Express Route and Azure Firewall

Question

We have express route to on-prem and it is working fine. We are in the process of implementing Az Firewall but are having trouble getting the routing right. I know you cannot add routes to the Express Route subnet so how do we force traffic that arrives over Express Route to the Azure Firewall?

Answer 1

Hello @MDavis ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that you have a working ExpressRoute connection between Azure and your on-premises and are in the process of deploying Azure Firewall which should inspect the to and fro traffic between Azure and on-premises. Please correct me if my understanding is incorrect.

For Azure to On-premise traffic:

To filter all the traffic going out of Azure by the firewall, you can add a UDR with 0.0.0.0/0 on all the subnets (except the Firewall subnet) with next hop as your Azure Firewall.
This setup will take care of the routing from Azure to on-prem which will go as below:
All subnets --> Azure firewall --> ExpressRoute gateway --> On-premises.

NOTE : Azure Firewall must have direct Internet connectivity. If your AzureFirewallSubnet learns a default route to your on-premises network via BGP, you must override this with a 0.0.0.0/0 UDR with the NextHopType value set as Internet to maintain direct Internet connectivity or stop advertising the default route from on-prem. Post this you can filter the outbound traffic within the Azure Firewall according to your needs by configuring network rules.
Refer : https://learn.microsoft.com/en-us/azure/firewall/firewall-faq#is-forced-tunneling-chaining-to-a-network-virtual-appliance-supported

For return On-premise to Azure traffic:

GatewaySubnet do not support 0.0.0.0/0 UDRs but it supports UDRs with other address prefixes.
Hence, you can add a UDR to the ExpressRoute GatewaySubnet with the address prefix of your Vnet range with next hop type Virtual Appliance and IP address of your Azure firewall. This will make sure that any traffic that comes from your on-premises for your Azure Vnet range, when reaches your ExpressRoute gateway will be forwarded to the firewall for scanning.

NOTE : Propagate gateway routes should be set to "Enabled" on the GatewaySubnet to ensure availability of the gateway and to propagate your on-premises routes to the network interfaces in the subnet.

For example : If your Vnet address range is 10.0.0.0/16 then you can add a UDR to your ExpressRoute GatewaySubnet as below:
Address prefix : 10.0.0.0/16 --> Next hop = Virtual Appliance --> Next hop = IP address of Azure Firewall

So the routing from On-prem to Azure will go as below:
On-premises --> ExpressRoute gateway --> Azure firewall --> All subnets.

Kindly let us know if the above helps or you need further assistance on this issue.

----------------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

Hello @MDavis

Thank you for your post.

I would say to use UDR as well as BGP.... If you want more info please refer yourself to the next documentation below:

https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview

https://learn.microsoft.com/en-us/azure/expressroute/expressroute-routing#advertising-default-routes

Best Regards,

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.