What's new in Azure Virtual WAN?

Azure Virtual WAN is updated regularly. Stay up to date with the latest announcements. This article provides you with information about:

  • Recent releases
  • Previews underway with known limitations (if applicable)
  • Known issues
  • Deprecated functionality (if applicable)

You can also find the latest Azure Virtual WAN updates and subscribe to the RSS feed here.

Recent releases

Routing

Type Area Name Description Date added Limitations
Feature Routing Virtual hub routing preference Hub routing preference gives you more control over your infrastructure by allowing you to select how your traffic is routed when a virtual hub router learns multiple routes across S2S VPN, ER and SD-WAN NVA connections. October 2022
Feature Routing Bypass next hop IP for workloads within a spoke VNet connected to the virtual WAN hub generally available Bypassing next hop IP for workloads within a spoke VNet connected to the virtual WAN hub lets you deploy and access other resources in the VNet with your NVA without any additional configuration. October 2022
SKU/Feature/Validation Routing BGP end point (General availability) The virtual hub router now exposes the ability to peer with it, thereby exchanging routing information directly through Border Gateway Protocol (BGP) routing protocol. June 2022
Feature Routing 0.0.0.0/0 via NVA in the spoke Ability to send internet traffic to an NVA in spoke for egress. March 2021 0.0.0.0/0 doesn't propagate across hubs.

Can't specify multiple public prefixes with different next hop IP addresses.

NVAs and integrated third-party solutions

Type Area Name Description Date added Limitations
Feature Network Virtual Appliances (NVAs)/Integrated Third-party solutions in Virtual WAN hubs Fortinet SD-WAN General availability of Fortinet SD-WAN solution in Virtual WAN. Next-Generation Firewall use cases in preview. October 2022 SD-WAN solution generally available. Next Generation Firewall use cases in preview.
Feature Network Virtual Appliances (NVAs)/Integrated Third-party solutions in Virtual WAN hubs Versa SD-WAN Preview of Versa SD-WAN. November 2021
Feature Network Virtual Appliances (NVAs)/Integrated Third-party solutions in Virtual WAN hubs Cisco Viptela, Barracuda and VMware (Velocloud) SD-WAN General Availability of SD-WAN solutions in Virtual WAN. June/July 2021

ExpressRoute

Type Area Name Description Date added Limitations
Feature ExpressRoute ExpressRoute circuit page now shows vWAN connection August 2022

Site-to-site

Type Area Name Description Date added Limitations
Feature Branch connectivity/Site-to-site VPN Multi-APIPA BGP Ability to specify multiple custom BGP IPs for VPN gateway instances in vWAN. June 2022 Currently only available via portal. (Not available yet in PowerShell)
Feature Branch connectivity/Site-to-site VPN Custom traffic selectors Ability to specify what traffic selector pairs site-to-site VPN gateway negotiates May 2022 Azure negotiates traffic selectors for all pairs of remote and local prefixes. You can't specify individual pairs of Traffic selectors to negotiate.
Feature Branch connectivity/Site-to-site VPN Site-to-site connection mode choices Ability to configure if customer or vWAN gateway should initiate the site-to-site connection while creating a new S2S connection. February 2022
Feature Branch connectivity/Site-to-site VPN Packet capture Ability for customer to perform packet captures on site-to-site VPN gateway. November 2021
Feature Branch connectivity/Site-to-site VPN

Remote User connectivity/Point-to-site VPN
Hot-potato vs cold-potato routing for VPN traffic Ability to specify Microsoft or ISP POP preference for Azure VPN egress traffic. For more information, see Routing preference in Azure. June 2021 This parameter can only be specified at gateway creation time and can't be modified after the fact.
Feature Branch connectivity/Site-to-site VPN NAT Ability to NAT overlapping addresses between site-to-site VPN branches, and between site-to-site VPN branches and Azure. March 2021 NAT isn't supported with policy-based VPN connections.

User VPN (point-to-site)

Type Area Name Description Date added Limitations
Feature Remote User connectivity/Point-to-site VPN Global profile include/exclude Ability to mark a point-to-site gateway as "excluded", meaning users who connect to global profile won't be load-balanced to that gateway. February 2022
Feature Remote User connectivity/Point-to-site VPN Forced tunneling for P2S VPN Ability to force all traffic to Azure Virtual WAN for egress. October 2021 Only available for Azure VPN Client version 2:1900:39.0 or newer.
Feature Remote User connectivity/Point-to-site VPN macOS Azure VPN client General Availability of Azure VPN Client for macOS. August 2021
Feature Branch connectivity/Site-to-site VPN

