Secure Hub support for NVA BGP peering

Ravichander Pinnaca 26

Secure Hub support for NVA BGP peering. I see its not supported with firewall in virtual hub. Does it not working only when we secure private traffic for East-West. Does this support if we just have secure internet traffic?

GitaraniSharma-MSFT 47,696 Reputation points Microsoft Employee

2022-11-11T11:34:45.753+00:00

Hello @Ravichander Pinnaca ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I am reaching out to the Product Group team internally regarding this query and will provide an update as soon as I get a response.

Regards,
Gita

2 answers

GitaraniSharma-MSFT 47,696 Reputation points Microsoft Employee

2022-11-15T17:35:46.917+00:00

Hello @Ravichander Pinnaca ,

I understand that you wanted to know if Secured Hub with NVA BGP peering is supported for securing Internet traffic.

I discussed this with the Azure Virtual WAN Product Group team and below is their update:

For private traffic, BGP peering with NVA in the spoke is only supported with routing intent.
For Internet traffic it should work with or without routing intent. If it does not work please open a Support Request.

Refer : https://learn.microsoft.com/en-us/azure/virtual-wan/scenario-bgp-peering-hub
https://learn.microsoft.com/en-us/azure/virtual-wan/create-bgp-peering-hub-portal

Kindly let us know if the above helps or you need further assistance on this issue.

----------------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Please sign in to rate this answer.
Ravichander Pinnaca 26 Reputation points

2022-11-15T20:14:02.92+00:00

I need to know more on this routing intent and routing policies. Please help

Does this require secure hubs in same region and same vWAN

Does this work with secure hub in different vWAN across regions.

GitaraniSharma-MSFT 47,696 Reputation points Microsoft Employee

2022-11-17T13:40:40.437+00:00

Hello @Ravichander Pinnaca ,

All the details about routing intent and routing policies can be found in the below doc:
https://learn.microsoft.com/en-us/azure/virtual-wan/how-to-routing-policies

In the gated public preview of Virtual WAN Hub routing policies, inter-hub traffic between hubs in different Azure regions is dropped.

Inter-region traffic cannot be inspected by Azure Firewall or NVA. Additionally, configuring both private and internet routing policies is currently not supported in most Azure regions.

Currently, using Azure Firewall to inspect inter-hub traffic is available for Virtual WAN hubs that are deployed in the same Azure Region. Inter-hub inspection for Virtual WAN hubs that are in different Azure regions is available on a limited basis. For a list of available regions, please email previewinterhub@mcirosoft.com.

To obtain access to the preview, please deploy any Virtual WAN hubs and gateways (Site-to-site VPN Gateways, Point-to-site Gateways and ExpressRouteGateways) and then reach out to previewinterhub@microsoft.com with the Virtual WAN ID, Subscription ID and Azure Region you wish to configure Routing Intent in.

Kindly let us know if the above helps or you need further assistance on this issue.

----------------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Ravichander Pinnaca 26 Reputation points

2022-11-24T17:28:26.073+00:00

Considering Routing Intent is still in preview, and we also see limitation on Static NAT for outbound. We are moving to traditional Hub & Spoke with NVA instead of Azure Firewall. Thanks for the inputs.

GitaraniSharma-MSFT 47,696 Reputation points Microsoft Employee

2022-11-27T15:06:51.917+00:00

Thank you for the update, @Ravichander Pinnaca .
Sign in to comment
Robert Vloothuis 0 Reputation points

2023-01-17T09:00:56.5566667+00:00

hi, i've tested a similar setup with private traffic secured and bgp peering with an NVA on an hub with routing intent enabled.

Doesn't seem to work. Do you have any more documentation on this?
Please sign in to rate this answer.
GitaraniSharma-MSFT 47,696 Reputation points Microsoft Employee

2023-02-02T04:17:22.2066667+00:00

@Robert Vloothuis , could you please provide more details on what exactly is not working.

Did you follow the below doc to configure routing policies for NVA?

https://learn.microsoft.com/en-us/azure/virtual-wan/how-to-routing-policies#nva

NOTE: The only Network Virtual Appliance deployed in the Virtual WAN hub compatible with routing intent and routing policies are listed in the Partners section as dual-role connectivity and Next-Generation Firewall solution providers.

Also check the troubleshooting section to validate your setup.

https://learn.microsoft.com/en-us/azure/virtual-wan/how-to-routing-policies#troubleshooting

Regards, Gita
Sign in to comment