Hub Spoke topology with Virtual Network Gateway of type ExpressRoute

Apurva Pathak 360

Hi folks,

Merry Christmas!

Could you please guide me to any help doc/ forum which can help me to implement Hup- Spoke topology with Virtual Network Gateway of type ExpressRoute (not type VPN). I tried implementing both, and VPN type gateway worked for me however Expressroute didn't.

So, just want to ensure where exactly I am messing around.

Thanks a lot in advance!

Cheers!

Apurva

KapilAnanth-MSFT 39,211 Reputation points Microsoft Employee

2023-12-29T04:34:14.3433333+00:00
@Apurva Pathak

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you would like to configure ExpressRoute and connect OnPrem and Azure.

As stated by Andreas Baumgarten, to connect OnPrem to Azure VNET, you need an ExpressRoute Gateway + an ExpressRoute Circuit (with peering enabled)

You must understand what an ExpressRoute is,

ExpressRoute lets you extend your on-premises networks into the Microsoft cloud over a private physical connection with the help of a connectivity provider.

The physical part of this connection is the ExpressRoute Circuit

The ExpressRoute Circuit can only start exchanging BGP Routes when the "connectivity provider" enables the circuit for you.

What is Azure ExpressRoute?

Deploying only a Gateway will not be able to provide a connectivity to OnPrem.

Other than that, the Hub-Spoke connectivity is similar to the VPN Gateway.

Kindly let us know if this helps or you need further assistance on this issue.

Thanks,

Kapil

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.
Apurva Pathak 360 Reputation points

2023-12-29T11:38:51.57+00:00

Hi @KapilAnanth-MSFT ,

Thanks for your inputs!

I am not trying to connect my on-premises network with my Azure. I just want to achive Hub- Spoke with a VPN GW of type ExR (which did not work in my case).

Could you please suggest me docs which can me help me do so.

Thanks,

Apurva
KapilAnanth-MSFT 39,211 Reputation points Microsoft Employee

2024-01-03T12:57:39.46+00:00
@Apurva Pathak

From your question, I am afraid did not quite understand what did not work.

When you say "I just want to achieve Hub- Spoke with a VPN GW of type ExR", what exactly do you mean by "achieve" ?

Having a VNET with a Gateway (any gateway, both VPN or ExpressRoute) and peering other VNETs with "Enable Gateway Transit" creates a Hub- Spoke architecture.

If you want connectivity to OnPrem
1.ExR Gateway - Connect to a ExR Circuit
2.VPN Gateway - Create a S2S Connection

Can you elaborate what exactly is "not working" ?

If your end goal is to just have a Hub VNET and Spoke VNETs, Point 1 covers it.

If your goal is to connect to OnPrem, you have to have a ExR Circuit

Were you unable to create a Peering between Hub and Spoke VNETs?

Is there any error message you are getting?

Or is your end goal completely different?

Cheers,

Kapil
KapilAnanth-MSFT 39,211 Reputation points Microsoft Employee

2024-01-04T12:01:26.4033333+00:00

@Apurva Pathak

May I know if you got a chance to review my previous comment?

Please let me know if you are facing any challenges or if there are any follow-up questions, I shall be glad to address them.

Thanks,

Kapil
Apurva Pathak 360 Reputation points

2024-01-04T12:07:38.9066667+00:00

@KapilAnanth-MSFT

Having a VNET with a Gateway (any gateway, both VPN or ExpressRoute) and peering other VNETs with "Enable Gateway Transit" creates a Hub- Spoke architecture.

I tried this one but ExR GW didn't work and the Spoke Vnets were unable to communicate with each other. However, when I deleted the ExR GW and deployed VPN one (with same setup routes etc.) that started working.

Is there something which we need to care about specially while working to get Hub- Spoke with ExR GW?
KapilAnanth-MSFT 39,211 Reputation points Microsoft Employee

2024-01-04T14:07:30.5666667+00:00
@Apurva Pathak

By default,

Spoke to Spoke communication will not work even if you have VPN Gateway in the Hub VNET.

This is to be expected.

If you say you are able to achieve Spoke-to-Spoke communication,

This means you are using a UDR and pointing the next Hop as VNET Gateway in the UDR.

Which you have not mentioned in the verbatim.

Can you please confirm this is the case?

While the above may work for VPN Gateway,

It won't work for an ExR Gateway

And this is not recommended as this affects latency and throughput of the VPN Gateway.

Cheers,

Kapil
Apurva Pathak 360 Reputation points

2024-01-04T15:41:28.8433333+00:00

@KapilAnanth-MSFT

Yes, same UDRs, peerings, UDRs etc. were working for VPN GW and not for ExR GW. UDRs were pointing to VPNGateway in both the cases.

Thanks
KapilAnanth-MSFT 39,211 Reputation points Microsoft Employee

2024-01-04T16:06:37.13+00:00

@Apurva Pathak

Thanks for confirming that you have UDRs pointing towards VNET Gateway in Spoke Subnets.

I can confirm you Spoke to Spoke connectivity will not work if the gateway is of type ExR Gateway even if you have UDR pointing to VNET Gateway.

