Azure Express route forced-tunneling with NVA-CodePudding

I want to set-up forced tunneling in Azure. All traffic destined to internet should be routed to on-prem and exit to internet from there.

As far as i understand i need to advertise default route via BGP in Azure so that it replaces internet default route and send everything to on-prem via Express route.
Then i make UDRs 0.0.0.0/0 next hop to NVA Cisco firewall on all subnets in Azure.

All traffic from Azure subnets will go to NVA and from there it will be routed to on-prem or to another vNET.

Question is what about the traffic coming from on-prem to Azure ? I want that traffic to also go through NVA cisco firewall. How could it be done as gateway subnet do not support 0.0.0.0/0 UDRs with Express route setup.

CodePudding user response：

Your initial understanding of the setup is correct. You will have to advertise a default route of 0.0.0.0/0 via BGP from your on-premises to Azure, so that all your Azure traffic is sent to your on-premises via the ExpressRoute. And in order to filter all that traffic by an NVA, you can add a UDR with 0.0.0.0/0 on all the subnets (except the NVA subnet) with next hop as your Cisco Firewall NVA.

This setup will take care of the routing from Azure to on-premises which will go as below: All subnets --> Cisco NVA --> ExpressRoute gateway --> On-premises.

Now coming back to your question on what about the return traffic, yes GatewaySubnet do not support 0.0.0.0/0 UDRs but it supports UDRs with other address prefixes.

Hence, you can add a UDR to the ExpressRoute GatewaySubnet with the address prefix of your Vnet range with next hop type Virtual Appliance and IP address of your Cisco NVA. This will make sure that any traffic that comes from your on-premises for your Azure Vnet range, when reaches your ExpressRoute gateway will be forwarded to the Cisco NVA.

For example : If your Vnet address range is 10.0.0.0/16 then you can add a UDR to your ExpressRoute GatewaySubnet as below: Address prefix : 10.0.0.0/16 --> Next hop = Virtual Appliance --> Next hop = IP address of Cisco NVA So the routing from On-premises to Azure will go as below: On-premises --> ExpressRoute gateway --> Cisco NVA --> All subnets.