.
• i.e., if you also want subnet to subnet traffic to go via Azure Firewall, you should define all the subnets in the Route Table and set nextHop as Azure Firewall
  This includes,
  • Spoke1subnet1 <----> Spoke1subnet2
  • Spoke1subnet1 <----> Hub1subnet1
  • Spoke1subnet1 <----> OnPrem
• The above routes, do not go via Firewall if you only have 0.0.0.0/0 route.

Wrt, "Is there a better solution or how can we force this route table on every subnet connected to the hub? Is it possible to have an Azure Policy to auto-deploy the route table?"

• You can consider the preview policy : All Internet traffic should be routed via your deployed Azure Firewall
• See : Azure Policy built-in definitions for Azure Virtual Network.

Hope this helps.

Cheers,

Kapil