This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(156.8, 77%, 25%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERH%3C/text%3E%3C/svg%3E)
Hi,
Need to route all GCP traffic via Azure Firewall (including Internet traffic). Already Site to site tunnel has been established and connectivity is successful between Azure and GCP. Here I need to route all GCP traffic via Azure Firewall.
Route: Traffic from GCP - S2S Connection - Azure Firewall - Internet.
Is this possible scenario? If YES , let me know how to configure routes in azure?
If NO, What are all possible options or alternatives ?
Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.
I understand that you would like to route all Internet bound traffic from 3rd party cloud provider to Azure via VPN Connection.
Forced Tunneling is concept where we route Internet or "All" Traffic to the remote site for inspection.
Generally, in Azure, Forced Tunneling refers to sending all traffic from Azure to the Remote Site and not the other way around.
This is because support for such a scenario is limited and is only supported via a vWAN.
You cannot proceed with this configuration by using regular Azure VPN Gateway only.
The reason being,
User-defined routes with a 0.0.0.0/0 destination and NSGs on the GatewaySubnet are not supported. Gateways with this configuration are blocked from being created. Gateways require access to the management controllers in order to function properly.
Refer : https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub
Now, with Azure vWAN,
You must use Internet Traffic Routing Policy
Refer : https://learn.microsoft.com/en-us/azure/virtual-wan/how-to-routing-policies#background
when an Internet Traffic Routing Policy is configured on a Virtual WAN hub, the Virtual WAN advertises a default (0.0.0.0/0) route to all spokes, Gateways and Network Virtual Appliances (deployed in the hub or spoke).
This would require you to recreate the connection to Azure and Remote site using a vWAN S2S Connection.
Please go through the considerations and limitations associated with this before configuring the connections.
Should there be any follow-up questions or concerns, please let us know and we shall try to address them.
Thanks,
Kapil
Could you please provide an update on this post?
Kindly let us know if this helps or you need further assistance on this issue.
Thanks,
Kapil
May I know if you got a chance to review my previous comment?
Please let me know if you are facing any challenges or if there are any follow-up questions, I shall be glad to address them.
Thanks,
Kapil
@KapilAnanth-MSFT , sorry for delayed response.
Thanks for your support, I guess now I understood how routing works for VPN.
Thankyou.
Hi, You can use Azure vWAN and Azure Firewall Manager to advertise 0.0.0.0/0 route to On-Prem, in this case GCP. This will force all GCP outbound traffic to flow via Azure Firewall. Reference : https://learn.microsoft.com/en-us/azure/virtual-wan/how-to-routing-policies