In this video I walk through an overview of Azure Virtual WAN, what it is, why we have it and the connectivity is provides! Includes connecting vnets, expressroute, S2S and P2S!
Someone asked on Reddit about controlling access between vnets. I talked about a default route table but you can also use custom route tables for the vnets to control which vnets can talk to which other vnets enabling you to control vnet-to-vnet if required.
you are a wizard, you were able to explain to me Virtual WAN, when looking at the documentation I was not totally able to understand the capabilities of the product. Well done
I am networking support engineer right now. I cannot thank you enough for your great guidance to reach technical knowledge and feel motivated to reach more.
You are the best teacher ever ❤️❤️ thank you so much. Also People are lucky enough to have your lessons for free..🙏 And unlucky people who have not watched your videos yet, I wish they all should get their luck soon 😊
On a first glance I've dismissed VWAN on the grounds that I could do the same by other means. But this is big-enterprise stuff and there are so many things to explore in this topic that I would love to watch a "Azure Virtual WAN deep dive" in the near future. Who knows? :-)
Another amazing training video, great job John, I am getting ready for AZ-305 exam next week and these videos are so damn helpful, thanks a lot to spend so much to create these videos.
exactly! the only difference being, the wvan hubs in different regions can by default talk to each other .. versus in AWS, the transit gateways in different regions have to be peered. slightly different ways of implementing the spoke to spoke communication .. but good Azure has something for this use case... (heavy TGW user here)
Thanks John for the great explanation .In terms of S2S connectivity latency , I think there shouldn't be any difference between using it with vWAN ( hot potato routing that you mentioned ) and the traditional VNG S2S VPN , because MS is using anycast for their IPs globally , so your on-prem site will be connected to the nearest MS "POP" regardless if you are using vWAN or traditional VNG S2S connectivity. This should apply also to the SD-WAN tunnels as they will be using the same mechanism. So you can deploy the SD-WAN NVA on a VNET or on a Vhub and in terms of latency it should be the same. Please correct me if I am getting this wrong. Thanks
@@NTFAQGuy thanks , I got the anycast information from a network expert in Microsoft and he confirmed that all the regions public IPs are populated in all regions using anycast. Maybe I misunderstood.
Would you advise a VWAN for each Azure Tenant or would it better to use one VWAN to connect all business unit tenants as well as use one central firewall?
azure ad tenant? most companies will only have one. if you mean subscription then likely would use one as the connectivity hub but would depend on more specific requirements.
@@NTFAQGuy Hi John thanks for the feedback. We have different business units each with its own Azure AD Tenant and subscription. I was wondering if it would be possible to manage all from one Virtual WAN or if I would need different Virtual WAN's for each. The former would prove more cost-effective if possible and possibly less admin.
@@Stateoftheheart you can do that but you will need some sort of device that is able keep each tenant's traffic separate. the vwan hub will mesh everything together
I want to convert my normal hub and spoke to virtual wan. Vnet to Vnet communication happening via NVA Firewall right now. Suppose if I add existing hub vnet to virtual wan hub vnet and the old hub become shared spoke services as per documentation. I hope i can still use UDR at spoke to direct the traffic via old NVA ( shared service spoke) and egress/ingress internet.
Thanks for another great video John! appreciate everything you do for the community! Do you know when the User/P2S VPN for Azure virtual WAN will support forced tunneling?
Great video, I do have a clarifying question, If you are using a product such as Silver Peak SD-WAN, why would we want to use vWAN to enable any-to-any communication? Wouldn't we just want vWAN to connect to our Azure resources?
i honestly don't know enough about silver peak to know its capabilities and where virtual wan make may sense to potentially connect locations over the azure back bone which would be better than Internet and then add-in the scope of azure connectivity etc.
@@NTFAQGuy well lets just say SD-WAN vs. Silver Peak. Is the end goal that we are just using the SD-WAN appliance to connect to Azure vWAN, then let it do all the connectivity for us?
The partner module for Azure Virtual Wan provides easy connectivity from that location to the Azure hub which then provides all the connectivity, yes sir.
@@gregtaylor5568 SilverPeak is a "bookend" type sdwan solution so it wont function on its on and requires both ends to exist and perform the sdwan functions so the per packet policies will still apply leaving and coming in. An advantage of Azure vWan here would be lower latency than DIA capabilities (think APAC to EMEA or domestic) where standard DIA may be not be performing as well so it will present as a wan link to the device (edgeconnect).
