GlobalLogistics needs to insert a third-party NVA (virtual appliance) into their Virtual WAN transit to perform deep packet inspection for spoke-to-spoke traffic. They plan to use an NVA from the marketplace which requires a fixed private IP. How should they integrate the NVA so hub-transit traffic flows through it?

The correct approach is to deploy the NVA in a VNet attached to the Virtual WAN hub. By adding a static route in the hub's route table that directs traffic for specific prefixes (representing the spoke VNets requiring inspection) to the NVA's private IP, and then associating this route table with those spokes, you ensure that spoke-to-spoke traffic transits through the NVA. A Virtual Machine Scale Set provides high availability and scalability for the NVA. Deploying the NVA in a spoke VNet and using VNet peering is inefficient and complex for a hub-and-spoke model, as it requires managing numerous peerings. Azure Security Center is for security posture management, not for deploying and routing traffic through third-party NVAs. Azure Route Server is used for dynamic routing with BGP, but for a fixed private IP NVA in Virtual WAN, static routes are the direct and recommended method for traffic steering within the hub.