Cloud Computing|Microsoft Azure

Implementing Azure User Defined Routing

In a previous post, How Do You Customize Routing in Azure?, I explained why we might use user defined routing in Azure. In this post I will show you how to create a route table and routes, and associate that route table to virtual subnets.

The Task

I will start with a simple example based on a scenario that one of my customers faced recently. The customer was dealing with a site that had invested heavily in a software-based edge network solution that was not on Microsoft’s listed set of supported VPN devices. The customer wanted to deploy a site-to-site VPN connection, but didn’t want to purchase new edge firewalls. So the solution that was created was to deploy a virtual appliance in Azure that would act as the VPN gateway instead of using a gateway on the virtual network.

If you use an Azure gateway for VPN connectivity, the local network setting will provide your subnets with a route to your on-premises network. However, when you deploy your own VPN solution in a virtual machine (that’s what a virtual appliance is) then there is nothing, by default, to tell Azure how to route subnet traffic to the on-premises network(s).

Overriding the default routing of Azure networking with third-party VPN [Image credit: Aidan Finn]
Overriding the default routing of Azure networking with third-party VPN [Image credit: Aidan Finn]

The Desired Solution

User defined routing will be used to fix the above problem. A route table will be created. A single route will be added:

Sponsored Content

What is “Inside Microsoft Teams”?

“Inside Microsoft Teams” is a webcast series, now in Season 4 for IT pros hosted by Microsoft Product Manager, Stephen Rose. Stephen & his guests comprised of customers, partners, and real-world experts share best practices of planning, deploying, adopting, managing, and securing Teams. You can watch any episode at your convenience, find resources, blogs, reviews of accessories certified for Teams, bonus clips, and information regarding upcoming live broadcasts. Our next episode, “Polaris Inc., and Microsoft Teams- Reinventing how we work and play” will be airing on Oct. 28th from 10-11am PST.

  • Address Prefix: The network address (192.168.1.0/24) of the on-premises network will be used as the destination address.
  • Next Hop Type: Virtual Appliance will be used because the next hop is a virtual machine.
  • Next Hop IP Address: The IP address of the virtual appliance on the Azure subnet (10.1.0.10) will be defined as the IP gateway address for this route.

When a packet is being sent from a virtual machine in the subnet to anywhere on 192.168.1.0/24, then the user defined rule will match and override the system route for routing the traffic to the Internet.

Implementing the Solution

We will use the Azure Portal (https://portal.azure.com) to deploy this solution. A later post will show you the PowerShell alternative.

Open the Azure Portal, and click New > Networking > Route Table. Enter the required details for the new route table:

  • A name that will identify the route table, and ideally identify the subnet(s) that it will be associated with.
  • Select the subscription (if necessary)
  • Select the resource group that you want to add the route table to – it makes sense to add it to a resource group that contains the virtual network.
  • Select the Azure region that you want to deploy this route table to.

Click Create when you are ready.

Creating a new Azure route table [Image credit: Aidan Finn]
Creating a new Azure route table [Image credit: Aidan Finn]
It will take a few minutes for the new route table to be prepared for you. When it is, browse to the resource group that the route table was created in and open the route table. There are two groups of settings that we need to edit:

  • Routes: This is where you create the user defined routes to override the system routes.
  • Subnets: Here is where you can associate the route table with one or more subnets.

Open up routes and click Add. Enter the following information:

  • A name for the route.
  • The CIDR address of the network you are routing to.
  • The type of device that is acting as a router or gateway to the destination network.
  • The address of the route or gateway device – which itself must be routable from the Azure virtual network subnet.

AzureAddUserDefinedRoute
Adding a user defined route to an Azure route table [Image credit: Aidan Finn]
My example is a pretty simple one; a single route is being created to use a virtual appliance (machine) as a third-party site-to-site VPN solution.

Now browse to Subnets in the settings of the route table. Click Associate, choose a virtual network, and then select the subnet that you want to link this route table to. You should end up with something like the following example, where the routes and subnets can be seen summarized in the Essentials view of the route table.

A completed Azure route table [Image credit: Aidan Finn]
A completed Azure route table [Image credit: Aidan Finn]
It would be a mistake to attempt to test your routing now; the Azure fabric is not going to allow IP forwarding by the NIC(s) of a virtual machine (appliance) unless you allow it. This must be done using PowerShell. The following code will work with an Azure v2 (Azure Resource Manager or ARM) virtual machine. Make sure you update your version of the Azure PowerShell module, and then log into ARM using Login-AzureRMAccount. First we need to select a NIC in the virtual machine:
$RgName = “DemoPetriAF1”

$VMName = “DemoPetriAFGW1”

$NicName = ((Get-AzureRmVM -ResourceGroupName $RgName -Name $VmName).NetworkInterfaceIDs).Split("/")[-1] | Out-GridView -Title "Select a NIC to configure forwarding ..." –PassThru

Then you’ll get the configuration of that NIC using the following line:

$NicConfig = Get-AzureRmNetworkInterface -ResourceGroupName $RgName -Name $NicName

And finally you will enable IP forwarding:
$NicConfig.EnableIPForwarding = $true

$NicConfig | Set-AzureRmNetworkInterface

Be sure to repeat this for every virtual appliance NIC that will be used to route traffic on an Azure subnet. And now you can test your routing.

BECOME A PETRI MEMBER:

Don't have a login but want to join the conversation? Sign up for a Petri Account

Register
Comments (0)

Leave a Reply

Aidan Finn, Microsoft Most Valuable Professional (MVP), has been working in IT since 1996. He has worked as a consultant and administrator for the likes of Innofactor Norway, Amdahl DMR, Fujitsu, Barclays and Hypo Real Estate Bank International where he dealt with large and complex IT infrastructures and MicroWarehouse Ltd. where he worked with Microsoft partners in the small/medium business space.
External Sharing and Guest User Access in Microsoft 365 and Teams

This eBook will dive into policy considerations you need to make when creating and managing guest user access to your Teams network, as well as the different layers of guest access and the common challenges that accompany a more complicated Microsoft 365 infrastructure.

You will learn:

  • Who should be allowed to be invited as a guest?
  • What type of guests should be able to access files in SharePoint and OneDrive?
  • How should guests be offboarded?
  • How should you determine who has access to sensitive information in your environment?

Sponsored by: