I have peered hub VNets in different Azure regions, and traffic between them needs to pass through NVAs. What routing approach makes sense, and when is Virtual WAN worth considering?
How should I route between regional hub VNets through NVAs?
Asked by
c61~spool_304
Answers
For two regions, explicit routes may be the simplest place to start. Add routes for the destination region's prefixes with the appropriate NVA or NVA load balancer as the next hop, then do the equivalent for the return path.
Check the routes on the NVAs too. The exact entries depend on where inspection happens and which subnets originate the traffic. Verify the effective routes and make sure the forward and return paths work with your appliance's stateful inspection.
Reply to this answer
With multiple hubs, I'd look at Azure Virtual WAN rather than maintaining an expanding set of routes by hand. It can simplify hub-to-hub routing and support NVAs in the hubs, though it doesn't mean every inspection policy is automatic.
Check the supported NVA deployment and routing options for your design, and compare the hub costs against the operational work you'd save. The case gets stronger as the number of regions grows.
Reply to this answer
If the NVAs support it, consider exchanging routes over BGP so they can learn which hub reaches each prefix. You'd still need to design how traffic reaches the NVAs and check the return path, but dynamic exchange can reduce manual route upkeep.
Reply to this answer
Add your answer
Answers are reviewed before publication.
c61~spool_304:
Can Virtual WAN coexist with third-party SD-WAN if branch connectivity is handled separately?
briefly_unspooled:
Possibly, but it depends on the vendor and how you intend to connect the networks. Check the supported integration and routing options for that product before treating it as a drop-in change.