Merge pull request #247363 from cherylmc/vpnforced

updates

Author: v-regandowner

articles/vpn-gateway/TOC.yml

@@ -43,7 +43,7 @@
     href: vpn-gateway-about-point-to-site-routing.md
   - name: About NAT and VPN Gateway
     href: nat-overview.md
-  - name: About site-to-site forced and split tunneling
+  - name: About site-to-site forced tunneling
     href: about-site-to-site-tunneling.md
   - name: About zone-redundant gateways for Availability Zones
     href: about-zone-redundant-vnet-gateways.md
@@ -225,7 +225,7 @@
         href: bgp-how-to-cli.md
     - name: BGP diagnostics
       href: bgp-diagnostics.md
-    - name: Configure site-to-site forced and split tunneling
+    - name: Configure site-to-site forced tunneling
       href: site-to-site-tunneling.md
     - name: Configure gateway transit for VNet peering
       href: vpn-gateway-peering-gateway-transit.md

articles/vpn-gateway/about-site-to-site-tunneling.md

@@ -1,23 +1,23 @@
 ---
-title: 'About forced tunneling and split tunneling'
-description: Learn about forced tunneling and split tunneling for VPN Gateway site-to-site connections
+title: 'About forced tunneling for site-to-site'
+description: Learn about forced tunneling and split tunneling via UDRs for VPN Gateway site-to-site connections
 titleSuffix: Azure VPN Gateway
 author: cherylmc
 ms.service: vpn-gateway
 ms.topic: conceptual
-ms.date: 08/01/2023
+ms.date: 08/04/2023
 ms.author: cherylmc
 ---
 
-# About split tunneling and forced tunneling for site-to-site configurations
+# About forced tunneling for site-to-site configurations
 
-This article helps you understand the difference between forced tunneling and split tunneling for VPN Gateway site-to-site (S2S) IPsec connections. By default, Internet-bound traffic from your workloads and VMs within a virtual network is sent directly to the Internet.
+This article helps you understand how forced tunneling works for site-to-site (S2S) IPsec connections. By default, Internet-bound traffic from your workloads and VMs within a virtual network is sent directly to the Internet.
 
 Forced tunneling lets you redirect or "force" all Internet-bound traffic back to your on-premises location via S2S VPN tunnel for inspection and auditing. This is a critical security requirement for most enterprise IT policies. Unauthorized Internet access can potentially lead to information disclosure or other types of security breaches.
 
-In some cases, you may want specific subnets to send and receive Internet traffic directly, without going through an on-premises location for inspection and auditing. You can specify this split tunneling behavior using [custom user-defined routes](../virtual-network/virtual-networks-udr-overview.md#user-defined) (UDRs). After configuring forced tunneling, specify a custom UDR for the subnet(s) for which you want to split tunnel Internet traffic. All other subnets continue to be force tunneled to the on-premises location.
+In some cases, you may want specific subnets to send and receive Internet traffic directly, without going through an on-premises location for inspection and auditing. One way to achieve this is to specify routing behavior using [custom user-defined routes](../virtual-network/virtual-networks-udr-overview.md#user-defined) (UDRs). After configuring forced tunneling, specify a custom UDR for the subnet(s) for which you want to send Internet traffic directly to the Internet (not to the on-premises location). In this type of configuration, only the subnets that have a specified UDR send Internet traffic directly to the Internet. Other subnets continue to have Internet traffic force-tunneled to the on-premises location.
 
-Split tunneling configurations can also be used when working with peered VNets. A custom UDR can be applied to a subnet of a peered VNet that traverses through the VNet containing the VPN Gateway S2S connection.
+You can also create this type of configuration when working with peered VNets. A custom UDR can be applied to a subnet of a peered VNet that traverses through the VNet containing the VPN Gateway S2S connection.
 
 ## Considerations
 
@@ -29,32 +29,32 @@ Forced tunneling is configured using Azure PowerShell. You can't configure force
   * **On-premises routes:** To the Azure VPN gateway.
   * **Default route:** Directly to the Internet. Packets destined to the private IP addresses not covered by the previous two routes are dropped.
 
