You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/virtual-network/virtual-network-routing-appliance-overview.md
+34Lines changed: 34 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -39,6 +39,37 @@ Key characteristics:
39
39
- Dedicated subnet: You host the appliance in a dedicated subnet named "VirtualNetworkApplianceSubnet."
40
40
- In the data path: The appliance forwards traffic (data path).
41
41
42
+
## Common routing patterns (hub and spoke)
43
+
44
+
Most deployments use virtual network routing appliance in a hub virtual network to provide scalable spoke-to-spoke (east-west) transit. Common patterns include:
45
+
46
+
### Pattern 1: Route Azure private address space to the appliance
47
+
48
+
Use UDRs on spoke subnets to route your Azure private address space (for example, RFC1918) to the routing appliance, while routing internet egress and on-premises prefixes to other next hops as appropriate.
49
+
50
+
This pattern is useful when:
51
+
- You want the routing appliance to carry east-west traffic, but not become the default next hop for all traffic.
52
+
- You already have an established egress design (for example, Azure Firewall or NAT Gateway) that you don’t want to change.
53
+
54
+
### Pattern 2: Default-route spokes to the appliance (simplified spoke UDRs)
55
+
56
+
Use a 0.0.0.0/0 UDR on spoke subnets with the routing appliance as the next hop, and then route on-premises and internet traffic from the hub according to your architecture.
57
+
58
+
This pattern is useful when:
59
+
- You want “cookie cutter” spoke route tables (simpler to operate at scale).
60
+
- You want to avoid maintaining many per-prefix UDR entries in spokes.
61
+
62
+
> [!IMPORTANT]
63
+
> Review the limitations section carefully before using a default route to the appliance, especially for Azure Private Link / Private Endpoint traffic.
Use RFC1918 routes to the routing appliance to handle spoke-to-spoke and private transit, and send 0.0.0.0/0 to your chosen egress solution.
68
+
69
+
This pattern is useful when:
70
+
- You want predictable east-west routing via the appliance.
71
+
- You want to keep internet egress flows pinned to your egress solution and reduce the risk of asymmetric routing through a firewall.
72
+
42
73
## Benefits
43
74
44
75
### High throughput and low latency forwarding layer
@@ -91,6 +122,9 @@ During the public preview, virtual network routing appliance is available in a l
91
122
92
123
- During preview, client tools such as Azure CLI, PowerShell, and Terraform aren't supported.
93
124
125
+
> [!NOTE]
126
+
> Bandwidth and scaling behavior in preview are subject to change. If you need to change the configured bandwidth after deployment, you will need to redeploy the resource.
0 commit comments