How to configure a VM in Spoke in a HUB & SPOKE Cisco-SD-WAN Solution to use Site to site VPN tunnel using cisco FTDv to reach a partner on prem server

Question

How to configure a VM in Spoke in a HUB & SPOKE Cisco-SD-WAN Solution to use Site to site VPN tunnel using cisco FTDv to reach a partner on prem server

Raj A 0

G Sree Vidya 2,360 Reputation points Microsoft External Staff Moderator

2025-05-12T08:18:53.3033333+00:00

Hello Raj A,

I wanted to follow up and check if you had the opportunity to review the information provided by Suwarna S Kale in our previous post.

Kindly let us know if the above helps or you need further assistance on this issue.
G Sree Vidya 2,360 Reputation points Microsoft External Staff Moderator

2025-05-13T09:36:20.8666667+00:00

Hello Raj A,

Following up to see if the below suggestion was helpful. And, if you have any further query do let us know.
Raj A 0 Reputation points

2025-05-13T15:07:22.1366667+00:00

We have the Cisco FTDv deployed in a shared Services VNET which is spoke . Not in the vWAN HUB. If we configure Default Route 0.0.0.0 to Firewall inside interface on HUB Route Table its not taking this Path .
Raj A 0 Reputation points

2025-05-13T17:00:11.6033333+00:00

The Current design is Azure vWAN (HUB-SPOKE) Cisco SD WAN in HUB to Connect to Branch Sites.

Azure Developer Vnet for Functions Apps etc , Shared Services Vnet with Firewall for In bound for Vendors/Rapid7 etc out bound to Internet and VPN for VMs .
Venkat V 2,545 Reputation points Microsoft External Staff Moderator

2025-05-14T12:27:27.8433333+00:00

Hi @Raj A

To achieve your scenario, you can deploy a Virtual Machine within a Spoke VNet, which is peered with a hub VNet to enable cross-network communication.

Within the Hub VNet, a Cisco FTDv appliance is deployed and configured to establish a site-to-site VPN connection with the partner’s on-premises network.

To route traffic from the VM in the Spoke to the partner’s on-prem environment, user-defined routes are configured in the spoke. These UDRs direct all partner-specific IP prefixes to the private IP address of the Cisco FTDv in the Hub VNet, ensuring that outbound traffic follows the correct path through the VPN tunnel.

I hope this helps to resolve your query.

If the above is unclear and/or you are unsure about something, add a comment below.

Reference: Hub-spoke network topology in Azure

Raj A 0

So is Cisco FTDv in Spoke to connect a Partner Site via s2s VPN not a valid Senario ? in a HUB and Spoke vWan Design ?

