Connecting corporate network to Azure

Question

Connecting corporate network to Azure

thomascusi 1

We have 15 offices running Velocloud Edges. The SD-WAN network connects offices to Hub (colocations) where we run VMware VMs (AD, DNS, File Shares, Print Servers,...).
Each Velocloud Edge runs a Palo Alto firewall for traffic inspection, URL filtering...
Colocations are connected to Prisma Access (connection from Colocation Palo Alto firewall to Prisma) so remote users can access colocation VMs. Colocations are also connected with edges to the SD-WAN network.

Eventually we want to get rid of colocation and move the remaining VMs to Azure.

Can someone help me what components would be required?

I am thinking setting 3 VPN gateways in each region and create VNETs in each region and have vnet peering so sites in EU can access VMs in all regions for instance. It happens that EU users needs to access ASIA or US VMs. Is VNET peering the correct solution?

I am also considering Azure WAN since Velocloud offers NVA but would that mean I need 3? That may be overkilled since the traffic would only be basic file shares, AD traffic, so not much gain with SD-WAN forseen.
I could still go with Azure WAN but without NVA, just using S2S VPNs? What about remote users what would be the best way to connect them?

Something like that:

GitaraniSharma-MSFT 50,096 Reputation points Microsoft Employee Moderator

2023-01-11T15:06:39.8066667+00:00

Hello @thomascusi ,

Apologies for the delay in response.

As mentioned by @Luke Murray , Azure Virtual WAN (Standard type) seems to be a better fit for your scenario as it provides P2S VPN along with Inter-hub and VNet-to-VNet transiting through the virtual hub configurations.

Refer: https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-about#basicstandard

Kindly let us know if the below helps or you need further assistance on this issue.

To help the community find the right answers, please do mark the post which was helpful by clicking on Accept Answer.

2 answers

Your answer

GitaraniSharma-MSFT 50,096 Reputation points Microsoft Employee Moderator

2023-01-11T15:06:39.8066667+00:00

Hello @thomascusi ,

Apologies for the delay in response.

As mentioned by @Luke Murray , Azure Virtual WAN (Standard type) seems to be a better fit for your scenario as it provides P2S VPN along with Inter-hub and VNet-to-VNet transiting through the virtual hub configurations.

Refer: https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-about#basicstandard

Kindly let us know if the below helps or you need further assistance on this issue.

To help the community find the right answers, please do mark the post which was helpful by clicking on Accept Answer.

Answer 1

Luke Murray 11,436 MVP Volunteer Moderator

I would go, with Azure Virtual WAN, link the VNETs up to the WAN and an Azure Point to Site connection for remote clients. Using the Azure Virtual WAN will help with keeping the network traffic within the Azure backbone.

The branch office sites can just use an S2S connection to the WAN.

Additional Links:
https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-about
https://learn.microsoft.com/en-us/azure/virtual-wan/how-to-virtual-hub-routing
https://learn.microsoft.com/en-us/azure/virtual-wan/migrate-from-hub-spoke-topology
If you do need an NVA - https://learn.microsoft.com/en-us/azure/virtual-wan/how-to-nva-hub
https://github.com/adstuart/azure-vwan-anycast
https://github.com/adstuart/azure-crossregion-private-lb
https://github.com/dmauser/azure-virtualwan/tree/main/inter-region-azfw

thomascusi 1 Reputation point

2023-01-09T08:43:17.933+00:00

Cheers Luke, one thing we'd like to keep Prisma Access, it is Always-On so if we use P2S for remote clients we would need 2 VPN connections active at the same time, wouldnt it be more straightforward to setup a S2S between Prisma and Azure so current Prisma users can access vNets in Azure?
Luke Murray 11,436 Reputation points MVP Volunteer Moderator

2023-01-09T08:56:52.227+00:00

Yep, that makes sense.
The Remote Access windows service itself isn't supported on a Windows VM in Azure, but if your hosting it elseware then S2S makes sense, or if there's a marketplace image you may be able to setup Prisma in Azure, unsure how that solution works but makes sense to join it into Azure either through a S2S or more native supported way.

Answer 2

Hi,

As this is high level design question I will try to provide you some points that you can explore, Azure Expressroute will be required, Azure Firewall, Azure VPN also check out Azure vWAN and VNET peering you are correct. Explore the Expressroute design and connectivity documentation expressroute-connectivity-models

For remote users you can try Azure Virtual Desktop and this should help for roaming users connecting to local sites. virtual-wan-global-transit-network-architecture

Also this one expressroute

Hope this helps.
JS

==
Please Accept the answer if the information helped you. This will help us and others in the community as well.

Share via

Connecting corporate network to Azure

2 answers

Your answer