Remote User connectivity/Point-to-site VPN
Hot-potato vs cold-potato routing for VPN traffic Ability to specify Microsoft or ISP POP preference for Azure VPN egress traffic. For more information, see Routing preference in Azure. June 2021 This parameter can only be specified at gateway creation time and can't be modified after the fact.
Feature Remote User connectivity/Point-to-site VPN Remote RADIUS server Ability for a P2S VPN gateway to forward authentication traffic to a RADIUS server in a VNet connected to a different hub, or a RADIUS server hosted on-premises. April 2021
Feature Remote User connectivity/Point-to-site VPN Dual-RADIUS server Ability to specify primary and backup RADIUS servers to service authentication traffic. March 2021
Feature Remote User connectivity/Point-to-site VPN Custom IPsec policies Ability to specify connection/encryption parameters for IKEv2 point-to-site connections. March 2021 Only supported for IKEv2- based connections.

View the list of available parameters.
SKU Remote User connectivity/Point-to-site VPN Support up to 100K users connected to a single hub Increased maximum number of concurrent users connected to a single gateway to 100,000. March 2021
Feature Remote User connectivity/Point-to-site VPN Multiple-authentication methods Ability for a single gateway to use multiple authentication mechanisms. March 2021 Only supported for OpenVPN-based gateways.

Preview

The following features are currently in gated public preview. After working with the listed articles, you have questions or require support, reach out to the contact alias (if available) that corresponds to the feature.

Type of preview Feature Description Contact alias Limitations
Managed preview Configure user groups and IP address pools for P2S User VPNs This feature allows you to configure P2S User VPNs to assign users IP addresses from specific address pools based on their identity or authentication credentials by creating User Groups. Known limitations are displayed here: Configure User Groups and IP address pools for P2S User VPNs (preview).
Managed preview Aruba EdgeConnect SD-WAN Deployment of Aruba EdgeConnect SD-WAN NVA into the Virtual WAN hub preview-vwan-aruba@microsoft.com
Managed preview Routing intent and policies enabling inter-hub security This feature allows you to configure internet-bound, private, or inter-hub traffic flow through the Azure Firewall. For more information, see Routing intent and policies. For access to the preview, contact previewinterhub@microsoft.com Not compatible with NVA in a spoke, but compatible with BGP peering.

For additional limitations, see How to configure Virtual WAN hub routing intent and routing policies.
Managed preview Checkpoint NGFW Deployment of Checkpoint NGFW NVA into the Virtual WAN hub DL-vwan-support-preview@checkpoint.com, previewinterhub@microsoft.com Same limitations as routing intent.

Doesn't support internet inbound scenario.
Managed preview Fortinet NGFW/SD-WAN Deployment of Fortinet dual-role SD-WAN/NGFW NVA into the Virtual WAN hub azurevwan@fortinet.com, previewinterhub@microsoft.com Same limitations as routing intent.

Doesn't support internet inbound scenario.
Public preview/Self serve Virtual hub routing preference This feature allows you to influence routing decisions for the virtual hub router. For more information, see Virtual hub routing preference. For questions or feedback, contact preview-vwan-hrp@microsoft.com If a route-prefix is reachable via ER or VPN connections, and via virtual hub SD-WAN NVA, then the latter route is ignored by the route-selection algorithm. Therefore, the flows to prefixes reachable only via virtual hub. SD-WAN NVA will take the route through the NVA. This is a limitation during the preview phase of the hub routing preference feature.
Public preview/Self serve Hub-to-hub traffic flows instead of an ER circuit connected to different hubs (Hub-to-hub over ER) This feature allows traffic between 2 hubs traverse through the Azure Virtual WAN router in each hub and uses a hub-to-hub path, instead of the ExpressRoute path (which traverses through Microsoft's edge routers/MSEE). For more information, see the Hub-to-hub over ER preview link. For questions or feedback, contact preview-vwan-hrp@microsoft.com

Known issues

# Issue Description Date first reported Mitigation
1 Virtual hub router upgrade: Compatibility with NVA in a hub. For deployments with an NVA provisioned in the hub, the virtual hub router can't be upgraded to Virtual Machine Scale Sets. July 2022 The Virtual WAN team is working on a fix that will allow Virtual hub routers to be upgraded to Virtual Machine Scale Sets, even if an NVA is provisioned in the hub. After upgrading, users will have to re-peer the NVA with the hub router’s new IP addresses (instead of having to delete the NVA).
2 Virtual hub router upgrade: Compatibility with NVA in a spoke VNet. For deployments with an NVA provisioned in a spoke VNet, the customer will have to delete and recreate the BGP peering with the spoke NVA. March 2022 The Virtual WAN team is working on a fix to remove the need for users to delete and recreate the BGP peering with a spoke NVA after upgrading.

Next steps

For more information about Azure Virtual WAN, see What is Azure Virtual WAN and frequently asked questions- FAQ.