Routing for Network Virtual Appliances

Mike Kallies 21 Reputation points
2021-07-04T12:05:59.77+00:00

In the diagram, we have one vnet, two subnets, and three systems.

  • Azure "IP Forwarding" is enabled on the router interfaces.
  • Routing tables are created for "trust" and "untrust" subnets
  • Static routes are created on the machines (the obscured routes are host routes to make sure I don't cut myself off)
  • We can see that bob is successfully pinging alice.

Despite bob's default route being the router, the azure routing table setting bob's default route to the router, and alice is not in the same subnet, the traffic does not pass through the router!?

111594-image.png

This raises two big questions for me

  • Why and how is Azure doing this? This seems to completely defy Layer3 logic.
  • How are we supposed to do this in Azure?

My next guess on this is that this might need to be done with distinct vnets, but if I use vnets, does that mean 3 vnets? 1 for the virtual appliance and 1 for each subnet?

Azure Virtual Network
Azure Virtual Network
An Azure networking service that is used to provision private networks and optionally to connect to on-premises datacenters.
2,773 questions
0 comments No comments
{count} votes

Accepted answer
  1. SaiKishor-MSFT 17,336 Reputation points
    2021-07-08T00:28:19.5+00:00

    @Mike Kallies Thank you for reaching out to Microsoft Q&A. I understand that you are having challenges setting up traffic routing via the NVA.

    First thing I notice from the architecture is that the NVA shares the subnets of the Trsut and Untrust networks. This is not the preferred setup for this requirement as this creates loops in routing. As per Microsoft documenation-

    "Deploy a virtual appliance into a different subnet than the resources that route through the virtual appliance are deployed in. Deploying the virtual appliance to the same subnet, then applying a route table to the subnet that routes traffic through the virtual appliance, can result in routing loops, where traffic never leaves the subnet."

    Here is a similkar architecture explained here in the following blog anf video:

    https://rajanieshkaushikk.com/2020/01/12/how-to-route-network-traffic-in-azure/

    https://www.youtube.com/watch?v=UeFDa3vl0LA

    Please impelment a different subnet for the NVA and that should resolve this issue for you. Hope this helps.

    Please let us know if you have any further questions and we will be glad to assist you further. Thank you!

    Remember:

    Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is how.

    Want a reminder to come back and check responses? Here is how to subscribe to a notification.

    1 person found this answer helpful.

0 additional answers

Sort by: Most helpful

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.