How to Secure Traffic from VNETs over an Edge Service for Azure vWAN

An Edge Service for Azure vWAN can be used to secure traffic that flows from VNETs to the virtual hub in which they are deployed. To secure East-West traffic (VNET-2-VNET traffic) over the Edge Service for Azure vWAN, go to the Azure portal and configure Routing Intent and Routing Policies for the Azure virtual hub in which your Edge Service for Azure vWAN is deployed. Routing Intent simplifies routing by managing associated route tables for all connections (such as virtual networks, site-to-site VPNs, point-to-site VPNs, and express routes) and allows you to set up simple and declarative Routing Policies for sending traffic via security solutions such as the Edge Service for Azure vWAN. For more information, see https://learn.microsoft.com/en-us/azure/virtual-wan/how-to-routing-policies#nva. To secure North-South traffic (VNET-2-Internet traffic) over the Edge Service for Azure vWAN, configure it in the settings for the Edge Service in the Secure Edge Manager.

Before You Begin

• You need an existing Edge Service for Virtual WAN. For more information on creating an Edge Service for Virtual WAN, see How to Create a SecureEdge for Virtual WAN Edge Service in Microsoft Azure.

Configure Routing Intent and Routing Policies in Microsoft Azure

1. Log into the Azure portal: https://portal.azure.com.
2. Go to the resource group containing your Edge Service for Virtual WAN.
3. Go to the Virtual WAN Hub that you want to configure routing policies on and select your hub. For example, in this case: doc-wan-hub.
   
4. The selected Virtual HUB page opens. In the left menu, click Routing Intent and Routing Policies.
   
5. The Routing Intent and Pouting Policies page opens. Specify values for the following:
   • Private traffic – Select Network Virtual Appliance from the drop-down list.
   • Next Hop Resource –  Select your relevant next hop resource.
     
6. Click Save.

Enable Secure Internet Traffic from VNETs in Barracuda SecureEdge

1. Go to https://se.barracudanetworks.com and log in with your existing Barracuda Cloud Control account.
2. In the left menu, click the Tenants/Workspaces icon and select the workspace containing your Edge Service.
3. Go to Infrastructure > Edge Services. The Edge Services page opens.
4. Select the Edge Service for Virtual WAN you wish to enable secure internet traffic from VNETs for. 
5. Click on the arrow icon next to the Edge Service for Virtual WAN you are interested in. 
   
6. The selected <Edge Service for vWAN> page opens. In the Edge Service menu, click Settings.
7. Specify a value for the following:
   • Secure Internet Traffic from VNETs – Click to enable.
     
8. Click Save.