Azure NVA WAN Sides

Question

Azure NVA WAN Sides

Ali El Husseiny 320

I am looking to design my Azure NVA and for the egress part i am looking to segregate two kinds of traffic : my on prem traffic (IPSEC) and my in/out traffic to internet , thus we are talking about two public ip addresses here .

My concern is which of the below options are the best practice for this design :

Attaching the two wan-network interface cards to the same wan subnet of my NVA which both are associated with a public ip address , having a one route table pointing default route to Internet
Attaching each wan-network interface card of my NVA to its own wan subnet in the hub vnet , having two route tables pointing default route to Internet

Thanks for advising and if you have anything I have missed it out most appreciated !

0 comments

3 answers

Your answer

Answer 1

kagiyama yutaka 5,165

I think the two WAN‑NICs should stay in separate subnets with separate UDRs, and this keeps each NIC tied to one stable source IP, which many IPsec gateways and Internet firewalls rely on for policy matching. Azure’s subnet‑level routing makes this the simplest way to keep both paths predictable.

0 comments

Answer 2

Marcin Policht 106.3K MVP Volunteer Moderator

AFAIK, in general, the recommended approach is to place each WAN-facing network interface in its own dedicated subnet. This provides better traffic isolation, clearer routing boundaries, and simplifies applying different UDRs, NSGs, and monitoring policies for each traffic type. It also makes future troubleshooting and expansion easier.

Using two WAN interfaces in the same subnet is generally supported by Azure if the NVA vendor supports multiple NICs on the same network segment, but it offers little benefit. Both interfaces share the same routing domain, making it more difficult to enforce separate routing policies or independently manage IPsec and Internet traffic. It can also complicate asymmetric routing scenarios if traffic inadvertently leaves through a different interface than it arrived on.

If your goal is to segregate on-premises IPsec traffic from Internet ingress/egress, consider assigning each WAN interface to its own subnet. The NVA can then use separate routing policies or policy-based routing internally, while Azure UDRs direct the appropriate traffic to the correct interface. This design aligns with the principle of separating trust boundaries and is generally easier to operate in production.

However, the final design should also follow your NVA vendor's reference architecture, as some appliances have specific requirements or recommendations for multi-NIC deployments, asymmetric routing, and source NAT. Vendor guidance whould take precedence where it differs from generic Azure networking practices.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Ali El Husseiny 320 Reputation points

2026-08-02T18:42:17.8033333+00:00

I have question how i can make sure that the newly added NIC in NVA is assigned to the correct interface i need it in the NVA . when adding two NICS for example how i can make sure that NIC1 is assigned to interface -optional 1 and NIC2 is assigned to interface-optional 2 and so on .
Marcin Policht 106.3K Reputation points MVP Volunteer Moderator

2026-08-02T22:09:00.3966667+00:00

In Azure, the NIC name or creation order does not always guarantee how the NVA operating system or appliance maps the NICs to its internal interfaces. Azure presents the NICs to the VM, but the final mapping (for example, eth1, eth2, Optional1, Optional2, etc.) is controlled by the NVA image, operating system, and vendor drivers.

Verify the mapping from inside the NVA after attaching the NICs. Most NVA platforms provide a command or management interface that shows the detected interfaces, MAC addresses, IP addresses, and Azure NIC associations. Compare the MAC address shown in the NVA with the MAC address of each Azure network interface in the Azure portal. This lets you definitively identify which Azure NIC maps to which NVA interface.

For production deployments, follow the NVA vendor's Azure deployment guide. Many vendors recommend adding NICs in a specific order because the first NIC becomes the management or trusted interface, and subsequent NICs map to untrusted, optional, or external interfaces. If the vendor supports it, configure interface roles explicitly inside the appliance rather than relying only on Azure NIC ordering.

In addition, document the mapping before configuring routing: for example, Azure NIC nva-internet-nic -> MAC address X -> NVA Optional1, and Azure NIC nva-ipsec-nic -> MAC address Y -> NVA Optional2. This should help avoid accidental traffic flow changes during future NIC additions or maintenance.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Answer 3

Vipulkumar Patel 0

Hi Ali Husseiny,

Keep both WAN interface on separate subnets will gives you more control for traffic management, granular using NSG
Better control on NVA NAT configuration and Routing

For deployment, follow NVA OEM reference architecture; using the same appliance for north-south and east-west traffic is referred to combined or common firewall architecture. Since you are trying to use combined architecture on a single device/pair of devices, use segmentation for traffic separation and control on Azure as well as NVA.

0 comments