about routes

[hamma91]

Hello Community, 

I have this architecture HUB and Spoke with Forced Tunneling applicated. 

I need your propositon for the routes tables and the routes for every part. 

Thanks

[#2 · Accepted solution]

Hi Ensure that you have the proper peering enabled
hub-to-spoke A with gateway transit     

 spoke A-tohub  : Default + Use this virtual network's gateway or Route Server

hub-to-spoke B with gateway transit     

spoke B-tohub  : Default  Use this virtual network's gateway or Route Server

If you want the incoming traffic (from the gateway ) to be filtered by the firewall attach a route table to the gateway subnet with the routes  

Adress Prefix 10.1.0.0/16
Next Hop Type : Virtual Appliance
Next Hop IP address : Firewall private IP

Adress Prefix 10.2.0.0/16
Next Hop Type : Virtual Appliance
Next Hop IP address : Firewall private IP

Ensure also   that proper routes are present in  spoke route tables

Route Table associated to Subnet Spoke A

Adress Prefix 10.0.0.0/16
Next Hop Type : Virtual Appliance
Next Hop IP address : Firewall private IP

Adress Prefix 10.1.0.0/16
Next Hop Type : Virtual Appliance
Next Hop IP address : Firewall private IP

Adress Prefix  192.168.0.0/24
Next Hop Type : Virtual Appliance
Next Hop IP address : Firewall private IP

Adress Prefix 0.0.0.0/0
Next Hop Type : Virtual Network Gateway  (forced tunelling) 

Route Table associated to Subnet Spoke B

Adress Prefix 0.0.0.0/0
Next Hop Type : Virtual Network Gateway   (forced tunneling)

Adress Prefix 10.2.0.0/16
Next Hop Type : Virtual Appliance
Next Hop IP address : Firewall privat

Adress Prefix  192.168.0.0/24
Next Hop Type : Virtual Appliance
Next Hop IP address : Firewall private IP

Read the full doc for forced tunneling if needed   : https://docs.microsoft.com/fr-fr/azure/vpn-gateway/vpn-gateway-forced-tunneling-rm

[#3]

Hello Ibrahima,
Thank you for your reply and assistance.
1-Can you confirme that for the :

** Route table attached to gateway subnet ( disable_bgp_route_propagation = true)
** All Route tables for the spokes ( disable_bgp_route_propagation = false)
2- You use the address space  /16 and not the subnet /24 for every spoke in the routes ? Just to confirm that. 
Thanks

[#4]

Hello yes correct !

[#5]

For the peering, i use this code , can you confirm for me please :

1- For HUB TO SPOKE :
resource "azurerm_virtual_network_peering" "peering-Hub-SPOKE" {
name =xxxxx
resource_group_name = xxxx
virtual_network_name = xxxxx
remote_virtual_network_id = xxxx
allow_gateway_transit = true
allow_forwarded_traffic = true
allow_virtual_network_access = true
use_remote_gateways = false
}

2- For SPOKE to HUB :
resource "azurerm_virtual_network_peering" "peering-SPOKE-HUB" {
name = xxxxx
resource_group_name = xxxxx
virtual_network_name = xxxxxx
remote_virtual_network_id = xxxxx
allow_virtual_network_access = true
allow_forwarded_traffic = true
allow_gateway_transit = false
use_remote_gateways = true
}

Thank you

[#6]

Hello

Yes it seems correct !