Skip to content

Commit c0def70

Browse files
Merge pull request #128199 from simonpainter/update/network-virtual-appliance-docs
Added some additional information that I found during testing.
2 parents b866a42 + 9892b8e commit c0def70

1 file changed

Lines changed: 35 additions & 0 deletions

File tree

articles/virtual-network/virtual-network-routing-appliance-overview.md

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,37 @@ Key characteristics:
3737
- You host a routing appliance in a dedicated subnet named `VirtualNetworkApplianceSubnet`.
3838
- A routing appliance forwards traffic in the data path.
3939

40+
## Common routing patterns (hub and spoke)
41+
42+
Most deployments use a virtual network routing appliance in a hub virtual network to provide scalable spoke-to-spoke (east-west) transit. Common patterns include:
43+
44+
### Pattern 1: Route Azure private address space to the appliance
45+
46+
Use UDRs on spoke subnets to route your Azure private address space (for example, RFC1918) to the routing appliance, while routing internet egress and on-premises prefixes to other next hops as appropriate.
47+
48+
This pattern is useful when:
49+
- You want the routing appliance to carry east-west traffic, but not become the default next hop for all traffic.
50+
- You already have an established egress design (for example, Azure Firewall or NAT Gateway) that you don’t want to change.
51+
52+
### Pattern 2: Default-route spokes to the appliance (simplified spoke UDRs)
53+
54+
Use a 0.0.0.0/0 UDR on spoke subnets with the routing appliance as the next hop, and then route on-premises and internet traffic from the hub according to your architecture.
55+
56+
This pattern is useful when:
57+
- You want “cookie cutter” spoke route tables (simpler to operate at scale).
58+
- You want to avoid maintaining many per-prefix UDR entries in spokes.
59+
60+
> [!IMPORTANT]
61+
> Review the limitations section carefully before using a default route to the appliance, especially for Azure Private Link / Private Endpoint traffic.
62+
63+
### Pattern 3: RFC1918-to-appliance, default-to-egress
64+
65+
Use RFC1918 routes to the routing appliance to handle spoke-to-spoke and private transit, and send 0.0.0.0/0 to your chosen egress solution.
66+
67+
This pattern is useful when:
68+
- You want predictable east-west routing via the appliance.
69+
- You want to keep internet egress flows pinned to your egress solution and reduce the risk of asymmetric routing through a firewall.
70+
4071
## Benefits
4172

4273
### High throughput and maximum connections
@@ -96,6 +127,10 @@ The preview is free. We'll provide advance notice before billing is enabled.
96127

97128
## Registration
98129

130+
> [!NOTE]
131+
> Bandwidth and scaling behavior in preview are subject to change. If you need to change the configured bandwidth after deployment, you will need to redeploy the resource.
132+
133+
## How to request support and provide feedback
99134
After you submit your Azure Feature Exposure Control (AFEC) registration for `Microsoft.network/AllowVirtualNetworkAppliance`, finish the preview [sign-up form](https://forms.office.com/r/kqEKRr5mpB).
100135

101136
## Support

0 commit comments

Comments
 (0)