Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.
I understand that you have a single ExpressRoute circuit and a VNet connected to this.
Now, You want to connect this VNet to a different ExpressRoute circuit (of partner's)
Let me know if my understanding is incorrect
Wrt your questions,
1.we would like to connect a partner of this customer via another express route circuit
- A single VNet can be connected to different Circuits. So this is technically feasible.
2.Can/must I install a second set of ER gateways in order to control this flow
- Since you can connect a single gateway to multiple circuits, You do not have to install a second set of ER gateway.
- A Vnet can only have one ExR Gateway at any given instant.
3.can I transit from on-prem to this partner via the Azure hub?
- Generally, this requirement is met by using ExpressRoute Global Reach
- The above works for configurations having two different gateways and respective Vnets.
- For a single gateway connected to multiple expressRoute circuits, - I will be required to check internally if BGP propagation would happen or not.
- However, even in your scenario, you should be able to use Global Reach for OnPrem --- Partner transit
4.we want to screen the partner traffic via a firewall instance in our azure hub (NVA)
- You will be able to do this.
- But again, since we have only one Gateway, all the traffic (OnPREM and Partner ) needs to be sent to the Firewall NVA.
- For Partner to Azure
- Attach a Route table on the Gateway Subnet and forward the traffic with Vnet's range as destination to the Firewall.
- In the firewall, if the source is from Customer ---> Allow, and if the source is from Partner ---> Validate and the Allow or Deny traffic
- Similarly, for Azure to Partner
- Attach a Route table on the VMs and forward the traffic with both Customer's and Partner's range as destination to the Firewall.
- NOTE : Having only Partner's range as destination would result in asymmetric routing. However, it might work even though it's not recommended.
- From Firewall, traffic would flow to the Gateway subnet because of system routes.
Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.