NVA firewalls in availability set, how to prefer one over the other for outbound traffic

Steven Johnston 40 Reputation points
2023-08-26T10:39:03.91+00:00

I have a standard load balancer sandwich design, with two NVA firewalls in an availability set, with spoke vNets peered to the NVA vNet. UDR's have static routing towards the internal load balancer. it all works well enough

I have a requirement to prefer one firewall over the other for outbound traffic to specific destinations from the spoke vNets without using static routing on the UDR. It looks like the internal load balancer doesn't have the functionality to add "weight" to a particular member of the backend pool.

I tried deploying a route server in vnet-hub but it's incompatible with the virtual wan hub peering in this design

Are there any other Azure mechanisms i can use to achieve what i am looking for?

User's image

Azure Virtual WAN
Azure Virtual WAN
An Azure virtual networking service that provides optimized and automated branch-to-branch connectivity.
187 questions
Azure Load Balancer
Azure Load Balancer
An Azure service that delivers high availability and network performance to applications.
402 questions
{count} votes

Accepted answer
  1. KapilAnanth-MSFT 35,001 Reputation points Microsoft Employee
    2023-08-29T17:53:24.5066667+00:00

    @Steven Johnston

    Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

    Looking at your requirement, I believe this will not be feasible without requiring to revamp your architecture.

    With current architecture,

    You must use UDRs if you'd like to prioritize one NVA over the other for routing.

    What you can do is,

    To control the addresses learned from and advertised to the Spoke VNETs,

    You should consider using Route Tables and Custom Routing with vHUB

    Kindly let us know if you need further assistance on this issue.

    Cheers,

    Kapil


    Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

    0 comments No comments

0 additional answers

Sort by: Most helpful