How can I enforce Azure Firewall using Hub & Spoke with multiple subscriptions?

Stawik, Lukas 20 Reputation points
2024-05-07T03:52:11.61+00:00

Hello,

we are using classic hub/spoke with Express Route and want to manage a central firewall instance for all connections to on-prem.

We have setup a dedicated subscription hosting an Express route, Hub VNet & Azure Firewall. The spokes peered with the hub are distributed in multiple subscriptions. As far as I understood, a Route table with an entry 0.0.0.0/0 pointing to the Azure Firewall must be setup for each subnet of the spokes in order to force traffic routed to the Azure Firewall.

Is there a better solution or how can we force this route table on every subnet connected to the hub?
Is it possible to have an Azure Policy to auto-deploy the route table?

Anyone had a similar issue and found a smart solution?
Happy to get your thoughts on this.

Best regards & Thanks

Azure Firewall
Azure Firewall
An Azure network security service that is used to protect Azure Virtual Network resources.
580 questions
Azure Virtual Network
Azure Virtual Network
An Azure networking service that is used to provision private networks and optionally to connect to on-premises datacenters.
2,199 questions
0 comments No comments
{count} votes

Accepted answer
  1. KapilAnanth-MSFT 36,861 Reputation points Microsoft Employee
    2024-05-07T05:26:50.76+00:00

    @Stawik, Lukas ,

    Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

    I understand that you have a requirement to validate that every subnet in your Hub Spoke architecture (excluding FirewallSubnet, GatewaySubnet) has a Route Table with a User Defined Route to nextHop as the Firewall.

    Wrt, "As far as I understood, a Route table with an entry 0.0.0.0/0 pointing to the Azure Firewall must be setup for each subnet of the spokes in order to force traffic routed to the Azure Firewall."

    • The 0.0.0.0/0 route is used to force Internet Bound traffic or "default" traffic to the Azure Firewall.
    • i.e., if you also want subnet to subnet traffic to go via Azure Firewall, you should define all the subnets in the Route Table and set nextHop as Azure Firewall
      This includes,
      • Spoke1subnet1 <----> Spoke1subnet2
      • Spoke1subnet1 <----> Hub1subnet1
      • Spoke1subnet1 <----> OnPrem
    • The above routes, do not go via Firewall if you only have 0.0.0.0/0 route.

    Wrt, "Is there a better solution or how can we force this route table on every subnet connected to the hub? Is it possible to have an Azure Policy to auto-deploy the route table?"

    Hope this helps.

    Cheers,

    Kapil

    1 person found this answer helpful.

0 additional answers

Sort by: Most helpful