How to Configure VNET Peering with the CloudGen Firewall

If you have multiple virtual networks in the same Azure region, you can connect them with a high bandwidth, low-latency connection via virtual network peering. Create a hub and spoke architecture with all spoke VNETs peered to a central VNET containing the CloudGen Firewall VMs. The subnets in the spoke VNETs are associated with an Azure route table using the firewall VM in the central VNET as the next hop device. In this way, all traffic passes through the firewall, thereby allowing you to centrally apply security policies. Using the firewall as the next hop device also allows you to forward traffic between VNETs that are not directly peered with each other. The route table using the firewalls as nexthop routes must be associated with at least one (backend) subnet in the central hub, otherwise the routes will not be rewritten. The hub can contain not only the firewalls, but also additional backend subnets for services shared by all spoke VNETs. By default, you can create up to 10 VNET peerings per virtual network. Contact Microsoft Azure support to increase this limit to up to 50 peerings.

Open

• The virtual networks must be in the same Azure region.

• The virtual networks must use the same Azure subscription.

• The networks of the hub VNET and the spoke VNETs may not overlap.

• The Azure route table must be associated with at least one (backend) subnet in the hub VNET for the routes to be updated.

• All virtual networks must use the Azure Resource Manger deployment mode.

• Deploy a high availability firewall cluster. This virtual network is used as the hub. For more information, see High Availability in Azure.

• Configure Cloud Integration for the firewall cluster. For more information, see Cloud Integration for Azure.

• Create an Azure route table and user defined routes (UDR). For more information, see How to Configure Azure Route Tables (UDR) using Azure Portal and ARM.

Create the virtual networks that will be peered to the central virtual network.

1. Go to the Azure Portal: https://portal.azure.com.

2. In the upper left corner, click NEW. 

3. In the NEW blade, click Networking. 

4. In the Networking blade, click Virtual network.
   

5. In the Virtual network blade, select Resource Manager from the deployment model drop-down list. 

6. Click Create. 
   

   
   

7.   In the Create virtual network blade, enter:
   

   • Name – Enter a unique name for the virtual network.

   • Address space – Use either a large network not overlapping with the other virtual networks, or your on-premises networks.

   • Subnet name – Enter a name for the first subnet in the virtual network.

   • Subnet address range – Enter the network for the subnet. It must be a subnet of the network entered as the address space.

   • Subscription – Select the Azure subscription.

   • Resource Group – Click Select Existing and select the resource group the hub virtual network is in.

   • Location – Select the location the other virtual networks are in.

8. Click Create.

You now have at least two virtual networks in the same resource group. The route table created for the CloudGen Firewall HA cluster must also be in the same resource group.

Create the VNET peering between the hub virtual network and the spoke virtual networks. This will initialize, but not yet connect, the VNET peering. Create a VNET peering for every spoke VNET:

1. Go to the Azure Portal: https://portal.azure.com.

2. Select the resource group containing the virtual networks.

3. Select the Hub VNET.
   

4. In the left menu of the virtual network blade, select Peerings.

5. Click Add to add a new peering relationship.
   

6. In the Add peering blade, enter the peering settings:

   • Name – Enter a name. 

   • Peer details – Select Resource manager.

   • Subscription – Select the Azure subscription.

   • Virtual network – Click and select the spoke VNET you want to peer with. 

   • Allow virtual network access – Select Enabled to allow access to the virtual network. 

   • Allow forward traffic – Enable to allow virtual machines to forward traffic 

7. Click OK.

Repeat this process for every spoke VNET. The VNET Peering Status in the Virtual network blade is now Initiated.

Open

Create the VNET peering between the spoke virtual networks and the hub virtual networks. This will change the peering state to Connected from Initialized. Repeat this step for every spoke VNET.

1. Go to the Azure Portal: https://portal.azure.com.

2. Select the resource group containing the virtual networks.

3. Select a spoke VNET.
   

4. In the left menu of the virtual network blade select Peerings and click Add.
   

5. In the Add peering blade, enter the peering settings:

   • Name – Enter a name. 

   • Peer details – Select Resource manager.

   • Subscription – Select the Azure subscription.

   • Virtual network – Click and select the hub VNET.

   • Allow virtual network access – Select Enabled to allow access to the virtual network. 

   • Allow forward traffic – Enable to allow virtual machines to forward traffic 

6. Click OK.