Propagate gateway routes azure!

Naveenbalaji B 25 Reputation points
2023-09-20T05:50:12.8+00:00

I have configured Point-to-site VPN connection. I configured the network in HUB and Spoke Architecture, and Hub and Spoke is peered (Allowed Gateway Transits and Remote gateway server). In Hub I have Azure firewall. I have configured the Azure Route table (Propagate gateway routes: NO) to route traffic to Azure firewall. So that question is that when connect VM in the Spoke Vnet I couldn't take SSH or ping that VM, but after enabling the Propagate gateway routes, I could connect successfully with Spoke Network. Could you explain why I couldn't connect to spoke Vnet resources, When I disabled the Propagate gateway routes: NO?

Azure VPN Gateway
Azure VPN Gateway
An Azure service that enables the connection of on-premises networks to Azure through site-to-site virtual private networks.
1,795 questions
Azure Firewall
Azure Firewall
An Azure network security service that is used to protect Azure Virtual Network resources.
780 questions
0 comments No comments
{count} votes

Accepted answer
  1. GitaraniSharma-MSFT 50,096 Reputation points Microsoft Employee Moderator
    2023-09-20T09:17:30.4166667+00:00

    Hello @Naveenbalaji B ,

    Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

    I understand that you've configured a hub and spoke architecture in Azure where Hub and Spoke Vnets are peered (with Allowed Gateway Transits and Remote gateway server). In Hub you have an Azure firewall and you have added Route table to the subnets (with Propagate gateway routes: NO) to route traffic via Azure firewall. You've a Point-to-site VPN connection and when trying to connect to a VM in the Spoke Vnet, you couldn't SSH or ping that VM, but after enabling the Propagate gateway routes, you were able to connect it successfully.

    As mentioned in the Azure routing documentation,

    ER and VPN Gateway route propagation can be disabled on a subnet using a property on a route table. When you disable route propagation, the system doesn't add routes to the route table of all subnets with Virtual network gateway routes. This process applies to both static routes and BGP routes. Connectivity with VPN connections is achieved using custom routes with a next hop type of Virtual network gateway. Route propagation shouldn't be disabled on the GatewaySubnet. The gateway will not function with this setting disabled.

    Refer: https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview#border-gateway-protocol

    Propagate gateway routes: If you plan to associate the route table to a subnet in a virtual network that's connected to your on-premises network through a VPN gateway, and you don't want to propagate your on-premises routes to the network interfaces in the subnet, set Virtual network gateway route propagation to Disabled.

    Refer: https://learn.microsoft.com/en-us/azure/virtual-network/manage-route-table#create-a-route-table

    When you set Propagate gateway routes to NO and associate the route table to the spoke subnets, the VMs in those subnets do not get the Virtual network gateway routes and hence you are unable to connect to those VMs from your point to site VPN connection.

    Kindly let us know if the above helps or you need further assistance on this issue.


    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

    2 people found this answer helpful.

0 additional answers

Sort by: Most helpful

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.