Azure Hub to Hub Vnet Peering

Bohac, Stanislav 0

Dear Microsoft Q&A,

I have a Hub & Spoke topology which includes 2 Hub & Spokes. When I attach route table to Express Route gateway /subnet, the injected routes are not being propagated to On-Prem network.

Details: The objective is communicate via VNet peering, while having in one "hub" Azure Firewall and in other Express Route gateway.

As seen on attached sketch:

Hub1 knows network of Hub2 due to network peering. Hub2 knows network of Hub1 due to network peering.

In order to enable access of devices "on-prem" to Spoke1 network via ExpressRoute and Hub1 Firewall, I have attached route table to ExpressRouteGateway subnet with configuration:

10.0.1.0/24 (spoke1) Virtual Network Appliance 10.0.2.4 (Hub1 FW instance) with assumption this will be propagated to on-prem.

However, my UDR is not propagated by the ExpressRoute gateway. BGP settings is enabled on ExpressRouteGateway as well as on Route Table.

Would you have any advise on such topology/configuration? HubtoHub

Bohac, Stanislav 0 Reputation points

2024-04-25T21:46:00.4166667+00:00

Any additional information can be provided
ChaitanyaNaykodi-MSFT 23,031 Reputation points Microsoft Employee

2024-04-26T03:51:39.0966667+00:00

@Bohac, Stanislav

Thank you for reaching out.

As mentioned in the Azure routing documentation,

ER route propagation can be disabled on a subnet using a property on a route table. When you disable route propagation, the system doesn't add routes to the route table of all subnets with Virtual network gateway routes. This process applies to both static routes and BGP routes. Connectivity with VPN connections is achieved using custom routes with a next hop type of Virtual network gateway. Route propagation shouldn't be disabled on the GatewaySubnet. The gateway will not function with this setting disabled.

As documented here

Propagate gateway routes: If you plan to associate the route table to a subnet in a virtual network that's connected to your on-premises network through a VPN gateway, and you don't want to propagate your on-premises routes to the network interfaces in the subnet, set Virtual network gateway route propagation to Disabled.

Can you please confirm if are propagating the gateway routes? Thanks
Bohac, Stanislav 0 Reputation points

2024-04-26T04:26:03.8266667+00:00

Hello,

thank you for your answer.

As written in my original post and on the sketch, Gateway propagation is enabled on ER Gateway as well as on the Route Table attached to GatewaySubnet.

My expectation was, with this option enabled, there UDR to be propagated by ER Gateway to On-Prem, but it is not happening.
ChaitanyaNaykodi-MSFT 23,031 Reputation points Microsoft Employee

2024-05-03T20:57:28.82+00:00
@Bohac, Stanislav

Thank you for getting back and apologies for the delay in getting back here.A few observations from the network diagram above.

From the diagram we could not locate the route which will allow the communication from the spoke vnet to the on-prem network via NVA. Can you please confirm if this route was configured?

In addition to this can you please try getting BGP routes as shown here and see if you are able to see any issue with the route has been advertised?

Thanks!