Question

Your company deploys an Azure Firewall inside a Virtual WAN secured hub using Firewall Manager. The security team requires that all internet-bound traffic from the firewall itself be forced-tunneled through an on-premises appliance over ExpressRoute for centralized egress inspection. During design, you discover this requirement cannot be met with the current architecture. What is the correct explanation?

Accepted Answer

Forced tunneling of Azure Firewall traffic is not supported when the firewall is deployed in a Virtual WAN secured hub; forced tunneling requires a firewall deployed in a standard (customer-managed) VNet with an AzureFirewallManagementSubnet.

Answer

Forced tunneling is only available on the Basic SKU, so you must downgrade the secured hub firewall to Basic to enable it.

Answer

Forced tunneling requires enabling a 0.0.0.0/0 route in the hub routing intent, which the secured hub blocks by default and cannot be overridden.

Answer

Forced tunneling of the secured hub firewall works only if the hub also hosts a third-party NVA, so you must add one to the hub first.