Enable Inter-Hub traffic Azure Virtual WAN through Azure Firewall (Manual)

Since Azure WAN came out I’ve configured multiple Azure Virtual WAN environments. But since september 2023 it is now possible to automatically assign firewall routes to all your VPN tunnels. By default traffic from 1 VPN tunnel to another VPN tunnel will bypass the firewall. With this new Inter-hub option you can force VPN traffic to always be routed to the Azure Firewall. So lets set it up.

image 52

Before we continue, please keep in mind the following considerations:

  • Make sure to have proper firewall rules in place to keep the traffic flowing for VPN to VPN traffic.
  • You cannot have custom/static routes in your Azure WAN. Use custom route tables instead where really necessary.
  • Make sure that Firewall diagnostic settings have been configured to monitor denied traffic using Log Analytics Workspace.
  • During the change, VPN traffic might get interrupted multiple times for a few seconds.

For this manual I’ve created a test environment with 2 virtual WAN’s in 2 different subscriptions and a default Azure VPN Gateway in a third subscription. In your Virtual WAN go Hubs, and click on your Hub. In my case demo

image 33

From the Hub go to Azure Firewall and Firewall manager, click again on your Hub name.

image 34

From the new blade go to security Configuration

image 30

From the drop down menu at Inter-Hub select Enabled

image 31

When ready, click on Save. Please keep in mind that custom/static routes will be removed. Make sure to use custom route tables instead on networks where absolutely necessary.

image 40

When I performed the change I lost 2 ping’s over my VPN connections (activation takes around 10-15 minutes), which might be normal behavior for VPN traffic

image 41

After the change has been implemented, you can now review your Firewall log to verify traffic is passing your Azure Firewall.

image 42

More information on the Microsoft website:

How to configure Virtual WAN Hub routing policies – Azure Virtual WAN | Microsoft Learn

Add a Comment

Your email address will not be published. Required fields are marked *