How to Connect 2 VMs located in separate Spoke VNets in Hub Spoke Model

Question

We have Spoke 1 and Spoke 2 Vnet which are peered with HUBVnet. Traffics on each Spoke are routed to Azure Firewall in HUB Vnet. Meaning the communication between VMs on each Spokes are controlled through the Network Rule on Azure Firewall ( located in HUB Vnet). I am unable to access the Ping or RDP towards the VM on spoke 2 from source VM located in Spoke 1 through Azure Firewall , even though the Network rule in Azure Firewall are created to allow "ANY" service.

Answer 1

Hello @Indranil Ranu @Micheal Falowo wrote already a great summary, how it should be configured. In addition, please check if there are any NSGs, blocking your traffic. You didn't mention anything about Network Security Groups (NSGs) in your question, so I am wondering if there are any in place. You might also want to check the firewall logs, if you see the network communication from spoke1 to spoke2, so you have a better understanding, where the issue might be located.

• There is no corresponding traffic on the firewall logs
  • Check if NSG is blocking on spoke1
  • Check if NSG is blocking on HubVNET
  • Check if Network Peering Hub/Spoke1 is up and running and "Traffic forwarded from remote virtual network" is "Allow (default)".
  • Check if your rout table is configured correctly
• Traffic is blocked on the firewall (logs)
  • The issue is obviously in the firewall configuration
• Traffic is allowed on the firewall (logs)
  • Check if NSG is blocking on spoke2
  • Check if NSG is blocking on HubVNET (outgoing)
  • Check if Network Peering Hub/Spoke2 is up and running and "Traffic forwarded from remote virtual network" is "Allow (default)".
  • Check if your rout table is configured correctly Hope this is helpful to locate the issue. If this is the case, please mark it as the answer and/or click "Was this answer helpful? Yes", as a token of appreciation. Looking forward to your feedback.

Answer 2

Hi Indranil,

After testing your senario, here is my implementation.

Hubvnet has firewall and peered with two spoke vnets named (spoke1 and spoke2)

Both spokes has a VM and both VM subnets has a route table with route as shown below

spoke1routetable --- Traffic to spoke2 vnet IP space -> virtual appliance -> azurefirewall private IP

spoke2routetable --- Traffic to spoke1 vnet IP space -> virtual appliance -> azurefirewall private IP

Azure firewall has a network rule with any--->any.

The only thing here that would cause an issue is the peering. Check your peerings if the setting for Traffic forwarded from remote virtual network is "Allow (default)" if this is set to block, then you wouldn't be able to traverse traffic hoping through firewall to and fro spoke vnets.

Please let me know if this help.

Answer 3

Just to rule out the basics. It would be good to clarify if you have windows or Linux VM’s on each hub network. You should check the VM security settings, in case of Windows Server, the machine security settings to make sure that local firewall settings are not preventing ping. There are several articles describe these local VM settings preventing ping to go through.