Question

A company uses a hub-and-spoke topology in Azure. The hub virtual network contains an ExpressRoute gateway that provides connectivity to the on-premises datacenter. Two spoke virtual networks (Spoke-A and Spoke-B) are each peered with the hub. Users report that on-premises servers cannot reach resources in the spokes, and the spokes cannot reach each other. Which combination of configuration changes should you recommend to enable connectivity with minimal administrative overhead?

Accepted Answer

On the hub-to-spoke peerings enable 'Allow gateway transit', and on the spoke-to-hub peerings enable 'Use remote gateways'; for spoke-to-spoke traffic route through the hub using a network virtual appliance or Azure Firewall with user-defined routes.

Answer

Deploy a separate ExpressRoute gateway in each spoke virtual network and create direct peerings between Spoke-A and Spoke-B.

Answer

Enable 'Allow forwarded traffic' on all peerings, which automatically makes VNet peering transitive across the hub.

Answer

Replace the VNet peerings with VNet-to-VNet VPN connections between the hub and each spoke, and between Spoke-A and Spoke-B.