Hi all, Hope you are doing well! Do I need to deploy a Virtual Network Gateway for spoke hub connectivity even if I deploy an Azure Firewall. If yes, how the routing will happen? Thanks

Hey Apurva Pathak So, about Azure Firewall and Virtual Network Gateway whether you need one depends on what you're up to. If you're just playing around with hub-and-spoke in Azure for communication within virtual networks, you might not need a Virtual Network Gateway . Just let the Azure Firewall do its thing in controlling and inspecting the traffic between your spoke networks. But, if you're thinking bigger and need to connect your Azure network to the outside other networks, that's when you bring in the Virtual Network Gateway. It helps you manage the traffic going in and out of Azure. Even with the Gateway, you can still keep the Azure Firewall in the mix to secure traffic between your spokes. Routing is like giving directions to your traffic, right? You can set up Azure Route Tables to guide the flow within your virtual network. Associate them with your subnets and define your routes. This way, whether you go with or without the Gateway, you're in control. Hope this helps if it did kindly accept the answer thanks much.

Azure Firewall as NVA - Microsoft Q&A

Accepted answer

Azar 19,965 Reputation points

2024-01-24T12:01:52.99+00:00

Hey
Apurva Pathak
So, about Azure Firewall and Virtual Network Gateway whether you need one depends on what you're up to. If you're just playing around with hub-and-spoke in Azure for communication within virtual networks, you might not need a Virtual Network Gateway. Just let the Azure Firewall do its thing in controlling and inspecting the traffic between your spoke networks.
But, if you're thinking bigger and need to connect your Azure network to the outside other networks, that's when you bring in the Virtual Network Gateway. It helps you manage the traffic going in and out of Azure. Even with the Gateway, you can still keep the Azure Firewall in the mix to secure traffic between your spokes.
Routing is like giving directions to your traffic, right? You can set up Azure Route Tables to guide the flow within your virtual network. Associate them with your subnets and define your routes. This way, whether you go with or without the Gateway, you're in control.
Hope this helps if it did kindly accept the answer thanks much.
Please sign in to rate this answer.
Apurva Pathak 315 Reputation points

2024-01-24T12:04:55.92+00:00

Thanks for the guidance @azar Could you please share me any doc pertaining to the routing part of it. I wil be just using the Azure FW part for Azure Vnets. Thanks

Azar 19,965 Reputation points

2024-01-24T12:14:49.95+00:00

Hey thanks for getting back yeah lemme drop you a few documentation links and feel free to search them if needed. https://learn.microsoft.com/en-us/search/?terms=Azure%20Route%20Tables%20Documentation%3A https://learn.microsoft.com/en-us/search/?terms=Azure%20Virtual%20Network%20documentation https://learn.microsoft.com/en-us/search/?terms=Routing%20decisions%20in%20Azure Dont forget to accept the answer if it helped thanks again.

Apurva Pathak 315 Reputation points

2024-01-24T12:25:33.3833333+00:00

QQ: How Azure FW will determine the next hop.

GitaraniSharma-MSFT 48,016 Reputation points Microsoft Employee

2024-01-24T14:11:27.4933333+00:00

Hello Apurva Pathak,

When you have a hub and spoke topology in Azure, you normally use a Vnet peering to connect the hub Vnet with the spoke Vnets.

Virtual network peering enables you to seamlessly connect two or more Virtual Networks in Azure. The virtual networks appear as one for connectivity purposes. The traffic between virtual machines in peered virtual networks uses the Microsoft backbone infrastructure. Like traffic between virtual machines in the same network, traffic is routed through Microsoft's private network only.

Refer: https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview

So, as long as the hub Vnet and spoke Vnets are peered with each other, you can use Azure Firewall for traffic filtering and UDR for traffic routing between the spoke Vnets.

But point to remember here is:

Traffic between directly peered VNets is routed directly even if a UDR points to Azure Firewall as the default gateway. To send subnet to subnet traffic to the firewall in this scenario, a UDR must contain the target subnet network prefix explicitly on both subnets.

Refer: https://learn.microsoft.com/en-us/azure/firewall/tutorial-hybrid-portal-policy

https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/hub-spoke?tabs=cli

https://learn.microsoft.com/en-us/azure/firewall/firewall-multi-hub-spoke

https://learn.microsoft.com/en-us/azure/firewall/firewall-faq#can-azure-firewall-forward-and-filter-network-traffic-between-subnets-in-the-same-virtual-network-or-peered-virtual-networks

https://learn.microsoft.com/en-us/azure/architecture/networking/spoke-to-spoke-networking

Regards,

Gita
Sign in to comment

Share via

Azure Firewall as NVA

0 additional answers