   |

                                       |

                     +----------------++----------------+

                     |                                  |

                     | Third-Party Site                 |

                     | 10.200.250.48/29                |

                     | Internet IP: 1.2.3.4      |

                     |                                  |

                     +------------------+---------------+

                                        |

                                        | S2S VPN										

			   +----------------+

                               |    Internet    |

                               +--------+-------+

				    |

				    |

      +------------------------------------------------------+    

      |                                                      |    

      | Shared Services VNET (Spoke 1)                       |    

      |                                                      |    

      | +---------------------------------------------------+ |    

      | |  +----------------+                               | |    

      | |  | FTD Outside IP |                               | |    

      | |  | 4.x.x.1x   	|                               | |    

      | |  +-------+--------+                               | |    

      | |          |                                        | |    

      | |  +-------v--------+    +------------+----         | |    

      | |  | FTDv Outside IF|<-->| FTDv Inside    |         | |    

      | |  | 172.16.204.229 |    | 172.16.204.197 |         | |    

      | |  +----------------+    +-----+------+---          | |    

      | |                              |                    | |    

      | |                              v                    | |    

      | |  +---------------------------------------------+  | |    

      | |  | Shared Services Subnet                      |  | |    

      | |  | 172.16.250.0/24                             |  | |    

      | |  +---------------------------------------------+  | |    

      | +--------------------+------------------------------+ |    

      +--------------------- | ------------------------------+    

                             |

                             |  Connection to Virtual WAN Hub

                             v

                    +------------------+

                    |                  |

                    | Virtual WAN Hub  |

                    |                  |

                    +--------+---------+

                             |

                             |  Connection to App VNET

                             v

                    +------------------+

                    |                  |

                    | App VNET (Spoke 2) |

                    | 172.16.203.0/24  |

                    |                  |

                    +------------------+

Venkat V 2,545 Reputation points Microsoft External Staff Moderator

2025-05-15T04:57:16.25+00:00

Hi @Raj A

Placing the Cisco FTDv in a spoke to connect a partner site via S2S VPN is technically possible but not a recommended or supported design in Azure Virtual WAN architecture. In vWAN, all external connectivity (VPN, ER, etc.) should flow through the vWAN Hub to maintain centralized routing and policy control. Bypassing the hub by placing the VPN in a spoke breaks the hub-and-spoke model and may cause routing and support issues. Best practice is to terminate the VPN at the vWAN Hub or a dedicated NVA-connected VNet, then route traffic through the hub.

If you're still looking for the same approach, please share all the details for deploying an NVA in a spoke.

Reference: https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-about

I hope this helps to resolve your query.

If the above is unclear and/or you are unsure about something, add a comment below.
Venkat V 2,545 Reputation points Microsoft External Staff Moderator

2025-05-19T06:33:45.08+00:00

Hi @Raj A,

I just wanted to follow up and see if you had a chance to review my response to your question. Please let us know if it was helpful, and feel free to reach out if you have any further queries.

1 answer

Your answer

G Sree Vidya 2,360 Reputation points Microsoft External Staff Moderator

2025-05-12T08:18:53.3033333+00:00

Hello Raj A,

I wanted to follow up and check if you had the opportunity to review the information provided by Suwarna S Kale in our previous post.

Kindly let us know if the above helps or you need further assistance on this issue.
G Sree Vidya 2,360 Reputation points Microsoft External Staff Moderator

2025-05-13T09:36:20.8666667+00:00

Hello Raj A,

Following up to see if the below suggestion was helpful. And, if you have any further query do let us know.
Raj A 0 Reputation points

2025-05-13T15:07:22.1366667+00:00

We have the Cisco FTDv deployed in a shared Services VNET which is spoke . Not in the vWAN HUB. If we configure Default Route 0.0.0.0 to Firewall inside interface on HUB Route Table its not taking this Path .
Raj A 0 Reputation points

2025-05-13T17:00:11.6033333+00:00

The Current design is Azure vWAN (HUB-SPOKE) Cisco SD WAN in HUB to Connect to Branch Sites.

Azure Developer Vnet for Functions Apps etc , Shared Services Vnet with Firewall for In bound for Vendors/Rapid7 etc out bound to Internet and VPN for VMs .
Venkat V 2,545 Reputation points Microsoft External Staff Moderator

2025-05-14T12:27:27.8433333+00:00

Hi @Raj A

To achieve your scenario, you can deploy a Virtual Machine within a Spoke VNet, which is peered with a hub VNet to enable cross-network communication.

Within the Hub VNet, a Cisco FTDv appliance is deployed and configured to establish a site-to-site VPN connection with the partner’s on-premises network.

To route traffic from the VM in the Spoke to the partner’s on-prem environment, user-defined routes are configured in the spoke. These UDRs direct all partner-specific IP prefixes to the private IP address of the Cisco FTDv in the Hub VNet, ensuring that outbound traffic follows the correct path through the VPN tunnel.

I hope this helps to resolve your query.

If the above is unclear and/or you are unsure about something, add a comment below.

Reference: Hub-spoke network topology in Azure
Raj A 0 Reputation points

2025-05-14T17:50:30.5533333+00:00

So is Cisco FTDv in Spoke to connect a Partner Site via s2s VPN not a valid Senario ? in a HUB and Spoke vWan Design ?

| | +----------------++----------------+ | | | Third-Party Site | | 10.200.250.48/29 | | Internet IP: 1.2.3.4 | | | +------------------+---------------+ | | S2S VPN +----------------+ | Internet | +--------+-------+ | | +------------------------------------------------------+ | | | Shared Services VNET (Spoke 1) | | | | +---------------------------------------------------+ | | | +----------------+ | | | | | FTD Outside IP | | | | | | 4.x.x.1x | | | | | +-------+--------+ | | | | | | | | | +-------v--------+ +------------+---- | | | | | FTDv Outside IF|<-->| FTDv Inside | | | | | | 172.16.204.229 | | 172.16.204.197 | | | | | +----------------+ +-----+------+--- | | | | | | | | | v | | | | +---------------------------------------------+ | | | | | Shared Services Subnet | | | | | | 172.16.250.0/24 | | | | | +---------------------------------------------+ | | | +--------------------+------------------------------+ | +--------------------- | ------------------------------+ | | Connection to Virtual WAN Hub v +------------------+ | | | Virtual WAN Hub | | | +--------+---------+ | | Connection to App VNET v +------------------+ | | | App VNET (Spoke 2) | | 172.16.203.0/24 | | | +------------------+
Venkat V 2,545 Reputation points Microsoft External Staff Moderator

2025-05-15T04:57:16.25+00:00

Hi @Raj A

Placing the Cisco FTDv in a spoke to connect a partner site via S2S VPN is technically possible but not a recommended or supported design in Azure Virtual WAN architecture. In vWAN, all external connectivity (VPN, ER, etc.) should flow through the vWAN Hub to maintain centralized routing and policy control. Bypassing the hub by placing the VPN in a spoke breaks the hub-and-spoke model and may cause routing and support issues. Best practice is to terminate the VPN at the vWAN Hub or a dedicated NVA-connected VNet, then route traffic through the hub.

If you're still looking for the same approach, please share all the details for deploying an NVA in a spoke.

Reference: https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-about

I hope this helps to resolve your query.

If the above is unclear and/or you are unsure about something, add a comment below.
Venkat V 2,545 Reputation points Microsoft External Staff Moderator

2025-05-19T06:33:45.08+00:00

Hi @Raj A,

I just wanted to follow up and see if you had a chance to review my response to your question. Please let us know if it was helpful, and feel free to reach out if you have any further queries.

Answer 1

Hello Raj A,

Thank you for posting your question in the Microsoft Q&A forum.

To configure an Azure VM in a spoke network to access a partner's on-premises server via a Cisco SD-WAN site-to-site VPN with FTDv, begin by ensuring proper network topology: deploy the Cisco FTDv firewall in the hub VNet and establish VNet peering with gateway transit enabled to the spoke. Configure the FTDv with an IPSec VPN tunnel matching the partner's SD-WAN policies, including IKEv2 parameters, crypto maps, and proper route propagation either via static routes or BGP through Azure Route Server. Implement user-defined routes (UDRs) in the spoke VNet to direct partner-bound traffic to the FTDv’s private IP, and verify NSG rules allow this flow.

Network Topology & Prerequisites

Hub VNet (Azure): Hosts the Cisco FTDv firewall (Azure Marketplace VM).
Spoke VNet (Azure): Contains the VM that needs partner access (peered with Hub).
Cisco SD-WAN (On-Prem): Connects to FTDv via IPSec VPN.
Partner Network: Accessed via the SD-WAN tunnel.

Prerequisites:

Cisco FTDv deployed in Hub VNet (with VPN configured to SD-WAN).
Hub-Spoke VNet peering (with gateway transit enabled).
Azure Route Server (optional, for dynamic routing with BGP).

Test connectivity from the spoke VM while monitoring VPN status on the FTDv and Azure’s effective routes.

Test Connectivity

From the spoke VM, traceroute to the partner’s server.
Verify VPN status on FTDv (show vpn-sessiondb).
Check Azure effective routes for the spoke VM’s NIC.

For security, enable logging via NSG flow logs and FTDv syslog, and consider high availability with active/standby FTDv deployments. If challenges persist, validate IKE policy alignment, UDR application, and packet paths using FTDv diagnostics.

Security Considerations

Azure Firewall/NVA Inspection: If needed, route traffic via an additional firewall.
Logging: Enable NSG flow logs and FTDv syslog to monitor traffic.
High Availability: Deploy FTDv in active/standby with Azure Load Balancer.

For large-scale deployments, Azure Virtual WAN or ExpressRoute may offer more robust alternatives. Always refer to Cisco’s Azure deployment guides and Microsoft’s Route Server documentation for implementation specifics.

If the above answer helped, please do not forget to "Accept Answer" as this may help other community members to refer the info if facing a similar issue. Your contribution to the Microsoft Q&A community is highly appreciated.

Share via

How to configure a VM in Spoke in a HUB & SPOKE Cisco-SD-WAN Solution to use Site to site VPN tunnel using cisco FTDv to reach a partner on prem server

1 answer

Your answer