-* Forced tunneling must be associated with a VNet that has a route-based VPN gateway. Your forced tunneling configuration overrides the default route for any subnet in its VNet. You need to set a "default site" among the cross-premises local sites connected to the virtual network. Also, the on-premises VPN device must be configured using 0.0.0.0/0 as traffic selectors.
+* In this scenario, forced tunneling must be associated with a VNet that has a route-based VPN gateway. Your forced tunneling configuration overrides the default route for any subnet in its VNet. You need to set a "default site" among the cross-premises local sites connected to the virtual network. Also, the on-premises VPN device must be configured using 0.0.0.0/0 as traffic selectors.
 
 * ExpressRoute forced tunneling isn't configured via this mechanism, but instead, is enabled by advertising a default route via the ExpressRoute BGP peering sessions. For more information, see the [ExpressRoute Documentation](../expressroute/index.yml).
 
 ## Forced tunneling
 
-The following example shows all traffic being forced through the VPN gateway back to the on-premises location for inspection and auditing. Configure [forced tunneling](site-to-site-tunneling.md) by specifying a default site.
+The following example shows all Internet traffic being forced through the VPN gateway back to the on-premises location for inspection and auditing. Configure [forced tunneling](site-to-site-tunneling.md) by specifying a default site.
 
 **Forced tunneling example**
 
 :::image type="content" source="./media/about-site-to-site-tunneling/forced-tunnel.png" alt-text="Diagram shows forced tunneling." lightbox="./media/about-site-to-site-tunneling/forced-tunnel-high-res.png":::
 
-## Split tunneling
+## Forced tunneling and UDRs
 
-You may want Internet-bound traffic from certain subnets (but not all subnets) to traverse from the Azure network infrastructure directly out to the Internet. This scenario can be configured using a combination of forced tunneling and virtual network custom user-defined routes. For steps, see [Split tunneling](site-to-site-tunneling.md).
+You may want Internet-bound traffic from certain subnets (but not all subnets) to traverse from the Azure network infrastructure directly out to the Internet. This scenario can be configured using a combination of forced tunneling and virtual network custom user-defined routes. For steps, see [Forced tunneling and UDRs](site-to-site-tunneling.md).
 
-**Split tunneling example**
+**Forced tunneling and UDRs example**
 
-:::image type="content" source="./media/about-site-to-site-tunneling/split-tunnel.png" alt-text="Diagram shows split tunneling." lightbox="./media/about-site-to-site-tunneling/split-tunnel-high-res.png":::
+:::image type="content" source="./media/about-site-to-site-tunneling/tunnel-user-defined-routing.png" alt-text="Diagram shows split tunneling." lightbox="./media/about-site-to-site-tunneling/tunnel-user-defined-routing-high-res.png":::
 
-* **Frontend subnet**: Internet-bound traffic is split tunneled directly to the Internet using a custom UDR that specifies this setting. The workloads in the Frontend subnet can accept and respond to customer requests from the Internet directly.
+* **Frontend subnet**: Internet-bound traffic is tunneled directly to the Internet using a custom UDR that specifies this setting. The workloads in the Frontend subnet can accept and respond to customer requests from the Internet directly.
 
 * **Mid-tier and Backend subnets**: These subnets continue to be force tunneled because a default site has been specified for the VPN gateway. Any outbound connections from these two subnets to the Internet are forced or redirected back to an on-premises site via S2S VPN tunnels through the VPN gateway.
 
 ## Next steps
 
-* See [How to configure split tunneling and forced tunneling for VPN Gateway S2S connections](site-to-site-tunneling.md).
+* See [How to configure forced tunneling for VPN Gateway S2S connections](site-to-site-tunneling.md).
 
 * For more information about virtual network traffic routing, see [VNet traffic routing](../virtual-network/virtual-networks-udr-overview.md).

articles/vpn-gateway/media/about-site-to-site-tunneling/forced-tunnel-high-res.png

@@ -1,27 +1,27 @@
 ---
-title: 'Configure split or forced tunneling for site-to-site connections: PowerShell'
+title: 'Configure forced tunneling for site-to-site connections: PowerShell'
 description: Learn how to split or force tunnel traffic for VPN Gateway site-to-site connections using PowerShell.
 titleSuffix: Azure VPN Gateway
 author: cherylmc
 ms.service: vpn-gateway
 ms.topic: how-to
-ms.date: 08/01/2023
+ms.date: 08/04/2023
 ms.author: cherylmc
 ---
-# Configure forced tunneling and split tunneling for site-to-site connections
+# Configure forced tunneling for site-to-site connections
 
