Express Route and Azure Firewall

MDavis 26 Reputation points
2022-05-23T14:06:36.88+00:00

We have express route to on-prem and it is working fine. We are in the process of implementing Az Firewall but are having trouble getting the routing right. I know you cannot add routes to the Express Route subnet so how do we force traffic that arrives over Express Route to the Azure Firewall?

Azure Firewall
Azure Firewall
An Azure network security service that is used to protect Azure Virtual Network resources.
594 questions
Azure ExpressRoute
Azure ExpressRoute
An Azure service that provides private connections between Azure datacenters and infrastructure, either on premises or in a colocation environment.
339 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. GitaraniSharma-MSFT 49,001 Reputation points Microsoft Employee
    2022-05-24T05:17:09.687+00:00

    Hello @MDavis ,

    Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

    I understand that you have a working ExpressRoute connection between Azure and your on-premises and are in the process of deploying Azure Firewall which should inspect the to and fro traffic between Azure and on-premises. Please correct me if my understanding is incorrect.

    For Azure to On-premise traffic:

    To filter all the traffic going out of Azure by the firewall, you can add a UDR with 0.0.0.0/0 on all the subnets (except the Firewall subnet) with next hop as your Azure Firewall.
    This setup will take care of the routing from Azure to on-prem which will go as below:
    All subnets --> Azure firewall --> ExpressRoute gateway --> On-premises.

    NOTE : Azure Firewall must have direct Internet connectivity. If your AzureFirewallSubnet learns a default route to your on-premises network via BGP, you must override this with a 0.0.0.0/0 UDR with the NextHopType value set as Internet to maintain direct Internet connectivity or stop advertising the default route from on-prem. Post this you can filter the outbound traffic within the Azure Firewall according to your needs by configuring network rules.
    Refer : https://video2.skills-academy.com/en-us/azure/firewall/firewall-faq#is-forced-tunneling-chaining-to-a-network-virtual-appliance-supported

    For return On-premise to Azure traffic:

    GatewaySubnet do not support 0.0.0.0/0 UDRs but it supports UDRs with other address prefixes.
    Hence, you can add a UDR to the ExpressRoute GatewaySubnet with the address prefix of your Vnet range with next hop type Virtual Appliance and IP address of your Azure firewall. This will make sure that any traffic that comes from your on-premises for your Azure Vnet range, when reaches your ExpressRoute gateway will be forwarded to the firewall for scanning.

    NOTE : Propagate gateway routes should be set to "Enabled" on the GatewaySubnet to ensure availability of the gateway and to propagate your on-premises routes to the network interfaces in the subnet.

    For example : If your Vnet address range is 10.0.0.0/16 then you can add a UDR to your ExpressRoute GatewaySubnet as below:
    Address prefix : 10.0.0.0/16 --> Next hop = Virtual Appliance --> Next hop = IP address of Azure Firewall

    So the routing from On-prem to Azure will go as below:
    On-premises --> ExpressRoute gateway --> Azure firewall --> All subnets.

    Kindly let us know if the above helps or you need further assistance on this issue.

    ----------------------------------------------------------------------------------------------------------------

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

    4 people found this answer helpful.
  2. risolis 8,701 Reputation points
    2022-05-23T15:20:18.28+00:00

    Hello @MDavis

    Thank you for your post.

    I would say to use UDR as well as BGP.... If you want more info please refer yourself to the next documentation below:

    https://video2.skills-academy.com/en-us/azure/virtual-network/virtual-networks-udr-overview

    https://video2.skills-academy.com/en-us/azure/expressroute/expressroute-routing#advertising-default-routes

    Best Regards,

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.