Issue with outbound Internet Traffic through Load Balanced NVA in Azure Virtual WAN

Raviraj Velankar 86 Reputation points
2023-05-07T12:49:18.94+00:00

Following is the Architecture -

  • Azure Virtual WAN which has Cisco SD-WAN virtual appliances integrated with vWAN Hub (partner solution) and it also consist of Hub & Spoke topology. Hub Vnet consist of common services such as NVA, AD etc and Spoke vnet consist of actual App workloads.
  • Hub Vnet consist of Cisco Firewall in sandwich topology (load balanced between Azure Internal & External LB) to route Internet bound traffic.
  • FW outside interfaces does not have public IPs and all Internet bound traffic is going through Azure Ext LB with help of Outbound rules and public frontend IP
  • Hub Vnet & Spoke Vnet peered to vWAN Hub using "Vnet connection" and all Vnet connections and SD-WAN virtual appliances associated & propagated to 'Default Route Table' of vWAN Hub
  • VM in spoke Vnet has UDR with default route pointing to Azure Int LB 'private frontend IP' to route Internet traffic to Cisco FW
  • However traffic from VM in spoke Vnet does not reach to Cisco FW itself in Hub Vnet

As per my understanding, Azure vWAN integrated with partner SDWAN virtual appliances can propagate learned route only to 'Default Route Table' of vWAN Hub

As per following diagram and article "https://learn.microsoft.com/en-us/azure/virtual-wan/scenario-route-through-nvas-custom" ,

it suggest to create two custom route table. One for Hub Vnet (which has NVA) and another for Spoke Vnet

When followed the steps given in this article for "Alternate Workflow", it does not seem to be work

Added default route in "Default Route Table" of vWAN Hub with next hop as Hub Vnet connection and added static default route in "Hub Vnet Connection(which has NVA) with next hop IP address as "Private Frontend IP of Azure Int LB"

However when we added default route in Default Route Table and Vnet connection, connectivity from Onprem to Azure using SDWAN breaks

Would like to know whether it is feasible to route outbound traffic to Internet using NVA in Hub Vnet by leveraging Azure vWAN Vnet Connections

User's image

Azure Virtual WAN
Azure Virtual WAN
An Azure virtual networking service that provides optimized and automated branch-to-branch connectivity.
197 questions
{count} votes