You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/virtual-network/virtual-network-routing-appliance-overview.md
+35Lines changed: 35 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -37,6 +37,37 @@ Key characteristics:
37
37
- You host a routing appliance in a dedicated subnet named `VirtualNetworkApplianceSubnet`.
38
38
- A routing appliance forwards traffic in the data path.
39
39
40
+
## Common routing patterns (hub and spoke)
41
+
42
+
Most deployments use a virtual network routing appliance in a hub virtual network to provide scalable spoke-to-spoke (east-west) transit. Common patterns include:
43
+
44
+
### Pattern 1: Route Azure private address space to the appliance
45
+
46
+
Use UDRs on spoke subnets to route your Azure private address space (for example, RFC1918) to the routing appliance, while routing internet egress and on-premises prefixes to other next hops as appropriate.
47
+
48
+
This pattern is useful when:
49
+
- You want the routing appliance to carry east-west traffic, but not become the default next hop for all traffic.
50
+
- You already have an established egress design (for example, Azure Firewall or NAT Gateway) that you don’t want to change.
51
+
52
+
### Pattern 2: Default-route spokes to the appliance (simplified spoke UDRs)
53
+
54
+
Use a 0.0.0.0/0 UDR on spoke subnets with the routing appliance as the next hop, and then route on-premises and internet traffic from the hub according to your architecture.
55
+
56
+
This pattern is useful when:
57
+
- You want “cookie cutter” spoke route tables (simpler to operate at scale).
58
+
- You want to avoid maintaining many per-prefix UDR entries in spokes.
59
+
60
+
> [!IMPORTANT]
61
+
> Review the limitations section carefully before using a default route to the appliance, especially for Azure Private Link / Private Endpoint traffic.
Use RFC1918 routes to the routing appliance to handle spoke-to-spoke and private transit, and send 0.0.0.0/0 to your chosen egress solution.
66
+
67
+
This pattern is useful when:
68
+
- You want predictable east-west routing via the appliance.
69
+
- You want to keep internet egress flows pinned to your egress solution and reduce the risk of asymmetric routing through a firewall.
70
+
40
71
## Benefits
41
72
42
73
### High throughput and maximum connections
@@ -96,6 +127,10 @@ The preview is free. We'll provide advance notice before billing is enabled.
96
127
97
128
## Registration
98
129
130
+
> [!NOTE]
131
+
> Bandwidth and scaling behavior in preview are subject to change. If you need to change the configured bandwidth after deployment, you will need to redeploy the resource.
132
+
133
+
## How to request support and provide feedback
99
134
After you submit your Azure Feature Exposure Control (AFEC) registration for `Microsoft.network/AllowVirtualNetworkAppliance`, finish the preview [sign-up form](https://forms.office.com/r/kqEKRr5mpB).
0 commit comments