Hub and Spoke architecture traffic flow issue?

Sourabh Chhabra 40

We have a hub and spoke architecture environment. We need communication from vm1 from spoke 1 to communicate to vm2 in spoke 2 using hub and azure firewall in hub vnet. We need to establish this connection without using Virtual Network Gateway. We already have associated route table to spoke 1 and spoke 2 to send the traffic to Firewall as next hope of we need traffic flow. Already allowed firewall rules to allow the traffic. However don't see the traffic going from hub to spoke 2 when trying to connect from vm1 to vm2. Please suggest what setting would be needed to establish this connectivity.

Deepanshukatara-6769 10,685 Reputation points

2024-06-24T17:06:24.33+00:00
Hi Sourabh, Welcome to MS Q&A

Check Effective Routes:

Use the "Effective routes" option in the Azure portal for the NICs of VM1 and VM2 to verify that the routes are correctly propagating and pointing to the firewall as the next hop.

Diagnose Traffic Flow:

Use Network Watcher and its connection troubleshoot feature to diagnose and see where the traffic might be failing.

Can you please check once above two points and shared the details and result with us to help you with more accurate solutions here
Sourabh Chhabra 40 Reputation points

2024-06-24T17:14:11.9133333+00:00

Yes, effective route is showing next hop as virtual appliance and firewalls private ip, I will check network watcher and come back. Thanks
ChaitanyaNaykodi-MSFT 26,451 Reputation points Microsoft Employee

2024-06-25T02:16:00.64+00:00

@Sourabh Chhabra

Thank you for reaching out.You can follow this documentation to troubleshoot the connectivity issue using Azure network watcher.

Meanwhile can you please also share a network diagram of your set-up as it will help troubleshoot the issue? And if you have configured a Virtual network peering between the hub and spoke network, please make sure you selected the correct options in the settings of you VNET peering.

https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-manage-peering?tabs=peering-portal#create-a-peering

Thank you!
Sourabh Chhabra 40 Reputation points

2024-06-25T02:42:47.2966667+00:00

tried removing NSG also , will try Network watcher and allow any any rule for testing and come back, Thanks
Deepanshukatara-6769 10,685 Reputation points

2024-06-27T04:29:42.8633333+00:00

Hi Sourabh , do we have any updates ?
Sourabh Chhabra 40 Reputation points

2024-06-27T04:35:28.3466667+00:00

I had to re create the whole infra again and it worked this time. I wonder.what happened last time. Thank you for ur recommendation.

Accepted answer

Andreas Baumgarten 111.5K Reputation points MVP

2024-06-24T16:53:31.1366667+00:00
Hi @Sourabh Chhabra ,

for me it sounds like 2 routes are missing:

Route from spoke 1 IP to spoke 2 IP address range using the hub vNet NVA in hub vNet as the next hop

Route from spoke 2 IP to spoke 1 IP address range using the hub vNet NVA in hub vNet as the next hop

If you don't have the routes please add the routes and try again.

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards

Andreas Baumgarten
Please sign in to rate this answer.
Sourabh Chhabra 40 Reputation points

2024-06-24T17:04:51.02+00:00

Yes, both the routes are in place . From spoke1 to spoke to spoke 2 and next hop as Azure firewall private ip n similar for spoke 2 to spoke 1 with next hop as az firewall. My real question is how will hub transfer the data to destination and which route it will take. Is there any routing we do or firewall will have its its own route table in back ground to transfer data from hub to destination spoke 2

Andreas Baumgarten 111.5K Reputation points MVP

2024-06-24T17:20:24.9766667+00:00

Hi @Sourabh Chhabra ,

if everything is configured correctly the transfer of spoke to spoke communication will be send to the hub vNet and the Azure firewall will take for the routing and the filtering of network traffic based on firewall rules.

You should check the effective Routes for each VM NIC. Both effective routes should point to the hub vNet FW.

Also verify the firewalls of the VM OS are allowing ICMP in/out.

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards

Andreas Baumgarten

Sourabh Chhabra 40 Reputation points

2024-06-24T17:35:23.5866667+00:00

Yes both effective route shows next hop as virtual appliance n firewall private ip only, OS firewall is disabled, still can't connect, tried different ports by allowing in NSG n fw rules

Andreas Baumgarten 111.5K Reputation points MVP

2024-06-24T18:38:07.2966667+00:00

Hi @Sourabh Chhabra ,

have you tried to remove the NSG (disassociate from the subnets for testing).

Also an option: Simplify the FW rules for testing (something like any/any/allow).

If the FWs of the VMs are disabled and the routing is configured properly it might be a NSG/FW rule issue.

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards

Andreas Baumgarten

Sourabh Chhabra 40 Reputation points

2024-06-27T04:36:04.2+00:00

I had to re create the whole infra again and it worked this time. I wonder.what happened last time. Thank you for ur recommendation.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Hub and Spoke architecture traffic flow issue?

0 additional answers

Your answer