What's changed: Deepened AZ-700 Chapter 3 (ja figures; comparison tables/scenarios/FAQ/traps/deep paragraphs in all sections)
3.2NVAs, Service Chaining, and Forced Tunneling
Understand service chaining that routes through network virtual appliances (NVA) like firewalls, forced tunneling that forces outbound traffic through on-prem, and gateway sharing in hub-and-spoke. These are practical traffic controls built on UDRs.
When you must route through security appliances (firewalls, etc.), point the UDR next hop to an NVA. This is called service chaining.
3.2.1NVAs and forced tunneling
- NVA: a third-party firewall/router virtual appliance for inspection and advanced control.
- Service chaining: set the UDR next hop to the NVA to force traffic through it.
- Forced tunneling: use a UDR to force outbound internet traffic through on-prem for inspection/control there.
- Gateway transit: spoke VNets share the hub’s gateway (VPN/ExpressRoute).
Common on AZ-700: force traffic through an NVA = service chaining via UDR, force outbound via on-prem = forced tunneling, spokes share the hub gateway = gateway transit. Also remember to enable IP forwarding on NVAs.
Even with a UDR pointing to the NVA, traffic won’t forward unless IP forwarding is enabled on the NVA. Both settings are required.
To make NVAs redundant, the standard approach is to place an internal Load Balancer in front of multiple NVAs and point the UDR next hop at its IP (pointing directly at a single NVA IP creates a single point of failure). With Azure Firewall you avoid self-managing an NVA and point the UDR next hop at the firewall’s private IP. Service chaining can chain across multiple VNets: having each spoke’s UDR point at the hub NVA brings East-West (VNet-to-VNet) traffic under inspection too. Forced tunneling is used for compliance that forbids direct internet egress from Azure and routes everything through on-prem proxies/firewalls, implemented with 0.0.0.0/0 → virtual network gateway (or advertising 0.0.0.0/0 via BGP). Be careful not to sweep up Azure’s own management traffic or required endpoints—use exception routes or service-tag exclusions. Designs that traverse an NVA must watch for asymmetric routing (different forward/return paths break stateful inspection) and keep both-direction UDRs consistent.
| Technique | Goal | Implementation |
|---|---|---|
| Service chaining | Force traffic through NVA/Firewall | UDR next hop = NVA (its internal LB) |
| Forced tunneling | Force egress via on-prem | 0.0.0.0/0 → virtual network gateway |
| Gateway transit | Spokes share hub gateway | Enable on the peering |
Scenario: compliance forbids direct cloud-to-internet egress. → Configure forced tunneling, pointing 0.0.0.0/0 next hop to the virtual network gateway so all egress goes via on-prem. To avoid breaking Azure management traffic, add exception routes (next hop = internet) for required service tags.
FAQ: Q. How to make NVAs redundant? → A. Put an internal Load Balancer in front of multiple NVAs and use its IP as the UDR next hop; pointing at one NVA IP is a single point of failure. Q. What is asymmetric routing? → A. Forward and return paths differ, so a stateful NVA can’t track the session and traffic drops; prevent it by keeping both-direction UDRs consistent.
Trap: “forced tunneling means denying egress with an NSG” is wrong—it’s a UDR routing design that sends egress via on-prem (not a block). Also “pointing the UDR directly at a single NVA IP gives redundancy” is wrong—without an internal LB in front it’s a single point of failure.
3.2.2Section summary
- Service chaining = route through an NVA via UDR (IP forwarding required)
- Forced tunneling = force outbound via on-prem, gateway transit = share the gateway
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. You want spoke VNet traffic to always pass through the hub NVA (firewall). How?
Q2. You want to force outbound internet traffic through on-prem for inspection there. What is this called?
Q3. You set a UDR with the NVA as next hop, but traffic isn’t forwarded. What must be enabled on the NVA?