vWAN hub routing issues

AzurePro 80 Reputation points
2026-02-13T18:32:48.7+00:00

I below below scenario

VNET A - has SD-WAN silver peak VM that contained on prem connection

VNET A has added into VWAN hub - Add virtual connection.

Silver peak to VWAN hub - BGP peer established successfully but cant learn routes from on prem.

what configuration I'm missing here?

Azure Virtual WAN
Azure Virtual WAN

An Azure virtual networking service that provides optimized and automated branch-to-branch connectivity.

2 answers

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-02-13T18:32:58.16+00:00

    In your scenario, since you've established a BGP peer between your SD-WAN Silver Peak VM in VNET A and the VWAN hub, but you're unable to learn routes from on-premises, there are a few configurations you might want to check:

    1. Routing Intent Configuration: Ensure that you have configured Routing Intent on the Virtual Hub. This is necessary for the Virtual WAN to advertise routes to on-premises connections.
    2. BGP Configuration: Verify that the BGP configuration on both the Silver Peak VM and the Virtual Hub is correct. This includes checking the BGP ASN (Autonomous System Number) and ensuring that the correct prefixes are being advertised.
    3. Private Routing Policies: If you have Private Routing policies configured, make sure that they are set up to allow routes from the on-premises to be advertised to the Virtual Hub. This includes ensuring that the prefixes learned from the on-premises are included in the routing policies.
    4. Effective Routes: Check the effective routes on the Azure Firewall or Network Virtual Appliance (NVA) if one is deployed. This will show which routes are selected by the Virtual WAN and can help identify any missing prefixes.
    5. Propagation Settings: Ensure that the propagation settings for your connections are correctly configured to allow the default route (0.0.0.0/0) to propagate if necessary.

    By reviewing these configurations, you should be able to identify what might be missing or misconfigured in your setup.

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

  2. Praveen Bandaru 11,800 Reputation points Microsoft External Staff Moderator
    2026-02-17T19:21:04.83+00:00

    Hello AzurePro

    Following our analysis of the current Virtual WAN and Silver Peak SD-WAN setup, we have identified the reason for the connectivity issue between On-Premises and the App VNet VM via the SaaS solution hosted in the vWAN hub.

    Currently, Routing Intent is configured for both Private and Internet traffic. With this configuration, the vWAN hub automatically attracts and injects private routes (including connected VNet prefixes and default routes) into the spoke VNets. When route propagation is enabled on the Silver Peak VNet, these propagated routes override the intended NVA forwarding path. As a result, traffic is sent directly to the hub instead of passing through the Silver Peak appliance, which is why no traffic is observed on the NVA.

    To ensure the setup functions correctly and maintains proper traffic inspection via Silver Peak, we recommend the following configuration:

    Recommended Design:

    Change Routing Intent to Internet Only (remove Private traffic from Routing Intent). Allow Silver Peak NVA to handle private traffic routing between On-Premises and Azure VNets.

    Keep route propagation enabled only where required. Ensure appropriate UDRs are applied to direct private traffic to the Silver Peak NVA.

    This design ensures:

    Private traffic flows through the Silver Peak appliance for inspection and routing control. Internet-bound traffic is handled centrally via the vWAN hub. No routing conflicts occur between the hub and the spoke NVA. Symmetric routing is maintained, preventing connectivity failures.

    Alternatively, if Routing Intent must remain configured for both Private and Internet traffic, we will need to disable route propagation on the Silver Peak VNet and apply explicit User Defined Routes (UDRs) to force traffic through the NVA. However, this approach requires careful route management and validation to avoid asymmetric routing

    Check the below documents for more understanding:

    Azure Virtual WAN – Routing Concepts and Route Tables

    Azure Virtual WAN – Integrate Network Virtual Appliance (NVA) in Spoke

    Azure Virtual WAN – Branch Connectivity (IPSec/BGP)

    Hope the above answer helps! Please let us know do you have any further queries.

    Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.