Accessing on-prem resources from P2S client over S2S VPN on the same Virtual Network Gateway

Question

So I think this question has been asked before but I want to make sure I understand the answer. I have an Azure VNET with a Virtual Network Gateway. This VNG is configured with a S2S VPN to on-prem and P2S VPN for external Win10 clients. The Win10 VPN clients can connect over P2S to Azure and connect with Azure resources but cannot connect with the on-prem resources using the S2S. From what I'm reading is that the S2S VPN and the on-prem firewall need to be configured to use BGP but I'm not sure why using static routes will not work. Am I correct in this and why is this the case. My research lead me to the following but this shows multiple S2S VPNs and I'm not sure if this matches my situation https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-point-to-site-routing#multivnets2sbranchbgp

Additionally, we are waiting for ExpressRoute to be configured. When this is fully provisioned will this work between the P2S clients and on-prem resources or will special configurations need to be made.

Answer 1

For your scenario, this should work if you are using BGP, but you will need to manually add the routes on the windows machine that is connected via the P2S VPN.

For your ExpressRoute question, this will NOT work if your ER is connected via a Virtual Network ER Gateway. If this is a scenario you need to have, consider using an Azure Virtual WAN with your ExpressRoute Connection, This will let your P2S connections access your Virtual Network and on-prem resources.

Please let me know if you have any other questions.