Greetings,
I'm having quite some issues trying to perfectly understand how Policy-based and Route-based VPNs work.
As we can se in the Azure documentation, for Policy-based VPNs, its important to keep the Traffic Selectors in sync in the Azure VPN and in the differents "On Prem VPN endpoints". Any changes to the architecture must be reflected in the Traffic Selectors of both ends of any connection in order to keep the traffic flowing.
But in the case of Route-based VPNs, what we do instead is we put a big star "*" in the Traffic Selectors of both ends the the connections, so there is no need to change them no more, even if the architecture changes, and we rely on the Route Tables the "configuration" of the VPN. These Route Tables will now be in charge of routing the traffic in&out our VNet1.
So far, so good. But now, questions start to pop.
- What happens to the Route Tables in the Policy-based VPN's? Is there any need to update them if there are any changes in the architecture of any side of the VPN?
- How do we know where to route a package through a VPN if the only place where the routes are stored is in the Route Tables? Is a new line is added automatically to the Route Table, transparently to us, so the traffic is properly routed via the VPN link? Or in case a package doesn't find a destination in the Route Tables, the package is sent to check Traffic Selectors that might be declared in the Subnet??
Thank you in advance. This questions have been troubling my mind for a few days already and I'm having quite some trouble to find the answers online.
Yours sincerely,
Jorge