Routing to/from virtual WAN

ZEIN Ahmed OBS/S EUR 125 Reputation points
2024-06-20T07:58:49.07+00:00

Hello All,
please check below diagram:
User's image

Subnet A: on-premises , will be advertised via SDWAN to the vHub
subnet Z: used in the service Vnet (where 2 Firewalls: FG or PA) are hosted: to filter traffic between cloud and sdwan (on-prem)
Subnet X1,Y1: host subnets, where i am using my VMs in Vnet1
Subnet X2,Y2: host subnets, where i am using my VMs in Vnet1

Target: Subnet A and Subnet (X1,X2,Y1,Y2) communicate , while Firewall can be used to block or allow communication based on application, subnet, port, etc.

The problem:
1-once vHub connected to service Vnet: subnet Z will be in the vHub routing table and reachable..OK
2-also subnet A (which is in vHub BGP , received from SDWAN) will also adv to service Vnet...OK
i.e. Subnet A and Z can reach each other , which is not target but OK

3-once the peering between service vnet and Host vnets (Vnet1 and Vnet2) , subnet X1,Y1 can reach subnet Z, same for X2,Y2 can reach subnet Z..OK

all above is happening automatically without any need for manual user defined routes

4-the problem is :
4.1 How subnet X1,X2,Y1,Y2 can be advertised to the vHub ?,
is there any way can make those subnets (from Host Vnets1,and 2) advertised to the vHub automatically?
i am thinking of manual options, but still not very clear for me! and i want automatic option, where if any new subnet (X3) added in Vnet1 , subnet X3 advertised automatically to the vHub

4.2 How subnet A can be advertised to Vnet1 and Vnet2 automatically?

Azure Virtual WAN
Azure Virtual WAN
An Azure virtual networking service that provides optimized and automated branch-to-branch connectivity.
199 questions
Azure
Azure
A cloud computing platform and infrastructure for building, deploying and managing applications and services through a worldwide network of Microsoft-managed datacenters.
1,068 questions
Azure Startups
Azure Startups
Azure: A cloud computing platform and infrastructure for building, deploying and managing applications and services through a worldwide network of Microsoft-managed datacenters.Startups: Companies that are in their initial stages of business and typically developing a business model and seeking financing.
237 questions
{count} votes

Accepted answer
  1. KapilAnanth-MSFT 40,021 Reputation points Microsoft Employee
    2024-06-20T10:05:33.82+00:00

    @ZEIN Ahmed OBS/S EUR ,

    Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

    Looking at your design, it appears something similar to Route traffic through an NVA.

    • User's image
    • Where,
      Your Set Up Azure reference architecture
      ServiceVnetX VNet2
      VNet1,VNet2 VNet5,VNet6
       

    Point to Note:

    • I see you have mentioned "automatic" advertisement a couple of times.
    • The entire concept of vWAN is to automate route propagation
    • However, you are using a multi Hub design
      • i.e, two Hubs - one vHubX and two vNETX.
    • This means you are still using traditional Hub Spoke where the Hub is "vNETX" and Spokes are "VNET1" and "VNET2"
    • And since vWAN does not have any control over the routing in the VNETs it is not directly connected to, you have to rely on manually updating the routes only

    With that said,

    To advertise the Spoke ranges to the vHub, (I am using your setup's naming convention)

    • You should add UDRs to VNET1 and VNET2 (Subnets X1,Y1,X2,Y2) with nextHop as the vFG
      • i.e.,
      • Destination Range : SubnetA
      • NextHop IP : vFG's IP
    • Add an static route entry for VNET1,VNET2,VNETX to vHubX’s Default route table.
    • Configure a static route for VNET1,VNET2 in VNet X’s virtual network connection. To set up routing configuration for a virtual network connection, see virtual hub routing.
      • i.e.,
      • User's image

    Post this,

    • X1,X2,Y1,Y2 subnets will be advertised to the vHubX
    • SubnetA 's range will be advertised to the X1,X2,Y1,Y2 by UDR

    Kindly let us know if this helps or you need further assistance on this issue.

    Thanks,

    Kapil


    Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

    1 person found this answer helpful.

0 additional answers

Sort by: Most helpful