VPN gateway and Express route gateway in two different VNETs

Question

Dears,

I have following scenarios. I have express route (gateway type-Express Route) on a Hub-VNET establishes the connection with On-Prem. I have created another VNET exclusive for S2S VPN to establish the VPN connection with 3rd party vendors. Below block diagram shows how I wanted to make the flow working. Please see the below diagram.
Basically, I just wanted to route the traffic from spoke VNET to Hub VNET -- > Traffic should be screened by NVA ---> Then If its a 3party site traffic (typically on VNET will do the route look up) traffic should forward to 3part VNET (where we have VPN gateway)
So....
Question 1 what configuration I should configure during the peering on Hub VNET and 3party VNET, particular in
Question 2 Can we have gateway types Express route on one VNET and VPN as gateway type another VNET, in this scenario is recommended.
Question 3Do I need to say on 3rdpary VNET this as remote gateway, so that dynamic route update will populate to Hub VNET / its just a VNET peering saying none.

Your swift response is much appreciated.

Answer 1

Hi @Ramakrishnan Venkataraman ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.
I understand that you are trying to build architecture as follows: Spoke-->Hub1-->Hub2-->OnPrem(3rd Party)

I am posting a summary of the discussions for the wider community's reach.

As suggested by @msrini-MSFT , the best way to go forward is to leverage Azure vWAN.
https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-route-table-nva-portal
We generally don't recommend multiple-Hub architectures.

Other than vWAN, you can also consider VPN-ExpressRoute Gateway co-existence with a single Hub

• Refer : https://learn.microsoft.com/en-us/azure/expressroute/how-to-configure-coexisting-gateway-portal#configure-a-site-to-site-vpn-to-connect-to-sites-not-connected-through-expressroute
• Your scenario comes under "Configure a Site-to-Site VPN to connect to sites not connected through ExpressRoute"

To address your queries,

Question 1
Question 3

• A Vnet, if it has a Virtual Network Gateway, then we cannot create a peering with another Vnet that has a Virtual Network Gateway with "Use Remote Gateways" enabled.
• "Use Remote Gateways" will be disabled.
• So, you cannot configure the peering to route traffic from HubVnet to 3rdPartyVPNVnet from the platform level.

Question 2

• This is not recommended.
• While one can make this work by adding manual routes, and deploying another NVA in 3rdPartyVPNVnet, it will be complex and difficult to manage

I see you have an InfoSec requirement that you need to have these Vnets isolated.

• Even with vWAN, and proper configuration of the Route table in vWAN, you can achieve this.
• https://learn.microsoft.com/en-us/azure/virtual-wan/how-to-virtual-hub-routing

As stated, you cannot configure the platform(Peering) to make a VM route traffic to two Gateways.

• The only way I can think of doing this is with the use of a Firewall/NVA in 3rdPartyVPNVnet
• You can set up routing between this Firewall and your existing NVA to exchange traffic.
• Ideally, this should work.

You confirmed you were able to follow the above action plan and make this work using the use of a Firewall/NVA (Palo Alto firewall)

Thanks,
Kapil

----------------------------------------------------------------------------------------------------------------

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

Answer 2

Hi,

You can leverage Azure vWAN where you create ER gateway + VPN gateway on the hub and you connect your spoke to the HUB VNETs.

You can use Route table to forward your traffic to the NVAs and then route traffic destined to On-Prem via ER and Vendors via VPN gateway. --> This can only be done if there are no overlapping of IPs between your vendor and On-Premises and advertise routes to the ER and VPN gateways respectively.

Reference : https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-route-table-nva-portal

Regards,
Karthik Srinivas

Answer 3

Update:
Sorry for delayed reply. We have implemented VPN gateway on centralized VNET(hub vnet) eradicated another hub from the equation.
To support our InfosSec requirement, all the the untrusted traffic(VPN traffic) ensure will pass on to the NVA(Paloalto firewall)
After successful connection establishment with third party I can see the route table automatically encoded in the connectivity VNET route table(as a system route).
However I am still working on initiating the live traffic with 3rd party, will keep you post with detailed analysis..

Sorry again....
Thanks again to all for your support.