Another great video again, thanks John. Quick question, are "premium" and "GlobalReach" mandates for the Express Route circuit connects to virtual WAN?
Thanks John, best VWAN breakdown I've seen! If I was going to implement Azure firewall would you advise going the secure VWAN hub route as opposed to just using a hub VNET with Azure firewall?
the decision to go vwan has many factors and would not be based on use of Azure Firewall typically. much bigger design/responsibility/cost factors etc.
I am confused on why the virtual wan is required ? because we can have express route plus site 2 site vpn tunnels on a single azure vnet also with virtual network gateway and the expressroute gateway , also if we need to connect the single vnet to different vnets we can make use of vnet peering between the vnets
@@NTFAQGuy If we compare the price for vnet and virtual wan is there a great difference , I can see vnet is free of charge if not doing anything but virtual wan costs around 150 euro /month , for smaller deployments vnet should be recommended but if a company have a bigger and complex network then virtual wan would be recommended . Please correct me if I am wrong .
Hi John, I really enjoy your videos, thank you! Question: I have vWAN in almost every region, it's great, it scales etc. Now I have a third-party vendor that needs access only to one VNET (which is a part of vWAN) via a routed VPN tunnel. I know there's a way to do custom routes, but it appears that I cannot have the vendor VPN in a custom routing table, is there a way to isolate this vnet-to-vendor-vpn connection without using NVA or secured hub?
@@NTFAQGuy You're right, I overlooked the " see IPsec over ExpressRoute for Virtual WAN" section in github.com/MicrosoftDocs/azure-docs/blob/master/articles/virtual-wan/virtual-wan-about.md
Is there any way to NAT with Virtual WAN? If I connect a client site-to-site VPN I would want to NAT. If you cannot NAT, how can you get around possible network overlaps?
@@NTFAQGuy Thank you for the quick response. If I have clients (that I do not manage) that connect into my network and two of them happen to give me overlapping addresses, would something like an NVA work?
thank you! just one question, if I put Firewall to the Hub, and one of locations want to reach out other location using ExpressRoute Global Reach, it will need to go over that inefficient route, right? I mean it can't use barely backbone network then, it has to reach out to Hub?
@@NTFAQGuy I don't want to take too much of your time, if question is irrelevant, please ignore. from 15:00 till 15:15 you explained how with Global reach locations can talk to each other without going to Hub. I just wanted to know if it still true if we add Firewall to the Hub - shouldn't it pass through firewall?
Hi John, under what circumstances would we need more than one Virtual Wan under a single subscription - I can't think of a reason given that one Virtual WAN is able to connect multiple regions with a hub in each region? And can different Virtual WANs talk to each other?
If you are talking about nsx I’m not aware of 3rd party to directly interface but you could have other gateways on physical network talking to the vlan etc that is connected to nsx
Ah - if you are crossing geo-political boundaries you need ER Premium, but if you are putting VWAN in a single region (for encryption lets say) then Standard will suffice
VoIP tends to be very picky re QoS, latency etc and would depend on solution and other factors. Honestly not done much with VoIP but maybe others can comment. There is nothing really vWAN specific about it, its more the latency of ExpressRoute/S2S VPN etc.
@@steveeyler this is not VWan but rather the various types of links you may have as mentioned earlier. Would depend on links utilized. Within vnet i've seen DSCP maintained.
@@NTFAQGuy sorry, spell check 😄 I don't quite understand the failover scenarios of virtual wan. If you have a number of sites terminating vpns in UK South as the primary region, then if that hub fails, how would they failover to uk west as a secondary region? I guess BGP stops advertising routes to uk south. The hubs have different address spaces from what I have read, or does the uk west hub advertise the same address space as South, then BGP routing sorts out the routing as the uk west region is now the only route to virtual wan?
@@NTFAQGuy all it says is "Users can connect to multiple hubs if they want resiliency across regions." It doesn't tell you anywhere how this is achieved and how failure of a vwan hub tells the devices connected that its failed, or the failover times etc. It's very wooly.
@@daveshanahan3413 I think a hub is basically regional. if you want regional resiliency you have multiple hubs then would need to arrange redundant connections to each hub.