0

I have a requirement to build out a networking solution that will have several site-to-site (S2S) VPNs and a point-2-site VPN (P2S). Ideally, we want each service provider/VPN to have its own set of infrastructure - dedicated Virtual Network Gateway as per the diagram: enter image description here

I am unable to get traffic to flow to/from on-prem to spokes 4 & 5.

I have built some test VMs in various segments which can communicate. For example:

  • Spoke 1 > hub > Spoke 4 + 5. ✅
  • On-prem > Spoke 1 + 2 + 3. ✅

I can see from the logs that the UDRs are pushing traffic through the firewall.

If I understand the documentation correctly I should be able to achieve this with the currently deployed infrastructure.

If you require connectivity between spokes, consider deploying an Azure Firewall or other network virtual appliance.

All the examples I can find show the VNG in the hub network (for example) - which means it will be shared across service providers.

I also see other examples where there is a vnet-to-vnet VNG (VPN gateway) (for example) between the hub and spoke. Microsoft say:

You can also use a VPN gateway to route traffic between spokes, although this choice will impact latency and throughput.

I am beginning to think the planned design is not possible. Must I have:

  1. Shared VNG in the hub
  2. vnet-to-vnet VNG in spokes and hub
  3. 1 + 2
  4. Design is possible, therefore route/firewall rules are wrong.

T.I.A

woter324
  • 233
  • 1
  • 3
  • 10
  • I have found: https://stackoverflow.com/questions/69578195/azure-multiple-s2s-vpn-gateways-with-hub-and-spoke-architecture, but the OPs architecture is slightly different. – woter324 Aug 11 '22 at 16:49
  • I would suggest to use network watcher to do some troubleshooting: https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-troubleshoot-overview. I don't see an inbound network flow to spoke 4 and 5, how did you have that setup? I only see a VNET peering. I also doubt that in a service provider scenario an vnet peering is a good solution, ideally you want to isolate you customers as much as possible. – Ace Aug 25 '22 at 05:16
  • @woter324 Did you get this to work? I'm looking into designing the same solution, was it doable without using VirtualWAN? – mastrboy Mar 11 '23 at 12:04

0 Answers0