Skip to content

Commit c3b595c

Browse files
AnnaMHuffAnnaMHuff
authored
Merge pull request #271053 from mbender-ms/avnm-udr-v2
virtual network manager - New Articles - UDR Management
2 parents 76c0f84 + 223dd95 commit c3b595c

16 files changed

+380
-6
lines changed

‎articles/virtual-network-manager/TOC.yml

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,8 @@
6767
href: concept-virtual-network-flow-logs.md
6868
- name: Query Azure Virtual Network Manager using Azure Resource Graph (ARG)
6969
href: query-azure-resource-graph.md
70+
- name: User-defined routes (UDRs) management
71+
href: concept-user-defined-route.md
7072
- name: Samples
7173
items:
7274
- name: Resource Manager Templates
@@ -109,12 +111,14 @@
109111
href: how-to-configure-event-logs.md
110112
- name: Monitor security admin rules with Virtual Network Flow Logs
111113
href: concept-virtual-network-flow-logs.md
112-
- name: View applied configurations
113-
href: how-to-view-applied-configurations.md
114-
- name: Define dynamic network group membership with Azure Policy
115-
href: how-to-define-network-group-membership-azure-policy.md
116-
- name: Common issues
117-
href: common-issues.md
114+
- name: View applied configurations
115+
href: how-to-view-applied-configurations.md
116+
- name: Define dynamic network group membership with Azure Policy
117+
href: how-to-define-network-group-membership-azure-policy.md
118+
- name: Create user-defined routes (UDRs)
119+
href: how-to-create-user-defined-route.md
120+
- name: Common issues
121+
href: common-issues.md
118122
- name: Reference
119123
items:
120124
- name: Code samples

