Can i deploy SaaS - Palo alto firewall and silver peak SD wan NVA in Same vWAN hub? Any issues with routing?

You cannot deploy both a Palo Alto Networks SaaS firewall and a Silver Peak SD-WAN NVA in the same Virtual WAN hub. Currently, the routing intent configuration does not support routing between an SD-WAN NVA and a Firewall NVA (or SaaS solution) deployed in the same Virtual hub. Instead, you would need to deploy them in different Virtual Hubs or deploy the SD-WAN NVA in a spoke Virtual Network connected to the hub and leverage BGP peering capabilities.

References:

• How to configure Virtual WAN Hub routing intent and routing policies
• What's new in Azure Virtual WAN?
• About NVAs in a Virtual WAN hub
• Virtual WAN to Virtual WAN connectivity options
• Palo Alto Networks Cloud NGFW

Hello @AzurePro,

Thanks for reaching out to Microsoft Q&A.

I understand that you're looking to deploy both a Palo Alto firewall and Silver Peak SD-WAN NVA in the same Virtual WAN hub and are wondering about any potential routing issues.

No, this is not supported. Azure Virtual WAN currently does not allow multiple NVAs with different roles (e.g., SD-WAN and Firewall) in the same Virtual WAN hub when using routing intent.

Routing intent configuration does not support routing between an SD-WAN NVA and a Firewall NVA (or SaaS firewall) deployed in the same hub.

Virtual WAN hubs are designed for single routing intent per hub (e.g., Internet, Private, or Default).

When you deploy Palo Alto Cloud NGFW (SaaS) in a hub, routing intent redirects traffic to that firewall for inspection. Adding an SD-WAN NVA in the same hub would conflict with this routing logic.

Below are the recommended options you can try:

Deploy one hub for Palo Alto Cloud NGFW SaaS and another hub for Silver Peak SD-WAN NVA. Use inter-hub connectivity or hub-and-spoke architecture for traffic flow between hubs.

Deploy the SD-WAN NVA in a spoke VNet connected to the vWAN hub hosting Palo Alto NGFW. Use BGP peering or static routes for connectivity.

Reference Document:
https://learn.microsoft.com/en-us/azure/virtual-wan/how-to-routing-policies#known-limitations