VNET Peering > Hub > Spoke and Azure Firewall

Question

Hi,

Inquiry on Hub - Spoke Peering with Azure Firewall in Spoke subscription. Please advise how to configure the routing in Hub and Spoke with Azure Firewall in spoke. In addition, hub has a site to site VPN to on-premise.

Thanks,

Answer 1

@Zero Trust Solutions

In a traditional hub-and-spoke model, spokes cannot communicate directly with each other unless routed through the hub.

1. for, Transit connectivity cannot be achieved as per the documentation.
   

Refer: https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-faq#if-i-peer-vneta-to-vnetb-and-i-peer-vnetb-to-vnetc-does-that-mean-vneta-and-vnetc-are-peered

Another possible solution,

1. Implementing Azure Virtual WAN can facilitate transitive connectivity between spokes without needing to route traffic through the hub. This service allows for any-to-any connectivity.

Refer: https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-about

Refer: https://learn.microsoft.com/en-us/azure/architecture/networking/architecture/hub-spoke-vwan-architecture

Refer: https://learn.microsoft.com/en-us/azure/virtual-wan/scenario-route-through-nvas-custom

Refer: https://learn.microsoft.com/en-us/azure/virtual-wan/scenario-route-through-nva

---

I hope this has been helpful!

If above is unclear and/or you are unsure about something add a comment below.

Your feedback is important so please take a moment to accept answers. If you still have questions, please let us know what is needed in the comments so the question can be answered. Thank you for helping to improve Microsoft Q&A!

Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is how.

Answer 2

Hello Zero Trust Solutions,

Let me share you a small digram of what you want to configure:

So here my suggestions to configure routing in a Hub-Spoke topology with Azure Firewall in the spoke subscription including the s2S VPN:

1. Deploy Azure Firewall in the Spoke VNet:
   • Ensure that the Azure Firewall is deployed in the designated subnet within the spoke VNet.
2. Peer the Hub and Spoke VNets:
   • Establish VNet peering between the hub VNet and the spoke VNet to allow communication between the two networks.
3. Create User Defined Routes (UDRs) in the Spoke VNet:
   • Set up UDRs in the spoke subnets to direct traffic to the Azure Firewall. This ensures that all outbound traffic from the spokes goes through the firewall for inspection and security.
   • Example Route:
     • Destination: 0.0.0.0/0
     • Next hop type: Virtual Appliance
     • Next hop address: IP address of the Azure Firewall
4. Update Route Table in the Hub VNet:
   • Configure the route table in the hub VNet to direct traffic destined for on-premises to the Azure Firewall.
   • Example Route:
     • Destination: On-premises IP range
     • Next hop type: Virtual Network Gateway
5. Configure Site-to-Site VPN:
   • Ensure that the site-to-site VPN is properly configured to connect the hub VNet to the on-premises network.
6. Create UDRs for Ingress Traffic from On-Premises to Spoke VNet:
   • Set up UDRs in the hub subnet to direct traffic arriving from on-premises to the spoke VNet.
   • Example Route:
     • Destination: Spoke VNet IP range
     • Next hop type: Virtual Network Gateway
7. Configure Azure Firewall Rules:
   • Define appropriate network rules, NAT rules, and application rules in the Azure Firewall to control and manage traffic.
   • Network Rules: Allow or deny network traffic based on IP addresses and ports.
   • NAT Rules: Configure inbound and outbound Network Address Translation.
   • Application Rules: Control outbound internet traffic based on fully qualified domain names (FQDNs).

Additional references:

• https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview
• https://learn.microsoft.com/en-us/azure/firewall/overview
• https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview

If the information helped address your question, please Accept the answer.

Luis