A utilities customer wants all spoke-to-spoke traffic to traverse a central NVA deployed in the Virtual WAN hub. They tried creating UDRs in the spoke VNets with a next hop pointing to the hub firewall IP, but the spoke subnets do not honor those UDRs. Why does this happen and what is the correct way to force spoke-to-spoke traffic through the hub NVA?

The correct answer explains that UDRs in spoke VNets are ignored for traffic transiting through a Virtual WAN hub. Virtual WAN manages its own routing. To direct spoke-to-spoke traffic through a central NVA in the hub, you must configure a custom route table within the Virtual WAN hub. This route table should contain routes (either specific routes for spoke subnets or a default route 0.0.0.0/0) that point to the NVA's private IP address as the next hop. This custom route table is then associated with the spoke VNet connections in the Virtual WAN hub, ensuring all traffic between spokes is steered through the NVA. Incorrect options: UDRs are not blocked, but they are ineffective for hub-managed transit. Service chaining is for specific services like Azure Firewall, not general NVA routing. BGP is not required in spoke VNets for this scenario; Virtual WAN handles routing. Static UDRs can work in other contexts but not for influencing Virtual WAN hub transit. Global VNet peering is not necessary or the correct mechanism for routing within Virtual WAN. Virtual WAN inherently provides transit connectivity. UDRs in the hub VNet would not control spoke-to-spoke traffic.