Azure Virtual WAN Overview

[@egger6311]

4 years later, still the best explanation out here. Thanks a lot

[@NTFAQGuy]

Glad it helped!

[@NTFAQGuy]

Someone asked on Reddit about controlling access between vnets. I talked about a default route table but you can also use custom route tables for the vnets to control which vnets can talk to which other vnets enabling you to control vnet-to-vnet if required.

[@z0nerider]

Azure vWAN seems a bit complicated with route table association and propagation, can you make a deep dive on this ????

[@gultekinbutun7910]

Even the video is 2 year old, still watching it. Thanks a lot John.

[@MarcosFreccia]

Great video, and thanks for putting these concepts in a very easy way! For a non-network expert here, this helped me a lot.

[@diegolagosmorales2536]

you are a wizard, you were able to explain to me Virtual WAN, when looking at the documentation I was not totally able to understand the capabilities of the product. Well done

[@cinthyagarciarodriguez5098]

I am networking support engineer right now. I cannot thank you enough for your great guidance to reach technical knowledge and feel motivated to reach more.

[@satishraju5188]

You are the best teacher ever ❤️❤️ thank you so much. Also People are lucky enough to have your lessons for free..🙏 And unlucky people who have not watched your videos yet, I wish they all should get their luck soon 😊

[@NTFAQGuy]

Wow, thank you

[@kamatapa]

On a first glance I've dismissed VWAN on the grounds that I could do the same by other means. But this is big-enterprise stuff and there are so many things to explore in this topic that I would love to watch a "Azure Virtual WAN deep dive" in the near future. Who knows? :-)

[@Staa31]

Always very informative and simple in the explanations, thank you

[@NTFAQGuy]

My pleasure!

[@eliassal1]

Great video, understood really the difference betweenn VWan and VPN Gateways

[@santiagoleoni3833]

The Azure God doing it again. Thanks John!

[@NTFAQGuy]

Lol, thanks :)

[@Tech-ub8dd]

Thank you John , love all your work! Thank you!

[@mansourshokri6176]

Another amazing training video, great job John, I am getting ready for AZ-305 exam next week and these videos are so damn helpful, thanks a lot to spend so much to create these videos.

[@NTFAQGuy]

Best of luck!

[@Apollo26gaming]

Excellent Video John. Really cleared my concept on Virtual WAN.

[@NTFAQGuy]

Excellent

[@Sergio-Here-In-Community]

Hey John.... Amazing training... the best of the best trainer ever!!!

[@NTFAQGuy]

Thanks!

[@kdedesko]

Simply the best John !!!!

[@Respawngg]

Thank you , you are explaining things so well which were really hard to grasp🤟

[@Stateoftheheart]

Would you advise a VWAN for each Azure Tenant or would it better to use one VWAN to connect all business unit tenants as well as use one central firewall?

[@NTFAQGuy]

azure ad tenant? most companies will only have one. if you mean subscription then likely would use one as the connectivity hub but would depend on more specific requirements.

[@Stateoftheheart]

@@NTFAQGuy Hi John thanks for the feedback. We have different business units each with its own Azure AD Tenant and subscription. I was wondering if it would be possible to manage all from one Virtual WAN or if I would need different Virtual WAN's for each. The former would prove more cost-effective if possible and possibly less admin.

[@JM-bl3ih]

@@Stateoftheheart you can do that but you will need some sort of device that is able keep each tenant's traffic separate. the vwan hub will mesh everything together

[@MohammadSameerA]

Very useful and helpful. Thanks.

[@gregtaylor5568]

Great video, I do have a clarifying question, If you are using a product such as Silver Peak SD-WAN, why would we want to use vWAN to enable any-to-any communication? Wouldn't we just want vWAN to connect to our Azure resources?

[@NTFAQGuy]

i honestly don't know enough about silver peak to know its capabilities and where virtual wan make may sense to potentially connect locations over the azure back bone which would be better than Internet and then add-in the scope of azure connectivity etc.

[@gregtaylor5568]

@@NTFAQGuy well lets just say SD-WAN vs. Silver Peak. Is the end goal that we are just using the SD-WAN appliance to connect to Azure vWAN, then let it do all the connectivity for us?

