Hub & Spoke with Azure Firewall - Integrating External Businesses

Hello @Son ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

If I had to summarize your query, it would be something like below:
You have an ExpressRoute connection from your on-premises to Azure where you have a hub-spoke model and are advertising a default route to block free internet access from all spokes and are filtering that traffic at your on-premises firewall. However, you have another site which is not connected via ExpressRoute and would most likely use a site-to-site VPN for connectivity to it's Azure spoke but you do not want the return traffic to be affected by the advertised default route (where all traffic goes back to your on-premises).
Please correct me, if my understanding is wrong.

If my understanding is correct, then the only thing you need to do is use 0.0.0.0/0 UDRs on the S2S connected spokes for directing the Internet traffic.
When outbound traffic is sent from a subnet, Azure selects a route based on the destination IP address, using the longest prefix match algorithm. If multiple routes contain the same address prefix, Azure selects the route type, based on the following priority:
User-defined route > BGP route > System route
User-defined routes are higher priority than BGP & default routes.
Refer : https://video2.skills-academy.com/en-us/azure/virtual-network/virtual-networks-udr-overview#how-azure-selects-a-route

Regards,
Gita

Hi Gita,

Thanks for your response and yes, your understanding is correct!

This is where I get confused regarding the UDRs and routing the traffic out to the internet directly from the S2S connected spoke. I would like to send that traffic out via our Azure Firewall also, so the way we would route the traffic (correct me if I am wrong) is the following:

Create a new route table and bundle in the S2S spoke subnets

Assign a UDR of 0.0.0.0/0 and have the next hop as virtual appliance and then address of the Azure Firewall RFC1918 IP address

This is where I having a knowledge gap I think, how do I route the traffic received from that spoke directly out the Azure firewall without affecting the other traffic that should route to the internet using Express Route through our on-premises firewalls? The Azure firewall is configured in the hub but as far as I can see there is no UDR configured to direct traffic back to the Express Route so it must be using the BGP default route advertised into Azure from our WAN provider that is making that work. If I configured the UDR route for the S2S spoke to say "Next hop type = Internet" then I am assuming the egress traffic would not route via the Azure Firewall or would it?

Many Thanks

Hello @Son ,

Yes, to send the Internet traffic out via your Azure Firewall, you need to:
Create a new route table and associate it to the S2S spoke subnets.
Add a UDR of 0.0.0.0/0 and have the next hop as virtual appliance and the address of the Azure Firewall RFC1918 IP address.

Regarding your Azure Firewall, could you please confirm if forced tunneling is enabled on it?
Refer : https://video2.skills-academy.com/en-us/azure/firewall/forced-tunneling
If yes, then you can't undo the configuration and all your traffic which reaches the Azure Firewall will be forced to your ExpressRoute.

Now coming to your last question, if you configure the UDR route for the S2S spoke to say "Next hop type = Internet" then yes, the egress traffic would not route via the Azure Firewall and will directly go to Internet.

Regards,
Gita

Hi Gita,

For some reason I cannot see where forced-tunnelling has been configured to confirm but I checked over the design documents and we indeed had that as a design requirement. We also have the AzureFirewallManagementSubnet which I believe is only needed in that scenario.

So basically, if we wanted to connected another business into the environment with a S2S VPN they would have to route the traffic to the internet down our ExpressRoute if we wanted them using the same Azure Firewall.

If we as a business decided not to use forced-tunnelling and allowed traffic to egress to the internet from the Azure Firewall directly would we have to rebuild the firewall without that setting enabled?

Many Thanks

Hello @Son ,

Yes, if you want to connect another business into the environment with a S2S VPN they would have to route the traffic to the internet down your ExpressRoute, if you want to use the same Azure Firewall.

If you decide not to use forced-tunneling and allow traffic to egress to the internet from the Azure Firewall directly, then you will have to rebuild the firewall without the forced tunneling setting enabled along with below changes:

Azure Firewall must have direct Internet connectivity. If your AzureFirewallSubnet learns a default route to your on-premises network via BGP, you must override this with a 0.0.0.0/0 UDR with the NextHopType value set as Internet to maintain direct Internet connectivity or stop advertising the default route from on-prem. Post this you can filter the outbound traffic within the Azure Firewall according to your needs by configuring network rules.
Refer : https://video2.skills-academy.com/en-us/azure/firewall/firewall-faq#is-forced-tunneling-chaining-to-a-network-virtual-appliance-supported

Regards,
Gita