Looking for a solution for: Azure network hub with connected vNets(other Azure subscribtions) with overlapping subnets

Question

We have set up a functional design where our customer wants to connect several of their customers with an Azure subscription to the Azure Network Hub. The Azure Network Hub is connected to the customer's on-premises data center via an ExpressRoute connection.

The customers connect their vNets (Spokes) to the Azure Network Hub. We need to be able to route traffic from the customer vNets to the on-premises corporate network.

There is a possibility of an overlapping subnet between the customer vnets. vNet peering is therefore not an option.

I would like to know what solutions are available to achieve this. See attached diagram for routing details with overlapping customer subnets.

Answer 1

@ScreptorIT ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you have a Hub Virtual Network connected to OnPrem via ExpressRoute and multiple Spoke VNETs with overlapping address ranges that need to connect to OnPREM via the Hub.

With your current set up,

• You can consider using Site-to-Site or VNET-to-VNET connection between your Spoke VNETS and Hub VNET with NAT and BGP Enabled
  • See : About NAT on Azure VPN Gateway
  • See : About BGP and VPN Gateway
• Enabling NAT is to solve the problem of overlapping address ranges
• Enabling BGP is to have transit routing to OnPrem via the VPN Gateway
  • 
  • Here, TestVNet1 is the Hub and you can see, TestVNet2 (Spoke) can connect to the OnPrem site
  • More configuration info on How to configure BGP for Azure VPN Gateway

NOTE:

• This means, you have to deploy VPN Gateways in all the Spoke VNETs
• And also, you must consider the maximum number of connections the Hub Gateway SKU can support
  • See : Gateway SKUs comparison
• My suggestion would be to use VNET Peering whenever possible and only create S2S/VNET-to-VNET when there is an existing VNET Peering with overlapping address range so that you don't hit the maximum connection limits.

Additionally, you can use vWAN in scenarios where you need more than 100 S2S VPN tunnels

Cheers,

Kapil

---

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.