SOLVED

about routes

%3CLINGO-SUB%20id%3D%22lingo-sub-3290175%22%20slang%3D%22en-US%22%3Eabout%20routes%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3290175%22%20slang%3D%22en-US%22%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHello%20Community%2C%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20have%20this%20architecture%20HUB%20and%20Spoke%20with%20Forced%20Tunneling%20applicated.%26nbsp%3B%3C%2FP%3E%3CP%3EI%20need%20your%20propositon%20for%20the%20routes%20tables%20and%20the%20routes%20for%20every%20part.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22hamma91_0-1650459906408.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F365508i5C9A174F0522599E%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22hamma91_0-1650459906408.png%22%20alt%3D%22hamma91_0-1650459906408.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3302219%22%20slang%3D%22en-US%22%3ERe%3A%20Routes%20Tables%20and%20routes%20for%20Hub%20and%20Spokes%20with%20Forced%20Tunneling%20applicated%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3302219%22%20slang%3D%22en-US%22%3EHello%3CBR%20%2F%3E%3CBR%20%2F%3EYes%20it%20seems%20correct%20!%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3295450%22%20slang%3D%22en-US%22%3ERe%3A%20Routes%20Tables%20and%20routes%20for%20Hub%20and%20Spokes%20with%20Forced%20Tunneling%20applicated%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3295450%22%20slang%3D%22en-US%22%3EFor%20the%20peering%2C%20i%20use%20this%20code%20%2C%20can%20you%20confirm%20for%20me%20please%20%3A%3CBR%20%2F%3E%3CBR%20%2F%3E1-%20For%20HUB%20TO%20SPOKE%20%3A%3CBR%20%2F%3Eresource%20%22azurerm_virtual_network_peering%22%20%22peering-Hub-SPOKE%22%20%7B%3CBR%20%2F%3Ename%20%3Dxxxxx%3CBR%20%2F%3Eresource_group_name%20%3D%20xxxx%3CBR%20%2F%3Evirtual_network_name%20%3D%20xxxxx%3CBR%20%2F%3Eremote_virtual_network_id%20%3D%20xxxx%3CBR%20%2F%3Eallow_gateway_transit%20%3D%20true%3CBR%20%2F%3Eallow_forwarded_traffic%20%3D%20true%3CBR%20%2F%3Eallow_virtual_network_access%20%3D%20true%3CBR%20%2F%3Euse_remote_gateways%20%3D%20false%3CBR%20%2F%3E%7D%3CBR%20%2F%3E%3CBR%20%2F%3E2-%20For%20SPOKE%20to%20HUB%20%3A%3CBR%20%2F%3Eresource%20%22azurerm_virtual_network_peering%22%20%22peering-SPOKE-HUB%22%20%7B%3CBR%20%2F%3Ename%20%3D%20xxxxx%3CBR%20%2F%3Eresource_group_name%20%3D%20xxxxx%3CBR%20%2F%3Evirtual_network_name%20%3D%20xxxxxx%3CBR%20%2F%3Eremote_virtual_network_id%20%3D%20xxxxx%3CBR%20%2F%3Eallow_virtual_network_access%20%3D%20true%3CBR%20%2F%3Eallow_forwarded_traffic%20%3D%20true%3CBR%20%2F%3Eallow_gateway_transit%20%3D%20false%3CBR%20%2F%3Euse_remote_gateways%20%3D%20true%3CBR%20%2F%3E%7D%3CBR%20%2F%3E%3CBR%20%2F%3EThank%20you%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3295119%22%20slang%3D%22en-US%22%3ERe%3A%20Routes%20Tables%20and%20routes%20for%20Hub%20and%20Spokes%20with%20Forced%20Tunneling%20applicated%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3295119%22%20slang%3D%22en-US%22%3EHello%20yes%20correct%20!%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3295104%22%20slang%3D%22en-US%22%3ERe%3A%20Routes%20Tables%20and%20routes%20for%20Hub%20and%20Spokes%20with%20Forced%20Tunneling%20applicated%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3295104%22%20slang%3D%22en-US%22%3E%3CP%3EHello%20Ibrahima%2C%3CBR%20%2F%3EThank%20you%20for%20your%20reply%20and%20assistance.%3CBR%20%2F%3E1-Can%20you%20confirme%20that%20for%20the%20%3A%3CBR%20%2F%3E%3CBR%20%2F%3E**%20Route%20table%20attached%20to%20gateway%20subnet%20(%20disable_bgp_route_propagation%20%3D%20true)%3CBR%20%2F%3E**%20All%20Route%20tables%20for%20the%20spokes%20(%20disable_bgp_route_propagation%20%3D%20false)%3CBR%20%2F%3E2-%20You%20use%20the%20address%20space%26nbsp%3B%26nbsp%3B%3CSPAN%3E%2F16%20and%20not%20the%20subnet%20%2F24%20for%20every%20spoke%20in%20the%20routes%20%3F%20Just%20to%20confirm%20that.