Azure 使用 NVA 的快速路由强制隧道

Question

I want to set-up forced tunneling in Azure. All traffic destined to inte.net should be routed to on-prem and exit to inte.net from there.

• As far as i understand i need to advertise default route via BGP in Azure so that it replaces inte.net default route and send everything to on-prem via Express route.
• Then i make UDRs 0.0.0.0/0 next hop to NVA Cisco firewall on all su.nets in Azure.

All traffic from Azure su.nets will go to NVA and from there it will be routed to on-prem or to another .NET.

Question is what about the traffic coming from on-prem to Azure? I want that traffic to also go through NVA cisco firewall. How could it be done as gateway su.net do not support 0.0.0.0/0 UDRs with Express route setup.

Answer 1

Your initial understanding of the setup is correct. You will have to advertise a default route of 0.0.0.0/0 via BGP from your on-premises to Azure, so that all your Azure traffic is sent to your on-premises via the ExpressRoute. And in order to filter all that traffic by an NVA, you can add a UDR with 0.0.0.0/0 on all the su.nets (except the NVA su.net) with next hop as your Cisco Firewall NVA.

This setup will take care of the routing from Azure to on-premises which will go as below: All su.nets --> Cisco NVA --> ExpressRoute gateway --> On-premises.

Now coming back to your question on what about the return traffic, yes GatewaySu.net do not support 0.0.0.0/0 UDRs but it supports UDRs with other address prefixes.

Hence, you can add a UDR to the ExpressRoute GatewaySu.net with the address prefix of your .net range with next hop type Virtual Appliance and IP address of your Cisco NVA. This will make sure that any traffic that comes from your on-premises for your Azure .net range, when reaches your ExpressRoute gateway will be forwarded to the Cisco NVA.

For example: If your .net address range is 10.0.0.0/16 then you can add a UDR to your ExpressRoute GatewaySu.net as below: Address prefix: 10.0.0.0/16 --> Next hop = Virtual Appliance --> Next hop = IP address of Cisco NVA So the routing from On-premises to Azure will go as below: On-premises --> ExpressRoute gateway --> Cisco NVA --> All su.nets.