Question

Your company deploys an Azure Virtual WAN with two secured virtual hubs, each containing an Azure Firewall. Several spoke VNets are connected to each hub, and the hubs are connected to each other through the Virtual WAN backbone. Security requires that ALL traffic between spoke VNets (both within the same hub and across hubs) be inspected by Azure Firewall. You want to enforce this with the least ongoing administrative effort and without manually maintaining route tables on every spoke. What should you configure?

Accepted Answer

Enable a routing intent policy with a private traffic route on each secured hub, pointing to the hub's Azure Firewall.

Answer

Create custom route tables in each hub and associate spokes to them, adding static routes for every other spoke's address prefix pointing to the firewall private IP.

Answer

Deploy user-defined routes on each spoke VNet subnet with a 0.0.0.0/0 next hop set to the Azure Firewall in the local hub.

Answer

Configure BGP peering between the Azure Firewalls in both hubs and advertise spoke prefixes to force inter-hub inspection.