Default route advertisement from on-prem to Azure VMware solution for internet connectivity

Question

Default route advertisement from on-prem to Azure VMware solution for internet connectivity

Sumit bnd 40

We are looking to force default internet traffic from AVS to route through the on-prem environment. However, as mentioned, advertising the default route may impact traffic from Azure VNets as well.

Given that we already have Azure Virtual WAN implemented, we would like to understand where this traffic can be filtered or controlled to avoid unintended routing impacts on Azure VNet traffic.

Mounika Reddy Anumandla 6,975 Reputation points Moderator

2025-05-12T03:16:17.3433333+00:00

Hi Sumit bnd,

Just checking in to see if you had a chance to review the response provided to your question.

Let me know if you have any further queries!

If the information is helpful, please click "upvote" to let us know.
Sumit bnd 40 Reputation points

2025-05-12T07:17:52.03+00:00
HI @Mounika Reddy Anumandla Thank you so much for your response. I just have two quick questions for further clarification:

If I configure the default route to point to on-premises using the AVS default route setting, is it still necessary to advertise the default route from on_prem ? Since the default route is already directed to on-prem

You mentioned, "Ensure that route propagation from on-premises does not inadvertently advertise the default route to all VNets." Could you please advise how we can control or prevent this, so that connected VNets are not impacted by the default route being advertised from on-prem?

Appreciate your guidance on this.
Mounika Reddy Anumandla 6,975 Reputation points Moderator

2025-05-12T09:02:48.1533333+00:00
Hi Sumit bnd,

As per my understanding, if you configure the AVS default route to point to your on-premises network (via ExpressRoute or VPN), you do not need to advertise the default route from on-premises separately. The default route configuration in AVS will ensure that internet-bound traffic from AVS is directed to your on-premises environment.

However, advertising the default route from on-premises (especially 0.0.0.0/0) can lead to unintended propagation of that route to other VNets, unless properly controlled. The main concern is that by advertising the default route from on-premises, you risk propagating it to other VNets connected to Azure Virtual WAN, which could cause unexpected internet traffic routing.

Here’s how to control and prevent the default route (0.0.0.0/0) from being inadvertently propagated to other VNets:

Use Custom Route Tables for Segmentation

Create a custom route table (e.g., AVS-RouteTable) for your AVS connection.

Associate only the AVS connection (i.e., the route to AVS) with this route table.

In this route table, include the default route (0.0.0.0/0) that points to your on-premises network.

For other VNets, associate them with different route tables that do not propagate the default route from on-premises.

By using separate route tables for each VNet, you isolate which routes (including 0.0.0.0/0) each VNet will receive. This way, only AVS gets the default route to on-prem, and other VNets retain their own routing behavior (e.g., internet access via Azure Firewall, NAT gateway, etc.).

In each route table used by other VNets, you should disable propagation of the default route from your on-premises connection (via ExpressRoute or VPN).

Specifically, in the Route Table settings for each VNet, go to "Propagate routes from" and ensure that on-premises (ExpressRoute or VPN) is not selected.

Effective Routes can be viewed on the NIC of a VM within a VNet to ensure the intended routes have been applied.

Use this to confirm that only AVS gets the default route while other VNets retain their correct routing paths.

Hope it helps!

Let me know if you have any further queries!
Mounika Reddy Anumandla 6,975 Reputation points Moderator

2025-05-13T11:56:22.2366667+00:00

Hi Sumit bnd,

Just checking in to see if you had a chance to review the response provided to your question.

Let me know if you have any further queries!

If the information is helpful, please click "Accept Answer" and "Upvote it."

Answer accepted by question author

0 additional answers

Your answer

Mounika Reddy Anumandla 6,975 Reputation points Moderator

2025-05-12T03:16:17.3433333+00:00

Hi Sumit bnd,

Just checking in to see if you had a chance to review the response provided to your question.

Let me know if you have any further queries!

If the information is helpful, please click "upvote" to let us know.
Sumit bnd 40 Reputation points

2025-05-12T07:17:52.03+00:00

HI @Mounika Reddy Anumandla Thank you so much for your response. I just have two quick questions for further clarification:

If I configure the default route to point to on-premises using the AVS default route setting, is it still necessary to advertise the default route from on_prem ? Since the default route is already directed to on-prem

You mentioned, "Ensure that route propagation from on-premises does not inadvertently advertise the default route to all VNets." Could you please advise how we can control or prevent this, so that connected VNets are not impacted by the default route being advertised from on-prem?

Appreciate your guidance on this.
Mounika Reddy Anumandla 6,975 Reputation points Moderator

2025-05-13T11:56:22.2366667+00:00

Hi Sumit bnd,

Just checking in to see if you had a chance to review the response provided to your question.

Let me know if you have any further queries!

If the information is helpful, please click "Accept Answer" and "Upvote it."

Answer 1

Hi Sumit bnd,
I understand you concern that to force default internet traffic from Azure VMware Solution (AVS) to route through your on-premises environment-while avoiding unintended routing impacts on other Azure VNet traffic-requires precise control over routing policies in Azure Virtual WAN. Because routing policies in Virtual WAN hubs are applied at the hub level, any default route (0.0.0.0/0) advertised for internet-bound traffic will affect all VNets and branches connected to that hub, not just AVS. This means that if you advertise a default route to force AVS internet traffic through on-premises, you risk impacting the default internet path for all other Azure VNets associated with that hub.

https://free.blessedness.top/en-us/azure/virtual-wan/about-virtual-hub-routing

Recommendations

Custom Route Tables: You can use custom route tables and control propagation/association to manage which VNets or connections receive specific routes. By associating only, the AVS connection with a route table that has the default route pointing to your on-premises next hop,and ensuring other VNets are associated with a different route table, you can isolate the routing behavior.

1.Use Custom Route Tables for Segmentation:

Create separate route tables in the Virtual WAN hub.
Associate the AVS connection with a route table that includes a default route (0.0.0.0/0) pointing to your on-premises environment (via ExpressRoute or VPN).
Associate other Azure VNets with a route table that does not include the default route, or that points their internet-bound traffic to Azure Firewall or the internet directly.

2.Review Propagation Settings:

Ensure that route propagation from on-premises does not inadvertently advertise the default route to all VNets. Control which connections propagate and receive routes using the Virtual WAN portal.

3.Test and Validate:

Use effective route table views to confirm that only the intended AVS connection receives the default route to on-premises, and other VNets maintain their desired internet routing path.
To avoid unintended routing impacts on Azure VNet traffic when forcing AVS internet traffic through on-premises, leverage custom route tables within Azure Virtual WAN. Carefully associate and propagate routes so that only AVS receives the default route to on-premises, while other VNets retain their standard internet routing path. Routing policies at the hub level are broad, but custom route tables provide the granularity needed for this scenario.
https://free.blessedness.top/en-us/azure/virtual-wan/how-to-routing-policies

Additional ref: https://www.youtube.com/watch?v=m-GmkMFZ5WA&t=4s

Hope it helps!

Let me know if you have any further queries!

If the information is helpful, please click "upvote" to let us know!

Share via

Default route advertisement from on-prem to Azure VMware solution for internet connectivity

0 additional answers

Your answer