Azure Digital WAN now helps full mesh safe hub connectivity | Azure Weblog

In Might 2023, we introduced the overall availability of Routing intent and routing insurance policies for all Digital WAN prospects. This characteristic is powered by the Digital WAN routing infrastructure and permits Azure Firewall prospects to arrange insurance policies for personal and web site visitors. We’re additionally extending the identical routing capabilities to all Firewall options deployed inside Azure Virtual WAN together with Community Digital Home equipment and software-as-a-service (SaaS) options that present Firewall capabilities.

Routing Intent additionally completes two secured hub use instances whereby customers can safe site visitors between Digital WAN hubs in addition to examine site visitors between totally different on-premises (department/ExpressRoute/SD-WAN) that transits by Digital WAN hubs.

Azure Digital WAN (vWAN), networking-as-a-service, brings networking, safety, and routing functionalities collectively to simplify networking in Azure. With ease of use and ease in-built, vWAN is a one-stop store to attach, defend, route site visitors, and monitor your broad space community.

On this weblog, we’ll first describe routing intent use instances, product experiences, and summarize with some further issues and sources for utilizing routing intent with Digital WAN.

Use instances for Digital WAN

You should utilize Routing Intent to engineer site visitors inside Digital WAN in a number of methods. Listed here are the primary use instances:

Apply routing insurance policies for Digital Networks and on-premises

Clients implementing hub-and-spoke community architectures with massive numbers of routes typically discover their networks onerous to know, preserve, and troubleshoot. In Digital WAN, these routes could be simplified for site visitors between Azure Digital Networks and on-premises (ExpressRoute, VPN, and SD-WAN).

Digital WAN makes this simpler for patrons by permitting prospects to configure easy and declarative non-public routing insurance policies. It’s assumed that non-public routing insurance policies might be utilized for all Azure Digital Networks and on-premises networks related to Digital WAN. Additional customizations for Digital Community and on-premises prefixes are presently not supported. Non-public routing insurance policies instruct Digital WAN to program the underlying Digital WAN routing infrastructure to allow transit between two totally different on-premises (1) through a safety answer deployed within the Digital Hub. It additionally permits site visitors transiting between two Azure Digital Networks (2) or between an Azure Digital Community and an on-premises endpoint (3) through a safety answer deployed within the Digital Hub. The identical site visitors use instances are supported for Azure Firewall, Community Digital Home equipment, and software-as-a-service options deployed within the hub.

Apply routing insurance policies for web site visitors

Digital WAN enables you to arrange routing insurance policies for web site visitors to be able to promote a default (0.0.0.0/0) path to your Azure Digital Networks and on-premises. Web site visitors routing configurations help you configure Azure Digital Networks and on-premises networks to ship web outbound site visitors (1) to safety home equipment within the hub. You too can leverage Vacation spot-Community Handle Translation (DNAT) options of your safety equipment if you wish to present exterior customers entry to purposes in an Azure Digital Community or on-premises (2).

Apply routing insurance policies for inter-hub cross-region site visitors

Digital WAN mechanically deploys all Digital Hubs throughout your Digital WAN in a full mesh, offering zero-touch any-to-any connectivity region-to-region and hub-to-hub utilizing the Microsoft international spine. Routing insurance policies program Digital WAN to examine inter-hub and inter-region site visitors between two Azure Digital Networks (1), between two on-premises (2), and between Azure Digital Networks and on-premises (3) related to totally different hubs. Each packet coming into or leaving the hub is routed to the safety answer deployed within the Digital Hub earlier than being routed to its remaining vacation spot.

Consumer expertise for routing intent

To make use of routing intent, navigate to your Digital WAN hub. Below Routing, choose Routing Intent and routing insurance policies.

Configure an Web or Non-public Routing Coverage to ship site visitors to a safety answer deployed within the hub by choosing the following hop kind (Azure Firewall, Community Digital Equipment, or SaaS answer) and corresponding subsequent hop useful resource.

Azure Firewall prospects can even configure routing intent utilizing Azure Firewall Supervisor by enabling the ‘inter-hub’ setting.

After configuring routing intent, you’ll be able to view the efficient routes of the safety answer by navigating to your Digital Hub, then choose Routing, and click on Efficient Routes. The efficient routes of the safety answer present further visibility to troubleshoot how Digital WAN routes site visitors that has been inspected by the Digital hub’s safety answer.

Earlier than you get began with this characteristic, listed here are some key issues:

1. The characteristic caters to customers that take into account Digital Community and on-premises site visitors as non-public site visitors. Digital WAN applies non-public routing insurance policies to all Digital Networks and on-premises site visitors.
2. Routing intent is mutually unique with customized routing and static routes within the ‘defaultRouteTable’ pointing to Community Digital Equipment (NVA) deployed in a Digital Community spoke related to Digital WAN. In consequence, use instances the place customers are utilizing customized route tables or NVA-in-spoke use instances usually are not relevant.
3. Routing Intent advertises prefixes akin to all connections to Digital WAN in direction of on-premises networks. Customers could use Route Maps to summarize and combination routes and filter primarily based on outlined match circumstances.

Study extra about Azure Digital WAN

We look ahead to persevering with to construct out Azure Digital WAN and including extra capabilities sooner or later. We encourage you to check out the Routing Intent characteristic in Azure Digital WAN and look ahead to listening to extra about your experiences to include your suggestions into the product.