vWAN hub routing issues

Question

vWAN hub routing issues

AzurePro 80

I below below scenario

VNET A - has SD-WAN silver peak VM that contained on prem connection

VNET A has added into VWAN hub - Add virtual connection.

Silver peak to VWAN hub - BGP peer established successfully but cant learn routes from on prem.

what configuration I'm missing here?

Praveen Bandaru 11,800 Reputation points Microsoft External Staff Moderator

2026-02-13T19:10:19.9166667+00:00

Hello **AzurePro
**I understand you have a VWAN setup and are experiencing some connectivity issues.

To help me better understand the situation, could you please share the topology diagram if possible.

I have also initiated a private message. Please check it and provide the necessary information so we can discuss further on your concern.

2 answers

Your answer

Praveen Bandaru 11,800 Reputation points Microsoft External Staff Moderator

2026-02-13T19:10:19.9166667+00:00

Hello **AzurePro
**I understand you have a VWAN setup and are experiencing some connectivity issues.

To help me better understand the situation, could you please share the topology diagram if possible.

I have also initiated a private message. Please check it and provide the necessary information so we can discuss further on your concern.

Answer 1

Hello AzurePro

Following our analysis of the current Virtual WAN and Silver Peak SD-WAN setup, we have identified the reason for the connectivity issue between On-Premises and the App VNet VM via the SaaS solution hosted in the vWAN hub.

Currently, Routing Intent is configured for both Private and Internet traffic. With this configuration, the vWAN hub automatically attracts and injects private routes (including connected VNet prefixes and default routes) into the spoke VNets. When route propagation is enabled on the Silver Peak VNet, these propagated routes override the intended NVA forwarding path. As a result, traffic is sent directly to the hub instead of passing through the Silver Peak appliance, which is why no traffic is observed on the NVA.

To ensure the setup functions correctly and maintains proper traffic inspection via Silver Peak, we recommend the following configuration:

Recommended Design:

Change Routing Intent to Internet Only (remove Private traffic from Routing Intent). Allow Silver Peak NVA to handle private traffic routing between On-Premises and Azure VNets.

Keep route propagation enabled only where required. Ensure appropriate UDRs are applied to direct private traffic to the Silver Peak NVA.

This design ensures:

Private traffic flows through the Silver Peak appliance for inspection and routing control. Internet-bound traffic is handled centrally via the vWAN hub. No routing conflicts occur between the hub and the spoke NVA. Symmetric routing is maintained, preventing connectivity failures.

Alternatively, if Routing Intent must remain configured for both Private and Internet traffic, we will need to disable route propagation on the Silver Peak VNet and apply explicit User Defined Routes (UDRs) to force traffic through the NVA. However, this approach requires careful route management and validation to avoid asymmetric routing

Check the below documents for more understanding:

Azure Virtual WAN – Routing Concepts and Route Tables

Azure Virtual WAN – Integrate Network Virtual Appliance (NVA) in Spoke

Azure Virtual WAN – Branch Connectivity (IPSec/BGP)

Hope the above answer helps! Please let us know do you have any further queries.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Praveen Bandaru 11,800 Reputation points Microsoft External Staff Moderator

2026-02-18T19:48:16.8366667+00:00

Hello AzurePro
I just wanted to follow up and see if you had a chance to review my answer to your question. Please let us know if you found it useful, and don't hesitate to contact us if you have any further questions.

I hope the above answer helps you! Please let us know if you have any further questions.

Please don't forget to "upvote" where the information provided will help you, this can be beneficial to other members of the community.
Praveen Bandaru 11,800 Reputation points Microsoft External Staff Moderator

2026-02-19T20:18:43.7266667+00:00

Hello AzurePro I just wanted to follow up and see if you had a chance to review my answer to your question. Please let us know if you found it useful, and don't hesitate to contact us if you have any further questions.

I hope the above answer helps you! Please let us know if you have any further questions.

Please don't forget to "upvote" where the information provided will help you, this can be beneficial to other members of the community.

Answer 2

In your scenario, since you've established a BGP peer between your SD-WAN Silver Peak VM in VNET A and the VWAN hub, but you're unable to learn routes from on-premises, there are a few configurations you might want to check:

Routing Intent Configuration: Ensure that you have configured Routing Intent on the Virtual Hub. This is necessary for the Virtual WAN to advertise routes to on-premises connections.
BGP Configuration: Verify that the BGP configuration on both the Silver Peak VM and the Virtual Hub is correct. This includes checking the BGP ASN (Autonomous System Number) and ensuring that the correct prefixes are being advertised.
Private Routing Policies: If you have Private Routing policies configured, make sure that they are set up to allow routes from the on-premises to be advertised to the Virtual Hub. This includes ensuring that the prefixes learned from the on-premises are included in the routing policies.
Effective Routes: Check the effective routes on the Azure Firewall or Network Virtual Appliance (NVA) if one is deployed. This will show which routes are selected by the Virtual WAN and can help identify any missing prefixes.
Propagation Settings: Ensure that the propagation settings for your connections are correctly configured to allow the default route (0.0.0.0/0) to propagate if necessary.

By reviewing these configurations, you should be able to identify what might be missing or misconfigured in your setup.