%26nbsp%3B%3C%2FSPAN%3E%3CBR%20%2F%3EThanks%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3294714%22%20slang%3D%22en-US%22%3ERe%3A%20Routes%20Tables%20and%20routes%20for%20Hub%20and%20Spokes%20with%20Forced%20Tunneling%20applicated%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3294714%22%20slang%3D%22en-US%22%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHi%20Ensure%20that%20you%20have%20the%20proper%20peering%20enabled%3CBR%20%2F%3Ehub-to-spoke%20A%20with%20gateway%20transit%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3Bspoke%20A-tohub%26nbsp%3B%20%3A%20Default%20%2B%26nbsp%3BUse%20this%20virtual%20network's%20gateway%20or%20Route%20Server%3C%2FP%3E%3CP%3E%3CBR%20%2F%3Ehub-to-spoke%20B%20with%20gateway%20transit%26nbsp%3B%20%26nbsp%3B%20%26nbsp%3B%3C%2FP%3E%3CP%3Espoke%20B-tohub%26nbsp%3B%20%3A%20Default%26nbsp%3B%26nbsp%3BUse%20this%20virtual%20network's%20gateway%20or%20Route%20Server%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIf%20you%20want%20the%20incoming%20traffic%20(from%20the%20gateway%20)%20to%20be%20filtered%20by%20the%20firewall%20attach%20a%20route%20table%20to%20the%20gateway%20subnet%20with%20the%20routes%26nbsp%3B%26nbsp%3B%3C%2FP%3E%3CP%3EAdress%20Prefix%2010.1.0.0%2F16%3CBR%20%2F%3ENext%20Hop%20Type%20%3A%20Virtual%20Appliance%3CBR%20%2F%3ENext%20Hop%20IP%20address%20%3A%20Firewall%20private%20IP%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAdress%20Prefix%2010.2.0.0%2F16%3CBR%20%2F%3ENext%20Hop%20Type%20%3A%20Virtual%20Appliance%3CBR%20%2F%3ENext%20Hop%20IP%20address%20%3A%20Firewall%20private%20IP%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EEnsure%20also%26nbsp%3B%20%26nbsp%3Bthat%20proper%20routes%20are%20present%20in%26nbsp%3B%20spoke%20route%20tables%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ERoute%20Table%20associated%20to%20Subnet%20Spoke%20A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAdress%20Prefix%2010.0.0.0%2F16%3CBR%20%2F%3ENext%20Hop%20Type%20%3A%20Virtual%20Appliance%3CBR%20%2F%3ENext%20Hop%20IP%20address%20%3A%20Firewall%20private%20IP%3C%2FP%3E%3CP%3E%3CBR%20%2F%3EAdress%20Prefix%2010.1.0.0%2F16%3CBR%20%2F%3ENext%20Hop%20Type%20%3A%20Virtual%20Appliance%3CBR%20%2F%3ENext%20Hop%20IP%20address%20%3A%20Firewall%20private%20IP%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAdress%20Prefix%26nbsp%3B%20192.168.0.0%2F24%3CBR%20%2F%3ENext%20Hop%20Type%20%3A%20Virtual%20Appliance%3CBR%20%2F%3ENext%20Hop%20IP%20address%20%3A%20Firewall%20private%20IP%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAdress%20Prefix%200.0.0.0%2F0%3CBR%20%2F%3ENext%20Hop%20Type%20%3A%20Virtual%20Network%20Gateway%26nbsp%3B%20(forced%20tunelling)%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ERoute%20Table%20associated%20to%20Subnet%20Spoke%20B%3C%2FP%3E%3CP%3EAdress%20Prefix%200.0.0.0%2F0%3CBR%20%2F%3ENext%20Hop%20Type%20%3A%26nbsp%3BVirtual%20Network%20Gateway%26nbsp%3B%20%26nbsp%3B(forced%20tunneling)%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAdress%20Prefix%2010.2.0.0%2F16%3CBR%20%2F%3ENext%20Hop%20Type%20%3A%20Virtual%20Appliance%3CBR%20%2F%3ENext%20Hop%20IP%20address%20%3A%20Firewall%20privat%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAdress%20Prefix%26nbsp%3B%20192.168.0.0%2F24%3CBR%20%2F%3ENext%20Hop%20Type%20%3A%20Virtual%20Appliance%3CBR%20%2F%3ENext%20Hop%20IP%20address%20%3A%20Firewall%20private%20IP%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ERead%20the%20full%20doc%20for%20forced%20tunneling%20if%20needed%26nbsp%3B%20%26nbsp%3B%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Ffr-fr%2Fazure%2Fvpn-gateway%2Fvpn-gateway-forced-tunneling-rm%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Ffr-fr%2Fazure%2Fvpn-gateway%2Fvpn-gateway-forced-tunneling-rm%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Contributor

