Is it possible to setup Spoke VNet access to onprem network of another HUB VNet that is using an Azure Virtual Network Gateway?

Question

We have a VNet in one azure tenant (Lets call it Org 1), that is connect to an onpremise network using site-to-site VPN through an Azure Virtual Network Gateway. That VNet is peered to the HUB VNet in another tenant (Lets call it Org 2) that is using a virtual sophos firewall appliance. VMs in Org 1's Azure VNet can communicate to VMs in Org 2's spoke VNets achieved by user defined routes pointing to the Sophos firewall in the HUB VNet. Our current challenge is we need a VM in Org 2's spoke VNet to also be able to reach servers in Org 1's onpremise network. Is it possible to achieve this since Org 1 is using a Virtual Network Gateway rather than a virtual firewall appliance?

Answer 1

@Jeremy Wallace

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you would like to connect your Org1 Site to Org2 Spoke VNET.

Looking at your configuration,

1.

• it is possible if you could create a VNET Peering between Org1HubVnet and Org2SpokeVnet
• And then enable "Use Remote Gateway" on the peering from Org2SpokeVnet to Org1HubVnet
• Refer : https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-peering-gateway-transit#same

or

2.

• Deploy a similar NVA in the Org1HubVnet
• And configure UDRs to point traffic from Org2SpokeVnet to Org1Site to route via this new NVA

or

3.

• Create a S2S Connection between Org2HubVnet and Org1Site

Hope this helps.

Thanks,

Kapil

---

Please Accept an answer if correct.

Original posters help the community find answers faster by identifying the correct answer.