One of your on-prem routers advertises some static prefixes that must be present in the Virtual WAN hub route table for proper routing to an NVA. How do you add those on-prem prefixes to the hub routing so spokes learn them via the hub?

To ensure spokes learn specific on-premises prefixes via the Virtual WAN hub, you must explicitly define these routes within the hub's routing configuration. Creating or editing a custom route table in the virtual hub allows you to add static route entries for each on-premises prefix. Crucially, the next hop type for these entries should be set to the on-premises VPN connection (or the NVA IP if the NVA is the intended next hop for traffic steering). Finally, associating this custom route table with the relevant spoke VNets ensures that these spokes receive and incorporate these routes. Incorrect options: Creating UDRs in spoke VNets for on-prem prefixes with the next hop set to the on-prem public IP is incorrect because spokes do not automatically advertise UDRs to the hub, and the next hop should typically be an internal IP or connection, not a public IP. Registering prefixes as BGP communities on Azure Firewall Manager is not the mechanism for injecting static on-prem routes into the Virtual WAN hub route table. Firewall Manager is for firewall policy management. The Virtual WAN Global Route Table does not directly accept static on-prem prefixes via Azure Route Server for automatic propagation to all hubs in this manner. Route Server is primarily for dynamic routing within VNets and with on-premise networks, not for static injection into the Virtual WAN hub's route tables for spoke distribution.