Azure Hub Network with NVA and azure firewall and routing between VPN and Express route gateway through firewalls

Question

Hi Team,

I have attached the network diagram, Here is set up.

1. There is HUB and Spoke topology with NVA. All traffic between on-premise and azure spoke is passing through NVA
2. Third party location is connected through SDWAN VM over internet. SDWAN VM is having IPSeC with BGP connectivity with Azure VPN gateway. Both are in same vnet.

Requirement -

1. Add azure firewall so that traffic flow will be like on-premise -> exprt gw -> NVA -> Azure FW -> spoke vnet. Since azure FW does not support UDR then how to send traffic from azure FW to NVA
2. How to enable routing between sites connected to VPN GW and exp route gateway e.g VM1 -> SDWAN VM -> VPN gw ->Azure fw -> NVA ->exp rt gw -> VM3
3. How to enable routing between sites connected to VPN GW and spoke vnet

     VM1 -> SDWAN VM -> VPN gw ->Azure fw -> NVA  -> VM2
   

   4. Does Azure FW and NVA learn Third party IP prefixes from VPN gateway through vnet peering
4. Does Azure route server help 1) to enable routing between exprt gateway and vpn gw 2) Further routing from VPN/exprt GW to NVA/ azure firewall to spoke vnet

Answer 1

Hello Siddhesh Rane,

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here, Requirement:1

I understand that you want to send the traffic from the firewall to NVA.

Create a Network Rule Collection on the Azure Firewall:

• Define a Network Rule that allows traffic from the on-premises source IP range to the NVA’s internal IP address.
• Specify the destination as the NVA's private IP address and the appropriate port (e.g., if the NVA is serving as a VPN, it might be port 443 or 500/4500 for IPsec).
• Set the action to Allow.

Once traffic reaches the NVA, you can set up UDRs on the NVA’s subnet to route the traffic to the appropriate spoke VNet.

Note: This step is critical for ensuring that traffic flows correctly between the NVA and the Spoke VNet.

 

Requirement:2 To enable routing between sites connected to a VPN Gateway and ExpressRoute Gateway using an Azure Route Server:

1. Deploy Azure Route Server: Set up the Route Server in your Hub VNet to manage routing dynamically.
2. Connect Your Appliances: Establish BGP peering between the Route Server and your network devices like SD-WAN, NVA, VPN Gateway, and ExpressRoute Gateway. This allows them to exchange routing information automatically.
3. Automatic Routing: The Route Server will automatically handle route updates, ensuring traffic flows correctly from the on-premises network through the VPN Gateway, SD-WAN, Azure Firewall, NVA, and finally to the destination via the ExpressRoute Gateway.

Requirement:3

Use the Route Server to dynamically route the traffic VPN Gate to Spoke Vnet.

 

Requirement:3b

No, Azure Firewall and NVA do not learn third-party IP prefixes from a VPN Gateway through VNet peering. Azure Firewall and NVAs require explicit route configuration or BGP peering with the VPN Gateway to learn and handle third-party IP prefixes, Azure Firewall and NVAs require explicit route configuration or BGP peering with the VPN Gateway.

 

Requirement: 4

1. Azure Route Server itself does not directly enable routing between ExpressRoute Gateway and VPN Gateway. It is designed to simplify and automate dynamic route management between your virtual network and network virtual appliances
2. Yes, Azure Route Server can assist with dynamic route propagation to and from NVAs (including Azure Firewall) and help in managing the routing between your VPN/ExpressRoute Gateway and your spoke VNets.

Additional References: What is Azure Route Server? | Microsoft Learn,

Configure ExpressRoute and S2S VPN coexisting connections with Azure PowerShell | Microsoft Learn, Support for ExpressRoute and Azure VPN - Azure Route Server | Microsoft Learn

If you have any further queries, do let us know. If the answer is helpful, please click "Accept Answer" and "Upvote it."