Virtual WAN Hub not advertising other Hub IP Space over VPN

Bryan Bartik 40

I have the following Azure VWAN with Palo Alto Cloud NGFWs set up:

Azure VWAN:

hub-west: 10.100.0.0/16
hub-east: 10.200.0.0/16

Cloud NGFWs are deployed as follows

hub-west-cngfw: 10.100.112.0/24
hub-east-cngfw: 10.200.112.0/24

I then have 2 "spoke" VNETs connected the hubs respectively:

spoke-west: 10.101.0.0/16
spoke-east: 10.201.0.0/16

From hub-west I have a VPN to a site that contains the Panorama management platform for the Palo CGNFWs. However, over this VPN only the following IP ranges are advertised, hub-east is missing:

hub-west: 10.100.0.0/16
spoke-west: 10.101.0.0/16
spoke-east: 10.201.0.0/16

Why is the hub-east range not advertised? This prevents Panorama from reaching them. Is this by design? What would be a possible workaround?

GitaraniSharma-MSFT 49,591 Reputation points Microsoft Employee

2024-06-21T11:56:45.42+00:00
Hello @Bryan Bartik ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that your Virtual WAN is not advertising Hub2 address range or route over VPN.

Could you please validate the below:

Does "hub-east" address range overlaps with your non-Azure site? Refer: https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-site-to-site-portal#prerequisites

Do you have Standard Azure Virtual WAN with Inter-hub or Hub-to-hub connection enabled? Refer: https://learn.microsoft.com/en-us/azure/virtual-wan/hub-settings#type

Is the routing preference for the "hub-east" virtual hub set to VPN? Refer: https://learn.microsoft.com/en-us/azure/virtual-wan/howto-virtual-hub-routing-preference

Additional documents for your reference:

https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-global-transit-network-architecture#hubtohub

https://learn.microsoft.com/en-us/azure/virtual-wan/about-virtual-hub-routing-preference

Regards,

Gita
GitaraniSharma-MSFT 49,591 Reputation points Microsoft Employee

2024-06-24T10:09:22.6533333+00:00

@Bryan Bartik , could you please provide an update on this post?
Bryan Bartik 40 Reputation points

2024-06-24T12:14:03.0733333+00:00

This is a known issue
GitaraniSharma-MSFT 49,591 Reputation points Microsoft Employee

2024-06-24T12:25:43.62+00:00

@Bryan Bartik , thank you for the update.

Could you please let me know how you confirmed that this is a known issue?

Did you reach out to support? If yes, could you please share your support request number for internal tracking purpose?

Regards,

Gita
GitaraniSharma-MSFT 49,591 Reputation points Microsoft Employee

2024-06-24T12:31:20.6033333+00:00

@Bryan Bartik , Ah! You are correct. You can't leverage Virtual WAN hub-to-hub full mesh routing capabilities to provide connectivity between NVA orchestration software deployed in a VNET or on-premises connected to a Virtual WAN hub to an Integrated NVA or SaaS solution deployed in a different Virtual WAN hub. This is a known issue.

I will update the answer below for broader visibility.

Regards,

Gita
Bryan Bartik 40 Reputation points

2024-06-24T14:48:59.1566667+00:00

Don't you work for Microsoft? Thought you would know :) Do you know if they will ever allow the hub advertisements between hubs?
GitaraniSharma-MSFT 49,591 Reputation points Microsoft Employee

2024-06-25T10:08:29.12+00:00

@Bryan Bartik , I apologize for the oversight regarding the hub-to-hub advertisement issue, as my attention was primarily on the connectivity aspect. I will contact the Virtual WAN Product Group team about the hub-to-hub advertisement and will provide you with an update as soon as possible.
GitaraniSharma-MSFT 49,591 Reputation points Microsoft Employee

2024-06-26T07:38:26.1833333+00:00

Hello @Bryan Bartik ,

I checked with Azure Virtual WAN Product Group team, and they mentioned the below:

The only available workarounds are the ones listed in the public documentation. We do not have an ETA for the fix at this time besides it being on our long-term roadmap.

So, I would suggest you use the recommended workarounds for now.

Regards,

Gita

Accepted answer

GitaraniSharma-MSFT 49,591 Reputation points Microsoft Employee

2024-06-24T12:35:24.0366667+00:00

Hello @Bryan Bartik ,

I understand that you have an Azure VWAN with 2 virtual hubs and Palo Alto Cloud NGFWs set up but the Virtual WAN is not advertising Hub2 address range or route over VPN.

This is a known limitation documented in the Azure Virtual WAN doc as below:

https://learn.microsoft.com/en-us/azure/virtual-wan/whats-new

As mentioned above, if your NVA or SaaS orchestrator is deployed on-premises, connect that on-premises site to all Virtual WAN hubs with NVAs or SaaS solutions deployed in them. If your orchestrator is in an Azure VNET, manage NVAs or SaaS solutions using public IP. Support for Azure VNET orchestrators is on the roadmap.

Kindly let us know if the above helps or you need further assistance on this issue.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Please sign in to rate this answer.

1 person found this answer helpful.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Virtual WAN Hub not advertising other Hub IP Space over VPN

0 additional answers

Your answer