Question

Your company deploys an Azure Virtual WAN with a single secured virtual hub. The hub contains an integrated Azure Firewall. Two spoke VNets are connected to the hub, and a site-to-site VPN connects an on-premises branch. Security policy requires that all traffic between the two spokes, between spokes and the branch, and to the internet be inspected by the Azure Firewall. You must configure this with the least administrative effort and without manually authoring per-VNet route tables. What should you configure on the virtual hub?

Accepted Answer

Enable routing intent with a private traffic policy and an internet traffic policy pointing to the Azure Firewall

Answer

Create a custom route table in the hub and associate all spoke connections to it with static routes to the firewall private IP

Answer

Deploy user-defined routes in each spoke VNet with the next hop set to the Azure Firewall private IP

Answer

Enable branch-to-branch routing and rely on BGP to advertise the firewall as the next hop