We have multiple Azure hub VNets deployed in different regions. The hubs are peered, and traffic between them needs to pass through network virtual appliances (NVAs). What routing design is recommended, and how should the VNets, NVAs, and route exchange be configured?
3 Answers
For a manually managed design, add routes in each source VNet for the destination region’s address space, using the destination hub’s internal load balancer or NVA path as the next hop. Configure the corresponding routes on the NVAs as well. This is manageable with two regions and can work with three, but the route tables become increasingly difficult to maintain as more hubs are added.
Azure Virtual WAN is usually the cleanest option once you have two or more regional hubs. Deploy the NVAs in the hubs and use routing intent and hub routing to manage the paths between regions. It can also coexist with third-party SD-WAN or remote-branch solutions, although the exact integration depends on how those devices exchange routes and connect to the Virtual WAN hubs.
The NVAs can exchange routes using BGP so each appliance knows which hub should receive traffic for a particular prefix. You may also need Azure Route Server (ARS) so the spoke VNets learn the routes dynamically instead of relying entirely on static user-defined routes. Make sure the effective routes and return paths are symmetric, since both directions must pass through the intended NVAs.
The main drawback is cost. Virtual WAN hub pricing can add up quickly, so it is worth comparing that with the operational effort and routing complexity of managing the hubs yourself.