-The steps in this article help you configure forced tunneling and split tunneling for site-to-site (S2S) IPsec connections. For more information, see [About forced tunneling and split tunneling for VPN Gateway](about-site-to-site-tunneling.md).
+The steps in this article help you configure forced tunneling for site-to-site (S2S) IPsec connections. For more information, see [About forced tunneling for VPN Gateway](about-site-to-site-tunneling.md).
 
-By default, Internet-bound traffic from your VMs goes directly to the Internet via the VPN gateway S2S connection. If you want to force all Internet-bound traffic through the VPN gateway to an on-premises site for inspection and auditing, you can do so by configuring **forced tunneling**. After you configure forced tunneling, if desired, you can split tunnel Internet-bound traffic for specified subnets using custom user-defined routes (UDRs).
+By default, Internet-bound traffic from your VMs goes directly to the Internet. If you want to force all Internet-bound traffic through the VPN gateway to an on-premises site for inspection and auditing, you can do so by configuring **forced tunneling**. After you configure forced tunneling, if desired, you can route Internet-bound traffic directly to the Internet for specified subnets using custom user-defined routes (UDRs).
 
-:::image type="content" source="./media/about-site-to-site-tunneling/split-tunnel.png" alt-text="Diagram shows split tunneling." lightbox="./media/about-site-to-site-tunneling/split-tunnel-high-res.png":::
+:::image type="content" source="./media/about-site-to-site-tunneling/tunnel-user-defined-routing.png" alt-text="Diagram shows split tunneling." lightbox="./media/about-site-to-site-tunneling/tunnel-user-defined-routing-high-res.png":::
 
-The following steps help you configure a forced tunneling scenario by specifying a default site. Optionally, using custom UDR, you can then split tunnel traffic by specifying that Internet-bound traffic from the Frontend subnet goes directly to the Internet, instead of to the on-premises site.
+The following steps help you configure a forced tunneling scenario by specifying a default site. Optionally, using custom UDR, you can route traffic by specifying that Internet-bound traffic from the Frontend subnet goes directly to the Internet, rather than to the on-premises site.
 
 * The VNet you create has three subnets: Frontend, Mid-tier, and Backend with four cross-premises connections: DefaultSiteHQ, and three branches.
-* You specify the default site for your VPN gateway using PowerShell, which forces all traffic back to the on-premises location. The default site can't be configured using the Azure portal.
-* The Frontend subnet is assigned a UDR to send traffic directly to the Internet, bypassing the VPN gateway.
-* The Mid-tier and Backend subnets continue to have traffic force tunneled back to the on-premises site via the VPN gateway because a default site is specified.
+* You specify the default site for your VPN gateway using PowerShell, which forces all Internet traffic back to the on-premises location. The default site can't be configured using the Azure portal.
+* The Frontend subnet is assigned a UDR to send Internet traffic directly to the Internet, bypassing the VPN gateway. Other traffic is routed normally.
+* The Mid-tier and Backend subnets continue to have Internet traffic force tunneled back to the on-premises site via the VPN gateway because a default site is specified.
 
 ## Create a VNet and subnets
 
@@ -134,7 +134,7 @@ To assign a default site for the gateway, you use the **-GatewayDefaultSite** pa
 
 At this point, all Internet-bound traffic is now configured to be force tunneled to *DefaultSiteHQ*. Note that the on-premises VPN device must be configured using 0.0.0.0/0 as traffic selectors.
 
-* If you want to only configure forced tunneling, and not split tunnel Internet traffic for specific subnets, you can skip to the [Establish Connections](#establish-s2s-vpn-connections) section of this article to create your connections.
+* If you want to only configure forced tunneling, and not route Internet traffic directly to the Internet for specific subnets, you can skip to the [Establish Connections](#establish-s2s-vpn-connections) section of this article to create your connections.
 * If you want specific subnets to send Internet-bound traffic directly to the Internet, continue with the next sections to configure custom UDRs and assign routes.
 
 ## Create route tables and routes