Default route pointing to VPN Gateway connection

Question

I have an Azure VPN Gateway with an IPSec VPN connection to a remote vpn server. The internal vpn interface is on a GatewaySubnet (zone redundant). I can get the tunnel to come up with the remote server but only see inbound traffic on the Azure side, never any outbound. It's as if the traffic comes in and gets lost. Given the routing that I'm trying to pull off with this configuration, this seems plausible. I need all traffic on the Azure VNet (on which the Azure VPN Gateway resides) to be routed to the remote end of the vpn tunnel. If I associate the GatewaySubnet to a route table, Azure doesn't allow that route table to have a default route. This is true even if the default route type is 'Virtual Network gateway'. I tried with a more specific route but it doesn't impact the one-way traffic described above. All routing is static. How can I establish a default route from VNet subnet(s) -> GatewaySubnet -> Azure VPN Gateway -> Remote VPN endpoint?

Answer 1

@Anonymous

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well. I understand that you would like to establish routing between VPN Gateway VNet's subnets and OnPrem.

User-defined routes with a 0.0.0.0/0 destination and NSGs on the GatewaySubnet are not supported. This is by design and we cannot modify this behavior.

Should you require forced tunneling,

• The NextHopType as VirtualNetworkGateway forces Traffic from VMs to the VPN Gateway.
• From the gateway, the connection is selected based on Traffic Selectors.
• Wrt, How does it know which connection to send the traffic down?
• That is why we mentioned the on-premises VPN device must be configured using 0.0.0.0/0 as traffic selectors.
• Wrt, Is there a way to add static routes to specific connections that maybe I'm overlooking?
• The -GatewayDefaultSite is the cmdlet parameter that allows the forced routing configuration to work, so take care to configure this setting properly.
• Refer Set-AzVirtualNetworkGatewayDefaultSite
• Refer to Step 8 in Configure forced tunneling

$LocalGateway = Get-AzLocalNetworkGateway -Name "DefaultSiteHQ" -ResourceGroupName "ForcedTunneling"
$VirtualGateway = Get-AzVirtualNetworkGateway -Name "Gateway1" -ResourceGroupName "ForcedTunneling"
Set-AzVirtualNetworkGatewayDefaultSite -GatewayDefaultSite $LocalGateway -VirtualNetworkGateway $VirtualGateway

P.S: Attaching 0.0.0.0/1 and 128.0.0.0/1 routes to the GatewaySubnet will not work either.

Additional points to be aware of

• In all the subnets except GatewaySubnet, setting the RouteTable as 0.0.0.0/0 ---> VirtualNetworkGateway will forward default traffic to the VPN Gateway (GatewaySubnet).
• From VPN Gateway to your OnPrem, this routing happens based on the negotiated Traffic Selectors.
• So, the traffic will be sent into Tunnel which advertises 0.0.0.0/0
• No need for RouteTable here

Thanks,

Kapil

---

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.