Virtual WAN Configuration

This document provides a comprehensive guide to configuring Azure Virtual WAN, covering essential steps and best practices to establish a robust and scalable cloud networking solution.

Core Components of Virtual WAN Configuration

Configuring Azure Virtual WAN involves setting up several key components to achieve your desired network topology. These include:

1. Virtual WAN Resource

The Virtual WAN resource itself serves as the top-level management object for your Virtual WAN implementation. When you create a Virtual WAN, you define its name, region, and resource group.

• Name: A unique identifier for your Virtual WAN.
• Region: The Azure region where the Virtual WAN resource will be deployed.
• Resource Group: The resource group to which the Virtual WAN resource belongs.

2. Virtual Hub

A virtual hub is a managed virtual network in Azure that acts as a connectivity hub for your Virtual WAN. It is the central point of connectivity for spokes, VPNs, and ExpressRoute circuits.

• Hub Name: A unique name for your virtual hub.
• Region: The Azure region for the virtual hub. This should typically be the same as or close to the regions of your connected resources.
• Address Space: A private IP address space for the virtual hub. This space must not overlap with any address spaces of connected VNets.
• Hub Routing Preference: Determines how traffic is routed within the hub. Options include 'ExpressRoute' or 'VPN'.

3. Virtual Hub Routing

Effective routing is critical for Virtual WAN. You'll configure routing within the virtual hub to manage traffic flow between connected sites, VNets, and the internet.

• Hub to VNet Connection: Configure connections between your virtual hub and spoke virtual networks. This enables communication between resources in these networks.
• Hub to Site Connection: Configure connections for VPN sites (site-to-site VPNs) and ExpressRoute circuits.
• Route Tables: Virtual hubs use route tables to manage routing. You can associate connections with specific route tables to control traffic propagation.
• Route Propagation: Routes from connected VNets and sites are propagated to the hub's route tables, and vice versa.

4. Connectivity Configurations

This section details how to establish and manage the actual connections:

a. VPN Site-to-Site Connectivity

Connect your on-premises networks to Azure Virtual WAN using VPN gateways.

1. Create a VPN Site: Define your on-premises VPN device's public IP address, BGP peer IP address (if applicable), and address space.
2. Configure VPN Connection: Establish the VPN connection from the virtual hub to the VPN site. This involves selecting the desired VPN gateway SKU and configuring IPsec/IKE policies.
3. BGP Peering: If your on-premises VPN device supports BGP, configure BGP peering between the virtual hub's VPN gateway and your on-premises BGP peer for dynamic route exchange.

b. ExpressRoute Connectivity

Integrate your existing ExpressRoute circuits with Azure Virtual WAN.

1. Provision ExpressRoute Circuit: Ensure you have a provisioned ExpressRoute circuit with a dedicated circuit connection.
2. Configure ExpressRoute Gateway: Create and configure an ExpressRoute gateway in your virtual hub.
3. Create ExpressRoute Circuit Connection: Establish a connection resource within your virtual hub that links to your ExpressRoute circuit.

c. VNet Peering

Connect your Azure virtual networks (spokes) to the virtual hub.

1. Create VNet Connection: In the virtual hub, create a VNet connection that points to your spoke virtual network.
2. Enable Gateway Transit: For spokes that need to reach other spokes, on-premises sites, or the internet via the hub, enable gateway transit on the VNet connection.
3. Disable Gateway and Use Remote Gateway: Ensure that the spoke VNet's gateway (if it has one) is disabled or set to 'Use Remote Gateway' to avoid conflicts and ensure traffic flows through the hub.

5. Network Virtual Appliances (NVAs)

Virtual WAN supports the deployment and integration of Network Virtual Appliances (like firewalls or WAN optimization devices) within the virtual hub for advanced traffic inspection and control.

• NVA Deployment: Deploy your NVA instances in a dedicated spoke VNet.
• Hub Routing Configuration: Configure the virtual hub's routing to steer traffic through the NVA for inspection before it reaches its destination. This often involves creating user-defined routes (UDRs) in the hub.

Azure CLI Examples

Here are some common Azure CLI commands for Virtual WAN configuration:

Next Steps

Once you have configured the core components, you can proceed with deploying and managing your Virtual WAN environment. Refer to the following sections for further details: