Question

Your company uses a hub-and-spoke topology in a single Azure region. The hub VNet contains an Azure VPN gateway that connects to your on-premises datacenter. Two spoke VNets (Spoke1 and Spoke2) are each peered to the hub VNet. Currently, resources in Spoke1 and Spoke2 cannot reach the on-premises network. You must allow VMs in both spoke VNets to communicate with on-premises servers while minimizing cost and administrative effort. What should you do?

Accepted Answer

On the hub-to-spoke peerings, enable 'Allow gateway transit', and on the spoke-to-hub peerings, enable 'Use remote gateways'.

Answer

Deploy a separate VPN gateway in each spoke VNet and create new site-to-site connections to on-premises.

Answer

Create a direct VNet peering between Spoke1 and Spoke2 so traffic can transit to the hub gateway.

Answer

Configure a user-defined route in each spoke that points to the hub gateway's public IP address as the next hop.