Contoso deploys a third-party SD-WAN network virtual appliance (NVA) in a hub VNet to connect to branch offices. The NVA learns branch routes dynamically and must propagate them to all VMs in the hub VNet and in spoke VNets, without administrators manually maintaining user-defined routes. The solution must avoid enabling IP forwarding-based static routing wherever possible. Which Azure service should you deploy in the hub VNet to meet these requirements?