Not getting internet once I apply a route table with destination 0.0.0.0/0 with next hop virtual network gateway

Question

Hi Team,

I have a azure connectivity with express route from onpremises

and having two Vnets in Azure

1. Vnet1 which has VPN gateway deployed
2. Vnet2 peered with Vnet1 and having all my VM's
3. created a subnet2 on Vnet2

I would like to route all my internet access of Vnet2 (from subnet2 in vnet2) towards my on premises firewall.

I have applied a route table on subnet 2 with below configuration

Address prefix : 0.0.0.0/0

Next hop type : VirtualNetworkGateway

problem here is outbound internet is not working once I apply a route table on subnet and effective routes shows this way from VM nic interface:

Note: All private network is routed and able to see in the onprem firewall but the public routes are not reaching to onpremises firewall

Can you please help me how to route entire internet to onpremises firewall

Regards,

Anurag,

Answer 1

@Anurag M

Welcome to the Microsoft Q&A Forum.

As documented here you must use BGP to advertise on-premises routes to the Microsoft Edge router. You can't specify a virtual network gateway created as type ExpressRoute in a user-defined route because with ExpressRoute, you must use BGP for custom routes.

This User Defined Route from your screenshot above is not supported.

You must use BGP to advertise on-premises routes to the Microsoft Edge router. You can't create user-defined routes to force traffic to the ExpressRoute virtual network gateway if you deploy a virtual network gateway deployed as type: ExpressRoute. In this case you will have to advertise a route with the 0.0.0.0/0 prefix via BGP.

As documented here default routes are permitted only on Azure private peering sessions. In such a case, ExpressRoute routes all traffic from the associated virtual networks to your network.

Just an FYI Advertising default routes will break Windows and other VM license activation. For information about a work around, see use user defined routes to enable KMS activation.

Hope this helps! Please let me know if you have any additional questions. Thank you!

---

​​Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

Hi ChaitanyaNaykodi-MSFT,

Thank you so much for detailed information, If we can not route the default 0.0.0.0/0 to virtual network gateway which is blocking the internet

as suggested in BGP , can you guide me where exactly I can configure to route all my internet traffic towards onprem fortigate firewall

the route I am looking for is

outbound internet>express route gateway>onprem fortigate firewall which is providing internet

I need some guidance on BGP to advertise on-premises routes to the Microsoft Edge router. and also not getting option to check the routes on VPN gateway , is there any other method to check the routing details on Virtual network gateway .

for a note I am able to check routes on network interface of VM but not able to check on Virtual network gateway to check the public request is reaching to gateway or not

If I am looking for the case which is not possible please suggest with right approach

all my requirement is when I access internet from the vm from spoke subnet it should route to onprem firewall beyond equinix instead of default system routed Internet

Regards,

Anurag