Question

Your company uses a hub-and-spoke topology. The hub VNet contains an Azure Firewall (private IP 10.0.1.4). Spoke1 (10.1.0.0/16) and Spoke2 (10.2.0.0/16) are each peered to the hub but not directly peered to each other. Security policy requires that all traffic between Spoke1 and Spoke2 be inspected by the Azure Firewall. Peering is already configured to allow forwarded traffic. What must you configure to enforce this inspection?

Accepted Answer

Create a user-defined route in each spoke subnet that sends the other spoke's address range to the firewall's private IP (10.0.1.4) as the next hop of type Virtual appliance.

Answer

Enable 'Use remote gateways' on both spoke peerings so traffic routes through the hub gateway.

Answer

Create a direct VNet peering between Spoke1 and Spoke2 and enable gateway transit.

Answer

Add a service endpoint for Microsoft.Network in each spoke subnet pointing to the hub VNet.