Virtual Network Gateway

[ramakrishnanv]

Hi There, 

I wanted to setup a Express route gateway and VPN on my Virtual Network gateway. I have Hub and Spoke model, where I create one subnet "GatewaySubnet" on hub vnet, Can I able to create two Virtual gateway one for Express route and another for S2S VPN for 3rd Party partners / Supporting vendors / B2B and so on. Any reference link much appreciated. 

As far I understand, generally  Virtual Network gateway would be use either one for On-prem connectivity or VPN as fall back. But in this scenario 

Express Route for ---> On-prem Connectivity 

VPN for ---> 3rd party S2S VPN. 

[#2]

This page explains how to configure an ExpressRoute and S2S VPN alongside each other. Does that help?
https://docs.microsoft.com/en-us/azure/expressroute/expressroute-howto-coexist-resource-manager

[#3]

@Chris Bradshaw 

Thanks for your response. 

Basically we wanted to achieve as shown in below:

With out forcing the traffic to PAFW I can successfully establish the tunnel. Spoke to Spoke communication also working as expected. But I wanted force the traffic PA first then pass on to VPNGW in order to establish the tunnel. Similarly from outbound after VPN lands on VPNGW it should be pass thru PAFW. 

[#4]

@ramakrishnanv 

Have you implemented any User-defined routes here? I would suggest that your spoke subnets might need a default route where the next hop is the Virtual Appliance address of the firewall. The firewall in turn would then have a next hop of the VPN connection:

Some details on User Defined Routes here: https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview

[#5]

Yes Chris,
Placed the UDR with default route done at the spoke. Found the issue. there should be another route in the NVA(PAFW) has to be in place which pointing to Gatewaysubnet default gateway IP(in our case 10.0.0.1 < subnet 1st ip>) , so that traffic would be pick up by VPN gateway in order to encrypt and send them over to internet. Thanks for your response.