How to enable inter hub communication between two hubs in single Azure Virtual WAN?

Hello @Suman Bikram Singh,

Thank you for confirming your setup and routes. Based on your current network design, the issue seems to be caused by asymmetric routing.

Here’s what’s happening:

• You have two Azure Virtual WAN hubs, each with its own firewall: one in the UK (Firewall 1) and one in the UAE (Firewall 2).
• Traffic from the UK to the UAE goes through the UK firewall (FW1).
• Traffic from the UAE to the UK goes through the UAE firewall (FW2).
• However, the networks connected to each hub are set to send returning traffic back through their local firewall, causing the return path to be different from the original path. This mismatch is what we call asymmetric routing.

Why is it a problem? Because traffic that goes out one firewall and returns via another can get dropped or not logged properly.

How to fix this step-by-step:

1. Confirm Asymmetric Routing Make sure traffic flows in and out through the same firewall between the regions. Right now, it enters one firewall but returns through the other, which causes issues.
2. Adjust Routing Update the custom routes on both UK and UAE networks so that traffic between these regions and to the Internet goes through the same firewall. For example, if you pick the UK firewall (FW1) as the central point:
   1. UAE networks send traffic through FW1 instead of FW2
   2. UK networks also use FW1

            This keeps all traffic consistent and maintains connection tracking.
      

3. Use Routing Intent in Azure Virtual WAN This feature lets you direct all internet and private traffic through a specific firewall clearly, avoiding routing confusion. (You can find more about this in Azure’s documentation on routing policies.)
4. Enable Logging and Monitoring Use Azure Firewall diagnostics and Network Watcher tools to watch traffic and ensure packets flow properly through the firewall.

Alternative if you can’t enforce symmetric routing: Set up Source NAT (SNAT) on each firewall so return traffic goes back to the same firewall that handled the outgoing traffic. Keep in mind this might hide the original source IP unless extra headers like X-Forwarded-For are used.

In short, your current setup looks like this:

• Outbound UK to UAE traffic passes FW1 but return traffic routes back through FW2 (and vice versa), causing problems.

The preferred setup is:

• Both outbound and return traffic between UK and UAE go through the same firewall (for example, FW1 in both directions), ensuring smooth and consistent routing.

Supporting documents:

https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview

https://learn.microsoft.com/en-us/azure/virtual-wan/how-to-routing-policies

Please let us know if this helps or if you need further assistance fixing this issue.