[@NTFAQGuy]

The partner module for Azure Virtual Wan provides easy connectivity from that location to the Azure hub which then provides all the connectivity, yes sir.

[@gregtaylor5568]

@@NTFAQGuy hmmm I think I would loose all of my traffic shaping capabilities, as well as, visibility no?

[@miketx3494]

@@gregtaylor5568 SilverPeak is a "bookend" type sdwan solution so it wont function on its on and requires both ends to exist and perform the sdwan functions so the per packet policies will still apply leaving and coming in. An advantage of Azure vWan here would be lower latency than DIA capabilities (think APAC to EMEA or domestic) where standard DIA may be not be performing as well so it will present as a wan link to the device (edgeconnect).

[@chandramohanb5585]

Excellent 👌👌👌

[@MonsterPOV]

so in AWS terms, this is similar to Transit Gateway :)

[@bhakta_rg]

exactly! the only difference being, the wvan hubs in different regions can by default talk to each other .. versus in AWS, the transit gateways in different regions have to be peered. slightly different ways of implementing the spoke to spoke communication .. but good Azure has something for this use case... (heavy TGW user here)

[@Certified_Chad_42]

As usual a great video. Thank JohnTechSavill!!!

[@NTFAQGuy]

Hehe, thanks

[@srinidatla1079]

Why would we want to use IPSec over express route? Isn’t express route a dedicated connection?

[@NTFAQGuy]

Its still a piece of wire going over physical spaces :-) Because of that some companies want extra encryption. For most though its not a concern.

[@altanetluke]

Sounds like that is more a compliance/regulatory requirement vs. actual security.

[@prrrabu]

Great Video John !!

[@NTFAQGuy]

Thanks 👍

[@masoudkooranloo908]

Thank you John!

[@rjbir]

Great explanation, thanks for sharing !!

[@NTFAQGuy]

Glad it was helpful!

[@robertgoldstein5819]

what type of device would you have at the branch locations? A standard VPN device or is there a specialized SD-WAN device?

[@NTFAQGuy]

Can be standard WAN or there are specialized partner solutions.

[@shubhamgupta3485]

I am confused on why the virtual wan is required ? because we can have express route plus site 2 site vpn tunnels on a single azure vnet also with virtual network gateway and the expressroute gateway , also if we need to connect the single vnet to different vnets we can make use of vnet peering between the vnets

[@NTFAQGuy]

Simplifies management, routing and adds some greater scale and some features I covered

[@shubhamgupta3485]

@@NTFAQGuy If we compare the price for vnet and virtual wan is there a great difference , I can see vnet is free of charge if not doing anything but virtual wan costs around 150 euro /month , for smaller deployments vnet should be recommended but if a company have a bigger and complex network then virtual wan would be recommended . Please correct me if I am wrong .

[@PrashantSharma-ql4yb]

brilliant explanation!

[@malshawaf]

Thanks John for the great explanation .In terms of S2S connectivity latency , I think there shouldn't be any difference between using it with vWAN ( hot potato routing that you mentioned ) and the traditional VNG S2S VPN , because MS is using anycast for their IPs globally , so your on-prem site will be connected to the nearest MS "POP" regardless if you are using vWAN or traditional VNG S2S connectivity. This should apply also to the SD-WAN tunnels as they will be using the same mechanism. So you can deploy the SD-WAN NVA on a VNET or on a Vhub and in terms of latency it should be the same. Please correct me if I am getting this wrong. Thanks

[@NTFAQGuy]

VPN GW is an ip in a region. But yes is same mechanism with or without vwan. It’s not anycast

[@malshawaf]

@@NTFAQGuy thanks , I got the anycast information from a network expert in Microsoft and he confirmed that all the regions public IPs are populated in all regions using anycast. Maybe I misunderstood.

[@NTFAQGuy]

@@malshawaf routing is not same as anycast. Regular public ips are regional

[@kenrq63]

Nice update John, thank you.

[@NTFAQGuy]

You are very welcome

[@rstra3]

Is there any way to NAT with Virtual WAN? If I connect a client site-to-site VPN I would want to NAT. If you cannot NAT, how can you get around possible network overlaps?

[@NTFAQGuy]

there is no native NAT in this solution. Ideally you ensure different networks don't overlap. Solutions like private link NAT.

