Protection-Firewall-Hub-Spoke.md

• Az firewall

• az firewall is linked to Az Vnet
• Vnet should spare subnet in place
• due to FW helps to communicate on private IP hence public IP is not assigned to VM

- firewall subnet name should "AzureFirewallSubnet"

- add the route

• supply private ip address of firewall here to route traffic via firewall

• attach subnet of VM to route table

• connect VM via NAT

• Hub Spoke model

• traffic flow will be via peering

• attach route table to GatewaySubnet

• Setting up Hub network

• acting as onprem machine with routing capability

Part 1- now install 3 components in azure for Hub setup

1. create VNet for Hub
2. vn gateway
3. az bastion

2. Enable Azure Firewall in the HubVnet

4. add gatewaysubnet to hubVnet

5. Create Virtual network gateway

Part 2- create Spoke network

1. create a vnet for spoke and subnet

2. create a VM in spoke but dont assign any public ip

Part 3- Local Network Gateway

1. create local network gateway

• assign IP of you on-prem vpn device public IP
• same for address space, should be taken from on-prem vpn subnet

Part 4- Add VPN Connection @ Virtual Network gateway

1. click on connection on VNgateway

2. select above created local network gateway, supply shared key

Part 5- on-premises n/w vpn device

2. supply public IP address of Virtual Network gateway

3. in the destination address, hub n spoke vnet information is supplied

4. supply pre-shared key in the properties

5. right click n connect

Part 6- Create VNet peering b/w Hub n Spoke

1. open any of the network, hub or spoke, click on peering

2. name peering link name

3. use virtual network gateway

network flow now, spoke to VPN gateway to on-premises

Now , routing the traffic via Az Firewall

1. Attach UDR to respective Vnet 2. one to gateway subnet in hub and another to spoke subnet

3. Create Route Table

- now add route of Spoke

- pick private address of firwall

• associate the hubnet / subnet and associate with Route Table

4. Create another Route Table to route the traffice to company

- add route to reach traffic to Company device(internet)

- attach spoke network/subnet here

- Firewall rules to be updated to allow the flow of traffic

# Part 7 - Firewall Manager - click on firewall manager

- add a rule for spoke

- Associate Firewall policy to Vnet(Hub Network)