Need suggestions on traffic flow from hub and spoke model and Azure Site to Site VPN.

Question

Hi,

Could you please suggest me a best Azure resource which can forward the traffic from hub virtual network to spoke virtual network which has my application running and I have one more query regarding Azure Site to Site. I have a Vnet with vpn gateway in it and I have made a connection from on-prem environment to Azure by using vpn gateway, but I have created an another Vnet which has a VM in it, which in the same region and resource group. I have peered the vpn gateway Vnet and Azure Vnet which has a VM, but I'm unable to reach the VM from on-prem environment. Please give me some inputs to achieve my requirement.

Answer 1

Hi @Martinmajestic-3285,

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

• You can use Azure Firewall in a hub virtual network to route and filter traffic between multiple spoke virtual network. Subnets in each of the spoke virtual networks must have a UDR pointing to the Azure Firewall as a default gateway for this scenario to work properly.
• Reference: https://learn.microsoft.com/en-us/azure/firewall/firewall-faq#can-azure-firewall-in-a-hub-virtual-network-forward-and-filter-network-traffic-between-multiple-spoke-virtual-networks
• Regarding Azure site-to-site, please follow the Microsoft document and go to the Vnet (which has a VPN Gateway) and configure VNET Peering between VNet1(which has a VPN Gateway) and VNet2 (VM).
• Please use the below screenshots for your reference:

• Also, we need to configure a static route for Vnet 2 (VM) from On-Prem server end. The static route needs to contain both VNet1(which has a VPN Gateway) and VNet2 (VM). pointing towards the same NIC.
• Please make sure that there is no IP overlapping between VNets.

If above is unclear and/or you are unsure about something add a comment below.

Please don’t forget to close the thread by clicking "Accept answer" wherever the information provided helps you, as this can be beneficial to other community members.

Thanks,

Sai.