question

SHIMIZUTAKAHIRO-0306 avatar image
0 Votes"
SHIMIZUTAKAHIRO-0306 asked GitaraniSharmaMSFT-4262 commented

How to set up a multi-spoke virtual network in Azure Firewall

Can you tell us how to configure multiple-spoke virtual networks in Azure Firewall when you adopt a hub-spoke network topology in Azure?

azure-firewall
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

SHIMIZUTAKAHIRO-0306 avatar image
0 Votes"
SHIMIZUTAKAHIRO-0306 answered

Hello @GitaraniSharmaMSFT-4262 ,

Thank you very much.
The information in the answer was helpful. It was also helpful for the link guidance.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

GitaraniSharmaMSFT-4262 avatar image
2 Votes"
GitaraniSharmaMSFT-4262 answered GitaraniSharmaMSFT-4262 commented

Hello @SHIMIZUTAKAHIRO-0306 ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

In order to setup a Hub and Spoke architecture with an Azure Firewall, you will have to:

  1. Deploy the Azure Firewall in the Hub subnet.

  2. Peer the Hub and Spoke Vnets.

  3. Create User Defined Routes (UDRs) on the spoke subnets that points to the Azure Firewall IP address as the default gateway.

If you have a site to site connection using VPN gateway between Azure and your on-premises and need the traffic to go through Azure Firewall, then for the spokes to use the hub gateway to communicate with remote networks, you must create a UDR on the hub gateway subnet pointing to the firewall IP address as the next hop and configure the below options in the Hub-spoke Vnet peering:
- Configure the peering connection in the hub to allow gateway transit.
- Configure the peering connection in each spoke to use remote gateways.
- Configure all peering connections to allow forwarded traffic.

Here are a few docs of Hub and Spoke architectures with Azure Firewall for your reference :

https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/hub-spoke?tabs=cli
https://docs.microsoft.com/en-us/azure/firewall/tutorial-hybrid-ps
https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/hub-spoke-network-topology

Kindly let us know if the above helps or you need further assistance on this issue.


Please "Accept the answer" below if the information helped you. This will help us and others in the community as well.

· 5
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hi, @GitaraniSharmaMSFT-4262 Does Azure Firewall works across different subscription?

0 Votes 0 ·

Hello @EnterpriseArchitect ,

Yes, Azure Firewall works across different subscriptions.

You can deploy Azure Firewall on any virtual network, but customers typically deploy it on a central virtual network and peer other virtual networks to it in a hub-and-spoke model. You can then set the default route from the peered virtual networks to point to this central firewall virtual network. The advantage of this model is the ability to centrally exert control on multiple spoke VNETs across different subscriptions. There are also cost savings as you don't need to deploy a firewall in each VNet separately.

Refer : https://docs.microsoft.com/en-us/azure/firewall/firewall-faq#what-is-the-typical-deployment-model-for-azure-firewall

Regards,
Gita

0 Votes 0 ·
EnterpriseArchitect avatar image EnterpriseArchitect GitaraniSharmaMSFT-4262 ·

That's great, thanks, Gita.

1 Vote 1 ·
EnterpriseArchitect avatar image EnterpriseArchitect GitaraniSharmaMSFT-4262 ·

Hi @GitaraniSharmaMSFT-4262 Does the Azure Firewall is required or can be deployed when the Web Application or Kubernetes/Containerized apps is deployed behind Azure Application Gateway (WAF - Web Application Firewall) ?

0 Votes 0 ·
Show more comments