Hi, Azure Bastion works fine in Peered Virtual Networks in a Hub-and-Spoke configuration, even with an User Defined Default Route (UDR) to send traffic over a Network Virtual Appliance (NVA) acting as firewall (UDR: 0.0.0.0/0 -> NVA). However to control the traffic between spoke, de system route between peered networks must be overriden by another UDR send traffic to the firewall first, rather than directly to the peered network (UDR: SpokeVNET -> NVA). Once this override UDR is in place, Bastions do not work any more between these (formely) peered networks. Would there be an hidden private IP address space that need to be added to the UDR in order to make this work?

Hi, I would suggest you to add Longest Prefix match (Instead of adding the entire address space of the VNET, try adding the exact subnet IP in the UDR) and check if the connectivity works. If this didn't work, drop an email to msrini@microsoft.com, lets have a quick call to debug this further. Regards, Karthik Srinivas

Azure Bastion with UDR VNet Peering override

Accepted answer

msrini-MSFT 9,281 Reputation points Microsoft Employee

2022-09-16T16:11:12.093+00:00

Hi,

I would suggest you to add Longest Prefix match (Instead of adding the entire address space of the VNET, try adding the exact subnet IP in the UDR) and check if the connectivity works.

If this didn't work, drop an email to msrini@microsoft.com, lets have a quick call to debug this further.

Regards,
Karthik Srinivas
Please sign in to rate this answer.
Arjen Gerritsen 41 Reputation points

2022-09-19T07:27:34.947+00:00

Hi Karthik,

Thanks for your useful advice. Adding Longest Prefix match for all individual subnets in the VNet rather then the entire VNet IP address space works very well. It is however quiet a lot of work and when subnets evolve, like when adding AKS subnets, every time the Route Table needs adjustment. Are you sure there is no alternative way around this?

msrini-MSFT 9,281 Reputation points Microsoft Employee

2022-09-20T17:15:55.86+00:00

Unfortunately there aren't other known solutions as of today.

GitaraniSharma-MSFT 49,461 Reputation points Microsoft Employee

2022-09-21T02:50:00.387+00:00

Hello @Arjen Gerritsen ,

I checked with the Azure Bastion Product Group team and they mentioned there is no other alternative as of yet but they are working on supporting the UDR scenarios for Azure Bastion (No ETA as of today).

Either: You have to add Longest Prefix match for all individual subnets in the VNet rather than the entire VNet IP address space.

OR: I have seen a similar scenario where the customer was able to solve this by just using an entirely different address space for Bastion (dedicated Vnet and subnet) and peering this dedicated Bastion Vnet to the other Vnets in the hub-spoke model. You could give this workaround a try.
Reference : https://learn.microsoft.com/en-us/answers/questions/929048/azure-bastion-and-hubspoke-with-udrs.html

Kindly let us know if the above helps or you need further assistance on this issue.

----------------------------------------------------------------------------------------------------------------

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Azure Bastion with UDR VNet Peering override

0 additional answers

Your answer