I shall summarize my comments and post it as a new answer.

I would highly appreciate if you could Accept the answer and close this thread

Original posters help the community find answers faster by identifying the correct answer.

Thanks,

Kapil
Apurva Pathak 360 Reputation points

2024-01-04T17:06:30.1233333+00:00

@KapilAnanth-MSFT

Thanks for the help!

Could you please help me why is so? Any reference doc will be highly appreciated.

Accepted answer

KapilAnanth-MSFT 39,211 Reputation points Microsoft Employee

2024-01-04T16:10:53.27+00:00
@Apurva Pathak

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you would like to configure ExpressRoute Gateway and achieve Spoke-to-Spoke connectivity.

I am afraid this is not a supported scenario with ExR Gateway.

While this can work with VPN Gateway, this is not recommended as well.

Instead, you should use an NVA such as Azure Firewall only.

See : Communication through an NVA

As you can see, our docs only specify the use of VPN Gateway and not ExpressRoute Gateway.

Kindly let us know if this helps or you need further assistance on this issue.

Thanks,

Kapil

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.
Please sign in to rate this answer.

1 person found this answer helpful.
Apurva Pathak 360 Reputation points

2024-01-05T08:38:03.8166667+00:00

@KapilAnanth-MSFT

Thanks for the help, Kapil!

Could you please help me understand why ExR Gateway doesn't support Spoke-to-Spoke connectivity? if I want to implement this what are the ways to do so, do I need to deploy a full-fledged ExR connection.

Cheers!

KapilAnanth-MSFT 39,211 Reputation points Microsoft Employee

2024-01-05T10:53:13.4+00:00

Hi @Apurva Pathak ,

Wrt,

"why ExR Gateway doesn't support Spoke-to-Spoke connectivity?"

This is by design.

As you can see, our docs only specify the use of VPN Gateway and not ExpressRoute Gateway.

Communication through an NVA

"if I want to implement this what are the ways to do so, do I need to deploy a full-fledged ExR connection."

Unfortunately, no.

You have to deploy an NVA such as Azure Firewall on the Hub VNET to make this work.

See : Using Azure Firewall as a Network Virtual Appliance (NVA)

Hope this helps.

Cheers,

Kapil
Sign in to comment

1 additional answer

Andreas Baumgarten 101.5K Reputation points MVP

2023-12-25T09:41:40.9133333+00:00

Hi @Apurva Pathak ,

what exactly doesn't work with the ExpressRoute?

Is the ExpressRoute active and just the routing doesn't work as expected? Or is there any issue with connecting the ExpressRoute?

Maybe this is helpful: Verify ExpressRoute connectivity

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards Andreas Baumgarten
Please sign in to rate this answer.
Apurva Pathak 360 Reputation points

2023-12-25T10:03:08.09+00:00

Thanks for the suggestion @Andreas Baumgarten

I am looking for a doc which can help me to setup hup- spoke with Expreeroute Virtual Network gateway.

Thanks in advance!

Andreas Baumgarten 101.5K Reputation points MVP

2023-12-25T11:26:32.4066667+00:00

Hi @Apurva Pathak ,

I haven't found a dedicated how-to for hub-spoke network topology and ExpressRoute.

But there are some resources that might be helpful. Basically you can replace the "VPN Gateway" with "ExpressRoute Virtual Network gateway".

Tutorial: Create a secured hub and spoke network

Hub-spoke network topology in Azure

Hub and Spoke, Azure Firewall and ExpressRoute

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards

Andreas Baumgarten

Apurva Pathak 360 Reputation points

2023-12-25T14:02:05.82+00:00

Hi @Andreas Baumgarten ,

I did try that, I deployed a VNG of type ExR but that was not working (I couldn't figure out why) then I deleted that (tried searching for some to way the change type to VPN from ExR but didn't any) and created a new with type VPN and that worked.

Most of YouTube tutorials or MS docs are only related to VNG type VPN and not ExR.

Apurva Pathak 360 Reputation points

2023-12-26T19:32:42.54+00:00

Hi @Andreas Baumgarten ,

Just to add, I did not have created an ExR Connection (a full fledge ExR setup), I just deployed an ExR Virtual Network Gateway and tried to setup Hub- Spoke topology.

Andreas Baumgarten 101.5K Reputation points MVP

2023-12-26T19:51:05.0866667+00:00

Hi @Apurva Pathak ,

without a full deployed Azure ExpressRoute it's not really possible to do a full test.

At least I can't see how to test the connection between on-premises network and Azure hub-spoke network infrastructure.

What's not working exactly in your ExpressRoute-Hub-Spoke infrastrukture?

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards

Andreas Baumgarten

Apurva Pathak 360 Reputation points

2023-12-27T09:59:11.5533333+00:00

I deployed 3 Vnets in Azure and deployed ExR GW in the Hub. This was not working however when I tried with type VPN same setup worked.
Sign in to comment

Share via

Hub Spoke topology with Virtual Network Gateway of type ExpressRoute

1 additional answer