 

Hello Community, 

 

I have this architecture HUB and Spoke with Forced Tunneling applicated. 

I need your propositon for the routes tables and the routes for every part. 

 

Thanks

hamma91_0-1650459906408.png

 

5 Replies
best response confirmed by hamma91 (Contributor)
Solution

 

 

Hi Ensure that you have the proper peering enabled
hub-to-spoke A with gateway transit     

 spoke A-tohub  : Default + Use this virtual network's gateway or Route Server


hub-to-spoke B with gateway transit     

spoke B-tohub  : Default  Use this virtual network's gateway or Route Server

 

If you want the incoming traffic (from the gateway ) to be filtered by the firewall attach a route table to the gateway subnet with the routes  

Adress Prefix 10.1.0.0/16
Next Hop Type : Virtual Appliance
Next Hop IP address : Firewall private IP

 

Adress Prefix 10.2.0.0/16
Next Hop Type : Virtual Appliance
Next Hop IP address : Firewall private IP

 

 

Ensure also   that proper routes are present in  spoke route tables

 

Route Table associated to Subnet Spoke A

 

Adress Prefix 10.0.0.0/16
Next Hop Type : Virtual Appliance
Next Hop IP address : Firewall private IP


Adress Prefix 10.1.0.0/16
Next Hop Type : Virtual Appliance
Next Hop IP address : Firewall private IP

 

Adress Prefix  192.168.0.0/24
Next Hop Type : Virtual Appliance
Next Hop IP address : Firewall private IP

 

Adress Prefix 0.0.0.0/0
Next Hop Type : Virtual Network Gateway  (forced tunelling) 

 

Route Table associated to Subnet Spoke B

Adress Prefix 0.0.0.0/0
Next Hop Type : Virtual Network Gateway   (forced tunneling)

 

Adress Prefix 10.2.0.0/16
Next Hop Type : Virtual Appliance
Next Hop IP address : Firewall privat

 

Adress Prefix  192.168.0.0/24
Next Hop Type : Virtual Appliance
Next Hop IP address : Firewall private IP

 

Read the full doc for forced tunneling if needed   : https://docs.microsoft.com/fr-fr/azure/vpn-gateway/vpn-gateway-forced-tunneling-rm

 

Hello Ibrahima,
Thank you for your reply and assistance.
1-Can you confirme that for the :

** Route table attached to gateway subnet ( disable_bgp_route_propagation = true)
** All Route tables for the spokes ( disable_bgp_route_propagation = false)
2- You use the address space  /16 and not the subnet /24 for every spoke in the routes ? Just to confirm that. 
Thanks

For the peering, i use this code , can you confirm for me please :

1- For HUB TO SPOKE :
resource "azurerm_virtual_network_peering" "peering-Hub-SPOKE" {
name =xxxxx
resource_group_name = xxxx
virtual_network_name = xxxxx
remote_virtual_network_id = xxxx
allow_gateway_transit = true
allow_forwarded_traffic = true
allow_virtual_network_access = true
use_remote_gateways = false
}

2- For SPOKE to HUB :
resource "azurerm_virtual_network_peering" "peering-SPOKE-HUB" {
name = xxxxx
resource_group_name = xxxxx
virtual_network_name = xxxxxx
remote_virtual_network_id = xxxxx
allow_virtual_network_access = true
allow_forwarded_traffic = true
allow_gateway_transit = false
use_remote_gateways = true
}

Thank you