‎articles/virtual-network-manager/concept-user-defined-route.md

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
---
2+
title: Automate UDR Management with Azure Virtual Network Manager
3+
description: Learn to automate and simplifying routing behaviors using user-defined routes management with Azure Virtual Network Manager.
4+
author: mbender-ms
5+
ms.author: mbender
6+
ms.topic: overview
7+
ms.date: 04/30/2024
8+
ms.service: virtual-network-manager
9+
ms.custom: references_regions
10+
# Customer Intent: As a network engineer, I want learn how I can automate and simplify routing within my Azure Network using User-defined routes.
11+
---
12+
# Automate UDR Management with Azure Virtual Network Manager
13+
14+
This article provides an overview of UDR management, why it's important, how it works, and common routing scenarios that you can simplify and automate using UDR management.
15+
16+
[!INCLUDE [virtual-network-manager-udr-preview](../../includes/virtual-network-manager-udr-preview.md)]
17+
18+
## What is UDR management?
19+
20+
Azure Virtual Network Manager (AVNM) allows you to describe your desired routing behavior and orchestrate user-defined routes (UDRs) to create and maintain the desired routing behavior. User-defined routes address the need for automation and simplification in managing routing behaviors. Currently, you’d manually create User-Defined Routes (UDRs) or utilize custom scripts. However, these methods are prone to errors and overly complicated. You can utilize the Azure-managed hub in Virtual WAN. This option has certain limitations (such as the inability to customize the hub or lack of IPV6 support) not be relevant to your organization. With UDR management in your virtual network manager, you have a centralized hub for managing and maintaining routing behaviors.
21+
22+
## How does UDR management work?
23+
24+
In virtual network manager, you create a routing configuration. Inside the configuration, you create rule collections to describe the UDRs needed for a network group (target network group). In the rule collection, route rules are used to describe the desired routing behavior for the subnets or virtual networks in the target network group. Once the configuration is created, you'll need to [deploy the configuration](./concept-deployments.md) for it to apply to your resources. Upon deployment, all routes are stored in a route table located inside a virtual network manager-managed resource group.
25+
26+
Routing configurations create UDRs for you based on what the route rules specify. For example, you can specify that the spoke network group, consisting of two virtual networks, accesses the DNS service's address through a Firewall. Your network manager creates UDRs to make this routing behavior happen.
27+
28+
:::image type="content" source="media/concept-udr-management/udr-management-example.png" alt-text="Diagram of user-defined rules being applied to virtual networks to route DNS traffic through firewall.":::
29+
30+
### Routing configurations
31+
32+
Routing configurations are the building blocks of UDR management. They're used to describe the desired routing behavior for a network group. A routing configuration consists of the following settings:
33+
34+
| **Attribute** | **Description** |
35+
|---------------|-----------------|
36+
| **Name** | The name of the routing configuration. |
37+
| **Description** | The description of the routing configuration. |
38+
39+
### Route collection settings
40+
41+
A route collection consists of the following settings:
42+
43+
| **Attribute** | **Description** |
44+
|---------------|-----------------|
45+
| **Name** | The name of the route collection. |
46+
| **Local routing settings** | The local routing settings for the route collection. |
47+
| **Enable BGP route propagation** | The BGP settings for the route collection. |
48+
| **Target network group** | The target network group for the route collection. |
49+
| **Route rules** | The route rules that describe the desired routing behavior for the target network group. |
50+
51+
:::image type="content" source="media/how-to-deploy-user-defined-routes/rule-collection-settings.png" alt-text="Screenshot of a configured rule collection with a routing rule.":::
52+
53+
### Route rule settings
54+
55+
Each route rule consists of the following settings:
56+
57+
| **Attribute** | **Description** |
58+
|---------------|-----------------|
59+
| **Name** | The name of the route rule. |
60+
| **Destination type** | |
61+
| IP address | The IP address of the destination. |
62+
| Destination IP addresses/CIDR ranges | The IP address or CIDR range of the destination. |
63+
| Service tag | The service tag of the destination. |
64+
| **Next hop type** | |
65+
| Virtual network gateway | The virtual network gateway as the next hop. |
66+
| Virtual network | The virtual network as the next hop. |
67+
| Internet | The Internet as the next hop. |
68+
| Virtual appliance | The virtual appliance as the next hop. |
69+
| **Next hop address** | The IP address of the next hop. |
70+
71+
:::image type="content" source="media/how-to-deploy-user-defined-routes/routing-rule-settings.png" alt-text="Screenshot of configured routing rule.":::
72+
73+
For each type of next hop, refer to [used-defined routes](../virtual-network/virtual-networks-udr-overview.md#user-defined).
74+
75+
### Common destination patterns for IP Addresses
76+
77+
When creating route rules, you can specify the destination type and address. When you specify the destination type as an IP address, you can specify the IP address information. The following are common destination patterns:
78+
The following are common destination patterns:
79+
80+
| **Traffic destination** | **Description** |
81+
|-------------------------|-----------------|
82+
| **Internet > NVA** | For traffic destined to the Internet through a network virtual appliance, enter **0.0.0.0/0** as the destination in the rule. |
83+
| **Private traffic > NVA** | For traffic destined to the private space through a network virtual appliance, enter **192.168.0.0/16, 172.16.0.0/12, 40.0.0.0/24, 10.0.0.0/24** as the destination in the rule. These destinations are based on the RFC1918 private IP address space. |
84+
| **Spoke network > NVA** | For traffic bound between two spoke virtual networks connecting through a network virtual appliance, enter the CIDRs of the spokes as the destination in the rule. |
85+
86+
### Use Azure Firewall as the next hop
87+
88+
You can also easily choose an Azure Firewall as the next hop by selecting **Import Azure firewall private IP address** when creating your routing rule. The IP address of the Azure Firewall is then used as the next hop.
89+
90+
:::image type="content" source="media/how-to-deploy-user-defined-routes/add-routing-rule-azure-firewall.png" alt-text="Screenshot of routing rule with Azure Firewall option.":::
91+
92+
## Common routing scenarios
93+
94+
Here are the common routing scenarios that you can simplify and automate by using UDR management.
95+
96+
| **Routing scenarios** | **Description** |
97+
|--------------------------------------------------|---------------|
98+
| Spoke network -> Network Virtual Appliance -> Spoke network | Use this scenario for traffic bound between two spoke virtual networks connecting through a network virtual appliance. |
99+
| Spoke network -> Network Virtual Appliance -> Endpoint or Service in Hub network | Use this scenario for spoke network traffic for a service endpoint in a hub network connecting through a network virtual appliance. |
100+
| Subnet -> Network Virtual Appliance -> Subnet even in the same virtual network | |
101+
| Spoke network -> Network Virtual Appliance -> On-premises network/internet | Use this scenario when you have Internet traffic outbound through a network virtual appliance or an on-premises location, such as hybrid network scenarios. |
102+
| Cross-hub and spoke network via Network Virtual Appliances in each hub | |
103+
| hub and spoke network with Spoke network to on-premises needs to go via Network Virtual Appliance | |
104+
| Gateway -> Network Virtual Appliance -> Spoke network | |
105+
106+
## Local routing settings
107+
108+
When you create a rule collection, you define the local routing settings. The local routing settings determine how traffic is routed within the same virtual network or subnet. The following are the local routing settings:
109+
110+
| **Local routing setting** | **Description** |
111+
|---------------------------|-----------------|
112+
| **Direct routing within virtual network** | Route traffic directly to the destination within the same virtual network. |
113+
| **Direct routing within subnet** | Route traffic directly to the destination within the same subnet. |
114+
| **Not specified** | Route traffic to the next hop specified in the route rule. |
115+
116+
When you select **Direct routing within virtual network** or **Direct routing within subne**t, a UDR with a virtual network next hop is created for local traffic routing within the same virtual network or subnet. However, if the destination CIDR is fully contained within the source CIDR under these selections and direct routing is selected, a UDR specifying a network appliance as the next hop won't be set up.
117+
118+
## Limitations of UDR management
119+
120+
The following are the limitations of UDR management with Azure Virtual Network Manager:
121+
122+
- When conflicting routing rules exist (rules with same destination but different next hops), they aren't supported within or across rule collections that target the same virtual network or subnet.
123+
- When you create a route rule with the same destination as an existing route in the route table, the routing rule is ignored.
124+
- When a virtual network manager-created UDR is manually modified in the route table, the route isn't up when an empty commit is performed. Also, any update to the rule isn't reflected in the route with the same destination.
125+
- Existing Azure services in the Hub virtual network maintain their existing limitations with respect to Route Table and UDRs.
126+
- Azure Virtual Network Manager requires a managed resource group to store the route table. If you need to delete the resource group, deletion must happen before any new deployments are attempted for resources in the same subscription.
127+
128+
## Next step
129+
130+
> [!div class="nextstepaction"]
131+
> [Learn how to create user-defined routes in Azure Virtual Network Manager](how-to-create-user-defined-routes.md).
132+

0 commit comments

Comments
 (0)