Skip to content

Commit c1dcab4

Browse files
authored
Apply suggestions from code review
Added spaces between the characters in abbreviations in the alt text.
1 parent 6d2a233 commit c1dcab4

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

articles/route-server/route-injection-in-spokes.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,13 +27,13 @@ However, if the NVA advertises via BGP to the Route Server network prefixes, the
2727

2828
If the NVA is used to provide connectivity to on-premises network via IPsec VPNs or SD-WAN technologies, the same mechanism can be used to attract traffic from the spokes to the NVA. Additionally, the NVA can dynamically learn the Azure prefixes from the Azure Route Server, and advertise them with a dynamic routing protocol to on-premises. The following diagram describes this setup:
2929

30-
:::image type="content" source="./media/scenarios/route-injection-vpn.png" alt-text="This network diagram shows a basic hub and spoke topology with on-premises connectivity via a VPN NVA.":::
30+
:::image type="content" source="./media/scenarios/route-injection-vpn.png" alt-text="This network diagram shows a basic hub and spoke topology with on-premises connectivity via a V P N N V A.":::
3131

3232
## Connectivity to on-premises through Azure Virtual Network Gateways
3333

3434
If a VPN or an ExpresRoute gateway exists in the same VNet as the Route Server and NVA to provide connectivity to on-premises networks, routes learned by these gateways will be programmed as well in the spoke VNets. These routes would override the default route injected by the Route Server, since they would be more specific (longer network masks). The following diagram describes the previous design, where an ExpressRoute gateway has been added.
3535

36-
:::image type="content" source="./media/scenarios/route-injection-vpn-and-expressroute.png" alt-text="This network diagram shows a basic hub and spoke topology with on-premises connectivity via a VPN NVA and ExpressRoute.":::
36+
:::image type="content" source="./media/scenarios/route-injection-vpn-and-expressroute.png" alt-text="This network diagram shows a basic hub and spoke topology with on-premises connectivity via a V P N N V A and ExpressRoute.":::
3737

3838
You cannot configure the subnets in the spoke VNets to only learn the routes from the Azure Route Server. Disabling "Virtual network gateway route propagation" in a route table associated to a subnet would prevent both types of routes (routes from the Virtual Network Gateway and routes from the Azure Route Server) to be injected on NICs in that subnet.
3939

@@ -43,7 +43,7 @@ Note that Azure Route Server per default will advertise all prefixes learnt from
4343

4444
A particular case of the previous design is when customers insert the Azure Firewall in the traffic flow to inspect all traffic going to on-premises networks, either via ExpressRoute or via SD-WAN/VPN appliances. In this situation, all spoke subnets have route tables that prevent the spokes from learning any route from ExpressRoute or the Route Server, and have default routes (0.0.0.0/0) with the Azure Firewall as next hop, as the following diagram shows:
4545

46-
:::image type="content" source="./media/scenarios/route-injection-vpn-expressroute-firewall.png" alt-text="This network diagram shows hub and spoke topology with on-premises connectivity via NVA for VPN and ExpressRoute where Azure Firewall does the breakout.":::
46+
:::image type="content" source="./media/scenarios/route-injection-vpn-expressroute-firewall.png" alt-text="This network diagram shows hub and spoke topology with on-premises connectivity via N V A for V P N and ExpressRoute where Azure Firewall does the breakout.":::
4747

4848
The Azure Firewall subnet will learn the routes coming from both ExpressRoute and the VPN/SDWAN NVA, and will decide whether sending traffic one way or the other. As described in the previous section, if the NVA appliance advertises more than 200 routes to the Azure Route Server, it should send its BGP routes marked with the BGP community `no-advertise`. This way, the SDWAN prefixes will not be injected back to on-premises via Express-Route.
4949

0 commit comments

Comments
 (0)