Route only P2s traffic through firewall

Question

I have a relatively simple network setup A spoke(192.168.0.1/24) and a hub network(172.17.32.0) .In the hub network I have a firewall in firewall subnet and a vpn gateway in gateway subnet.In the vpn gateway i have configured multiple s2s tunnels and Point to site connectivity also, for remote users to connect

The goal now is simple I need only the p2s traffic to be routed through firewall without the s2s traffic going there.

I created two route table one for spoke and one for gateway subnet.
Spoke RT
10.216.1.0/24(p2s subnet) ---> Firewall

Gateway subnet RT
192.168.0.1/24(spoke subnet) ---> firewall

Firewall
10.216.1.0/24 --> 192.168.0.1/24 --> Allow

The above setup works by forwarding the whole of vpn gateway traffic to Firewall whereas I only need P2s traffic to be forwarded to firewall.Kindly assist me in this.I am also attaching an okaish diagram of the setup as well

Answer 1

Hello George Geoffrick G

Apologies for delay in response!

• As per the Network setup what you are trying to achieve is not possible.

If you want to Implement this then I suggest you go with VWAN setup.

---

I hope this has been helpful!

Your feedback is important so please take a moment to accept answers. If you still have questions, please let us know what is needed in the comments so the question can be answered. Thank you for helping to improve Microsoft Q&A!

Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is how.

Answer 2

Hi @George Geoffrick G ,

Hope you are doing well.

To answer your question, Azure Route Table on the Gateway subnet doesn't allow you to bifurcate destination spoke traffic based on the source(P2S/S2S), so irrespective of traffic coming from anywhere(P2S/S2S) it would land on the firewall because of the UDR you have on the Gateway Subnet, and hence this is not possible.

Also, this is not a recommended approach as per network security best practises. I am curious to understand the motivation behind bypassing S2S traffic from the firewall, maybe that helps me answer better.

Regards,

Sarthak, CSA, Microsoft