[@rstra3]

@@NTFAQGuy Thank you for the quick response. If I have clients (that I do not manage) that connect into my network and two of them happen to give me overlapping addresses, would something like an NVA work?

[@burgergaming58]

Great video love your videos

[@NTFAQGuy]

Glad you like them!

[@marcelohg]

Thank you. Great explanation!

[@wolkwijs324]

Very good video about virtual wan! But I have a question; If you use encrypted expressroute via virtual wan, does global reach break that?

[@NTFAQGuy]

you mean S2S VPN over ExpressRoute? They should not impact global reach since the VPN is do a particular vnet not the entire expressroute circuit.

[@wolkwijs324]

@@NTFAQGuy You're right, I overlooked the " see IPsec over ExpressRoute for Virtual WAN" section in github.com/MicrosoftDocs/azure-docs/blob/master/articles/virtual-wan/virtual-wan-about.md

[@addinuff]

Hi John - You can have Express Route Standard, it doesnt have to be Premium according to the documentation?

[@addinuff]

Ah - if you are crossing geo-political boundaries you need ER Premium, but if you are putting VWAN in a single region (for encryption lets say) then Standard will suffice

[@NTFAQGuy]

Maybe it’s changed. When I spoke with the pg it had to be premium. I’ll check if changed.

[@joejohnthomas6426]

Can we have VWAN Gateway in Tier0 ?

[@NTFAQGuy]

If you are talking about nsx I’m not aware of 3rd party to directly interface but you could have other gateways on physical network talking to the vlan etc that is connected to nsx

[@JohnQ85]

If I have an existing Azure VPN Gateway, can I still add and use a Virtual WAN?

[@NTFAQGuy]

It would not be part of vwan

[@steveeyler]

Think VoIP quality is ok on VWAN?

[@NTFAQGuy]

VoIP tends to be very picky re QoS, latency etc and would depend on solution and other factors. Honestly not done much with VoIP but maybe others can comment. There is nothing really vWAN specific about it, its more the latency of ExpressRoute/S2S VPN etc.

[@steveeyler]

@@NTFAQGuy I expect it would be at least as good as internet based voip. Curious if VWAN observes DSCP flags for VoIP. Thanks.

[@NTFAQGuy]

@@steveeyler this is not VWan but rather the various types of links you may have as mentioned earlier. Would depend on links utilized. Within vnet i've seen DSCP maintained.

[@MammadovAdil]

thank you! just one question, if I put Firewall to the Hub, and one of locations want to reach out other location using ExpressRoute Global Reach, it will need to go over that inefficient route, right? I mean it can't use barely backbone network then, it has to reach out to Hub?

[@NTFAQGuy]

I don't understand your question, sorry.

[@MammadovAdil]

@@NTFAQGuy I don't want to take too much of your time, if question is irrelevant, please ignore. from 15:00 till 15:15 you explained how with Global reach locations can talk to each other without going to Hub. I just wanted to know if it still true if we add Firewall to the Hub - shouldn't it pass through firewall?

[@aryan1736]

Awesomely Explained

[@ravenbao3334]

Hi John, under what circumstances would we need more than one Virtual Wan under a single subscription - I can't think of a reason given that one Virtual WAN is able to connect multiple regions with a hub in each region? And can different Virtual WANs talk to each other?

[@NTFAQGuy]

Typical 1 then hub in regions

[@cartierin]

Great Video!! Quick question on S2S . Can I route traffic coming from Site 1 to vent-a and site 2 to vnet-b.

[@NTFAQGuy]

So it would be any to any but if you wanted to restrict use nsgs so vneta only talks to site 1 etc. could also control via azure firewall if using.

[@felipeccardoso]

And regarding the IP addresses connected in the Virtual WAN Hub (VNET, P2S, S2S, Express Route), there can be no overlap of IPs, correct?

[@NTFAQGuy]

Correct. If you have overlapping in azure Vnets then private link may help as that does nat

[@Stateoftheheart]

Thanks for another great video John! appreciate everything you do for the community! Do you know when the User/P2S VPN for Azure virtual WAN will support forced tunneling?

[@NTFAQGuy]

Thanks, I believe that feature is in preview.

