Azure Virtual Network Routing Appliance: peering performance, hub-and-spoke control
Yet another routing appliance? The name of this new Azure service is confusing. Is it a sort of NVA? A new kind of routing engine? No, the name tells too little, you need to look at the problem it solves. When two applications in different VNets need to talk, you have two options. The first is VNet peering. Throughput and latency are excellent: traffic stays on the Azure backbone, and VMs behave…
The Azure Virtual Network Routing Appliance is a new service designed to address the challenges of routing traffic between virtual networks (VNETs) within an Azure tenant. The service provides a dedicated forwarding layer that can handle large volumes of east-west traffic without becoming a performance bottleneck, as would be the case with a traditional network virtual appliance (NVA) or central device like Azure Firewall.
Unlike an NVA, the Virtual Network Routing Appliance does not inspect traffic or provide firewall capabilities. Instead, it relies on Azure-native tools such as user-defined routes (UDRs), network security groups (NSGs), and Azure Monitor metrics to control traffic flow. This allows organizations to maintain visibility and control over their east-west traffic without sacrificing performance.
Deploying the appliance is a straightforward process that involves registering the feature, creating a dedicated subnet for the appliance, and deploying the appliance itself. Once deployed, the appliance can be configured using the Azure portal or PowerShell. The service supports multiple tiers, ranging from 10 Gbps to 200 Gbps, allowing organizations to choose the bandwidth that best suits their needs.
To enable spokes VNETs to use the appliance, each spoke must have a peering relationship with the hub VNET and should not be directly peered with other spokes. UDRs must be configured on each spoke subnet, pointing to the appliance's private IP address as the next hop. This configuration allows traffic to flow through the appliance without the need for NAT functionality.
The Virtual Network Routing Appliance offers several benefits over traditional routing appliances. It reduces the need for complex peering configurations, provides high-performance routing without the bottleneck of a single device, and integrates seamlessly with existing Azure-native tools for traffic control. However, there are a few limitations to be aware of, such as the maximum number of appliances per region per subscription and the lack of support for VNET flow logs and Terraform at this time.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
