Question

A company is designing a hub-and-spoke network topology in Azure. Multiple spoke virtual networks host workloads that must reach a shared set of on-premises resources through an ExpressRoute circuit, and spokes must also be able to communicate with each other. The design must minimize the number of gateways deployed and route all inter-spoke and on-premises traffic through a central point where a network virtual appliance (NVA) inspects the traffic. Which combination should you recommend?

Accepted Answer

Deploy an ExpressRoute gateway in the hub, enable gateway transit on the hub peering and use-remote-gateways on the spoke peerings, and configure user-defined routes on the spoke subnets pointing to the NVA in the hub.

Answer

Deploy an ExpressRoute gateway in each spoke, enable global VNet peering between all spokes, and rely on BGP route propagation to steer traffic through the NVA.

Answer

Deploy an ExpressRoute gateway in the hub, enable gateway transit, and rely on default system routes so spoke-to-spoke and on-premises traffic automatically traverses the NVA.

Answer

Deploy a VPN gateway in the hub instead of ExpressRoute gateway, enable gateway transit, and use service endpoints on the spoke subnets to force traffic through the NVA.