Not getting internet once I apply a route table with destination with next hop virtual network gateway

Anurag M 0 Reputation points

Hi Team,

I have a azure connectivity with express route from onpremises

and having two Vnets in Azure

  1. Vnet1 which has VPN gateway deployed
  2. Vnet2 peered with Vnet1 and having all my VM's
  3. created a subnet2 on Vnet2

I would like to route all my internet access of Vnet2 (from subnet2 in vnet2) towards my on premises firewall.

I have applied a route table on subnet 2 with below configuration

Address prefix :

Next hop type : VirtualNetworkGateway

problem here is outbound internet is not working once I apply a route table on subnet and effective routes shows this way from VM nic interface:

Note: All private network is routed and able to see in the onprem firewall but the public routes are not reaching to onpremises firewall


Can you please help me how to route entire internet to onpremises firewall



Azure Virtual Network
Azure Virtual Network
An Azure networking service that is used to provision private networks and optionally to connect to on-premises datacenters.
1,657 questions
Azure ExpressRoute
Azure ExpressRoute
An Azure service that provides private connections between Azure datacenters and infrastructure, either on premises or in a colocation environment.
242 questions
0 comments No comments
{count} votes

2 answers

Sort by: Most helpful
  1. ChaitanyaNaykodi-MSFT 15,806 Reputation points Microsoft Employee

    @Anurag M

    Welcome to the Microsoft Q&A Forum.

    As documented here you must use BGP to advertise on-premises routes to the Microsoft Edge router. You can't specify a virtual network gateway created as type ExpressRoute in a user-defined route because with ExpressRoute, you must use BGP for custom routes.

    User's image

    This User Defined Route from your screenshot above is not supported.

    You must use BGP to advertise on-premises routes to the Microsoft Edge router. You can't create user-defined routes to force traffic to the ExpressRoute virtual network gateway if you deploy a virtual network gateway deployed as type: ExpressRoute. In this case you will have to advertise a route with the prefix via BGP.

    As documented here default routes are permitted only on Azure private peering sessions. In such a case, ExpressRoute routes all traffic from the associated virtual networks to your network.

    Just an FYI Advertising default routes will break Windows and other VM license activation. For information about a work around, see use user defined routes to enable KMS activation.

    Hope this helps! Please let me know if you have any additional questions. Thank you!

    ​​Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

  2. Anurag M 0 Reputation points

    Hi ChaitanyaNaykodi-MSFT,

    Thank you so much for detailed information, If we can not route the default to virtual network gateway which is blocking the internet

    as suggested in BGP , can you guide me where exactly I can configure to route all my internet traffic towards onprem fortigate firewall

    the route I am looking for is

    outbound internet>express route gateway>onprem fortigate firewall which is providing internet

    I need some guidance on BGP to advertise on-premises routes to the Microsoft Edge router. and also not getting option to check the routes on VPN gateway , is there any other method to check the routing details on Virtual network gateway .

    for a note I am able to check routes on network interface of VM but not able to check on Virtual network gateway to check the public request is reaching to gateway or not

    If I am looking for the case which is not possible please suggest with right approach

    all my requirement is when I access internet from the vm from spoke subnet it should route to onprem firewall beyond equinix instead of default system routed Internet



    0 comments No comments