Azure VMware Solution - Creation of VRF Tier-0 Gateways

Ravi Kumar Shanker 141 Reputation points
2026-07-13T03:43:57.6533333+00:00

Our Production and DMZ networks are connected through separate Tier-1 (T1) Gateways under the same Tier-0 (T0) Gateway.

Because of AVS's internal routing behaviour, traffic between T1 Gateways is locally routed within the AVS NSX fabric via the common Tier-0 Gateway. The traffic does not egress through ExpressRoute/MSEE, preventing Azure Firewall from inspecting or filtering the traffic.

As a result, east-west traffic between Production and DMZ bypasses Azure Firewall entirely. (Note: We do not have vDefend license to implement DFW or Gateway Firewall or have an option to deploy 3rd party NVAs inside AVS or create another AVS SDDC to segregate traffic)

We are checking whether deploying VRF Tier-0 Gateways can achieve the following:

  • Place Production and DMZ T1 Gateways under separate VRF Tier-0 Gateways.
  • Prevent direct routing between the two VRFs within AVS.
  • Route the traffic through the Microsoft Enterprise Edge (MSEE) to Azure Virtual WAN.
  • Inspect and filter the traffic using Azure Firewall.
  • Return the traffic back to AVS after policy enforcement.

As per our understanding, in AVS to setup VRF - we need to log ticket with Microsoft, since the Tier-0 is fully managed by Microsoft?

Azure VMware Solution
0 comments

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Ravi Kumar Shanker 141 Reputation points
    2026-07-14T14:08:28.6266667+00:00

    @Christos Panagiotidis @Alex Burlachenko Thank you so much for your comments! I'm in the process of raising a support request with Microsoft. I hope they help to create VRFs.

    But we tried the VRF scenario in on-premise NSX infrastructure and it does work. I cannot think about any other way apart from VRF to have the traffic from DMZ-T1 to be inspected by Azure Firewall in vWAN (outside AVS) and then come back to Prod-T1 - basically I want the Tier-0 to not route the traffic internally and send it out for inspection.

    If there are any other ways to achieve this please do comment.

    Was this answer helpful?

    0 comments
  2. Christos Panagiotidis 3,551 Reputation points
    2026-07-13T09:30:38.8966667+00:00

    Hi! The AVS Tier-0 gateway is Microsoft-managed, so customers cannot independently create or redesign Tier-0 VRFs. This requires an AVS support request and a supported-topology review. More importantly, separate VRFs do not automatically guarantee that inter-segment traffic will leave AVS through MSEE and return through Azure Firewall. Without NSX Distributed Firewall, a supported NVA, or separate SDDCs, the inspection requirement may not be achievable in the proposed form.

    Was this answer helpful?

    0 comments
  3. Alex Burlachenko 25,120 Reputation points MVP Volunteer Moderator
    2026-07-13T09:20:02.5666667+00:00

    hi Ravi Kumar Shanker & thx for sharing urs issue here at Q&A portal,

    ur understanding is correct. In Azure VMware Solution, the Tier-0 Gateway is Microsoft-managed, so customers can't create or modify Tier-0 VRFs themselves. If VRF Tier-0 Gateways are needed, that has to be coordinated through Microsoft support.

    VRFs are intended to provide routing separation, but whether they achieve your exact traffic flow (forcing Production <-> DMZ traffic through ExpressRoute, Virtual WAN, and Azure Firewall) depends on the supported AVS routing design. I wouldn't assume that simply placing the T1s under different VRFs automatically forces traffic out to MSEE instead of routing internally.

    Given your constraints (no vDefend, no third-party NVA, no second SDDC), I'd recommend engaging the AVS networking team through a support case. They can confirm whether the proposed VRF design is supported and whether inter-VRF traffic can be steered through Azure Firewall as you described. The AVS networking https://learn.microsoft.com/azure/azure-vmware/concepts-networking I'd include your current topology (T0, T1s, ExpressRoute, Virtual WAN, Azure Firewall) in the support request. This is more of an architecture validation than a configuration question, and the AVS team can confirm whether VRF-based isolation is the right approach or if there's another supported design.

    rgds,

    Alex

    &

    If my answer was helpful pls mark it and additional thx if u follow me at Q&A portal

    and at my blog https://ctrlaltdel.blog/

     

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.