Virtual Networks Route Table ARM Templates

This document provides guidance on using Azure Resource Manager (ARM) templates to deploy and manage route tables for Azure Virtual Networks. Route tables allow you to control the flow of network traffic within your virtual network and to and from external networks.

Introduction to Route Tables

In Azure Virtual Networks (VNet), network traffic is, by default, routed between subnets and to and from the internet. Route tables enable you to define custom routes to override this default behavior. This is particularly useful for scenarios such as:

• Forcing traffic through a network virtual appliance (NVA) like a firewall or intrusion detection system.
• Directing traffic to an ExpressRoute circuit or a VPN Gateway.
• Implementing complex routing topologies.

Understanding Route Table Components

An Azure route table is composed of the following key components:

• Routes: These are the individual entries that define how traffic is handled. Each route specifies:
  • Address prefix: The destination IP address range for the route (e.g., 0.0.0.0/0 for all internet-bound traffic).
  • Next hop type: The type of hop where the traffic should be sent. Common types include:
    • VirtualAppliance: For directing traffic to a network virtual appliance.
    • VirtualNetworkGateway: For directing traffic to a VPN gateway.
    • VnetLocal: For traffic destined for the VNet.
    • Internet: For internet-bound traffic.
    • None: For dropping traffic.
  • Next hop IP address: The IP address of the next hop when the Next hop type is VirtualAppliance.
• Subnets: A route table is associated with one or more subnets within a VNet. All traffic originating from or destined to these associated subnets will be subject to the routes defined in the route table.

Deploying Route Tables with ARM Templates

ARM templates provide a declarative way to define your Azure infrastructure. Below is a sample ARM template snippet for deploying a route table with a custom route.

Sample ARM Template

{
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "routeTableName": {
            "type": "string",
            "defaultValue": "myRouteTable",
            "metadata": {
                "description": "Name of the route table."
            }
        },
        "location": {
            "type": "string",
            "defaultValue": "[resourceGroup().location]",
            "metadata": {
                "description": "Location for the route table."
            }
        },
        "subnetName": {
            "type": "string",
            "metadata": {
                "description": "Name of the subnet to associate with the route table."
            }
        },
        "vnetName": {
            "type": "string",
            "metadata": {
                "description": "Name of the virtual network."
            }
        },
        "nextHopIpAddress": {
            "type": "string",
            "metadata": {
                "description": "IP address of the next hop (e.g., for a firewall)."
            }
        }
    },
    "resources": [
        {
            "type": "Microsoft.Network/routeTables",
            "apiVersion": "2020-11-01",
            "name": "[parameters('routeTableName')]",
            "location": "[parameters('location')]",
            "properties": {
                "routes": [
                    {
                        "name": "ToFirewall",
                        "properties": {
                            "addressPrefix": "0.0.0.0/0",
                            "nextHopType": "VirtualAppliance",
                            "nextHopIpAddress": "[parameters('nextHopIpAddress')]"
                        }
                    }
                ]
            }
        },
        {
            "type": "Microsoft.Network/virtualNetworks/subnets",
            "apiVersion": "2020-11-01",
            "name": "[concat(parameters('vnetName'), '/', parameters('subnetName'))]",
            "dependsOn": [
                "[resourceId('Microsoft.Network/routeTables', parameters('routeTableName'))]"
            ],
            "properties": {
                "addressPrefix": "10.0.1.0/24",
                "routeTable": {
                    "id": "[resourceId('Microsoft.Network/routeTables', parameters('routeTableName'))]"
                }
            }
        }
    ],
    "outputs": {
        "routeTableId": {
            "type": "string",
            "value": "[resourceId('Microsoft.Network/routeTables', parameters('routeTableName'))]"
        }
    }
}
                

Scenarios and Best Practices

Forcing Internet Traffic Through a Firewall

A common use case is to direct all outbound internet traffic from your subnets through a firewall deployed as a network virtual appliance. This is achieved by adding a route with an address prefix of 0.0.0.0/0 and a next hop type of VirtualAppliance, pointing to the private IP address of your firewall.

Using System Routes vs. User-Defined Routes

Azure provides system routes for default traffic flow. User-defined routes (UDRs) in route tables override these system routes. If a UDR exists for a specific destination, it takes precedence. If no UDR matches, Azure's system routes are applied.

Route Table Association Limit

A single route table can be associated with multiple subnets. However, each subnet can only be associated with one route table at a time. If you need different routing policies for subnets within the same VNet, you will need multiple route tables.

Troubleshooting Routing Issues

When encountering routing problems, consider the following:

• Effective Routes: Use the "Effective Routes" feature in the Azure portal for a specific VM's network interface to see the combined set of routes applied to that interface, including system and UDRs.
• Connection Troubleshoot: The "Connection Troubleshoot" tool can help diagnose connectivity issues between two VMs or between a VM and an endpoint.
• Network Watcher: Azure Network Watcher provides tools like IP flow verify and packet capture that can be invaluable for diagnosing complex routing problems.

Conclusion

Route tables are a powerful feature for controlling network traffic flow in Azure Virtual Networks. By leveraging ARM templates, you can automate the deployment and management of these critical networking components, ensuring consistent and reliable network configurations across your Azure environment.