[@Stateoftheheart]

@@NTFAQGuy Thank you John, that's great news!

[@Stateoftheheart]

@@NTFAQGuy Hi John, I don't see this feature in preview in the UK yet. Do you have any updates?

[@jackfang2221]

Another great video again, thanks John. Quick question, are "premium" and "GlobalReach" mandates for the Express Route circuit connects to virtual WAN?

[@NTFAQGuy]

Glad you like the video. Check the documentation for latest requirements as things have been changing around exact requirements.

[@Stateoftheheart]

Thanks John, best VWAN breakdown I've seen! If I was going to implement Azure firewall would you advise going the secure VWAN hub route as opposed to just using a hub VNET with Azure firewall?

[@NTFAQGuy]

the decision to go vwan has many factors and would not be based on use of Azure Firewall typically. much bigger design/responsibility/cost factors etc.

[@Stateoftheheart]

@@NTFAQGuy Thanks John, we are planning on going SDWAN down the line so I think it would make sense.

[@Chris920809]

Awesome video

[@narendermann]

these are really awesome.

[@NTFAQGuy]

Thanks

[@balasubramanianwv3877]

I want to convert my normal hub and spoke to virtual wan. Vnet to Vnet communication happening via NVA Firewall right now. Suppose if I add existing hub vnet to virtual wan hub vnet and the old hub become shared spoke services as per documentation. I hope i can still use UDR at spoke to direct the traffic via old NVA ( shared service spoke) and egress/ingress internet.

[@NTFAQGuy]

Should be possible yes.

[@eddurguti]

Hi John, I really enjoy your videos, thank you! Question: I have vWAN in almost every region, it's great, it scales etc. Now I have a third-party vendor that needs access only to one VNET (which is a part of vWAN) via a routed VPN tunnel. I know there's a way to do custom routes, but it appears that I cannot have the vendor VPN in a custom routing table, is there a way to isolate this vnet-to-vendor-vpn connection without using NVA or secured hub?

[@NTFAQGuy]

Vwan supports some 3rt parties. Would check docs for options, eg faq

[@grantpalmer9338]

Thanks great video really usefull

[@NTFAQGuy]

Great to hear, thank you!

[@jimlosinsky5548]

GREAT 😀😀😀😀

[@daveshanahan3413]

What happens if a refund fails, or a vwan hub fails?

[@NTFAQGuy]

not sure what you mean by refund but all the components are redundant, i.e. multiple instances for gateways etc.

[@daveshanahan3413]

@@NTFAQGuy sorry, spell check 😄 I don't quite understand the failover scenarios of virtual wan. If you have a number of sites terminating vpns in UK South as the primary region, then if that hub fails, how would they failover to uk west as a secondary region? I guess BGP stops advertising routes to uk south. The hubs have different address spaces from what I have read, or does the uk west hub advertise the same address space as South, then BGP routing sorts out the routing as the uk west region is now the only route to virtual wan?

[@NTFAQGuy]

@@daveshanahan3413 docs.microsoft.com/en-us/azure/virtual-wan/virtual-wan-faq has resiliency info

[@daveshanahan3413]

@@NTFAQGuy all it says is "Users can connect to multiple hubs if they want resiliency across regions." It doesn't tell you anywhere how this is achieved and how failure of a vwan hub tells the devices connected that its failed, or the failover times etc. It's very wooly.

[@NTFAQGuy]

@@daveshanahan3413 I think a hub is basically regional. if you want regional resiliency you have multiple hubs then would need to arrange redundant connections to each hub.

[@raymondkissoon8274]

Another great video!

[@Apa-is2jz]

thank youj

[@NTFAQGuy]

My pleasure

[@DrDoktor60]

Azure WAN in one sentence?

[@NTFAQGuy]

There would be a lot of commas and semi-colons :-)

[@DrDoktor60]

John Savill 😀something for a pseudo-technical person to understand

[@philathomas]

@@DrDoktor60 It's a cloud IP routing platform that can links cloud & on prem (S2S,ER) network resources via a single location.

[@allwynmasc1]

This looks like a SASE solution by Microsoft

[@NTFAQGuy]

The Entra SSE provides those capabilities. I have a video on the Entra SSE.