Configure a Non SD-WAN Destination of Type Microsoft Azure Virtual Hub

Follow the below steps to configure a Non SD-WAN Destination of type Microsoft Azure Virtual Hub in the SASE Orchestrator.

Prerequisites

Ensure you have configured a Cloud subscription. For steps, see Configure API Credentials.
Ensure you have created Virtual WAN and Hubs in Azure. For steps, see Configure Azure Virtual WAN for Branch-to-Azure VPN Connectivity.

In the SD-WAN service of the Enterprise portal, go to Configure > Network Services, and then under Non SD-WAN Destinations, expand Non SD-WAN Destinations via Gateway.
Click New, and then enter the Name and Type of the Non SD-WAN Destination. Once you enter the Type as Microsoft Azure Virtual Hub, Virtual Hub Configuration section is displayed in the dialog:

You can configure the following settings:


Option	Description
Subscription	Select a subscription from the drop-down menu.
Virtual WAN	The application fetches all the available Virtual WANs dynamically from Azure. Select a virtual WAN from the drop-down menu.
Resource Group	The application auto-populates the resource group to which the selected Virtual WAN is associated.
Virtual Hub	Select a virtual Hub from the drop-down menu.
Azure Region	The application auto-populates the Azure region corresponding to the selected Virtual Hub.
Enable Tunnel(s)	Select the Enable Tunnel(s) check box to allow VMware VPN Gateways to initiate VPN connections to the target Virtual Hub as soon as the site is successfully provisioned.

Note:

VMware VPN Gateways initiate the IKE negotiation only when the Non SD-WAN Destination is configured on at least one profile.
For Microsoft Azure Non SD-WAN Destination, the default local authentication ID value used is SD-WAN Gateway Interface Public IP.

Click Create.
The SASE Orchestrator automatically initiates deployment, provisions Azure VPN Sites, and downloads the VPN Site Configuration for the newly configured sites. It stores the configuration in the SASE Orchestrator’s Non SD-WAN Destination configuration database.

Once the Azure VPN sites are provisioned at the SASE Orchestrator side, you can view the VPN sites (Primary and Redundant) in the Azure portal by navigating to Virtual WAN > Virtual WAN architecture > VPN sites.

Associate the Microsoft Azure Non SD-WAN Destination to a Profile to establish a tunnel between a branch and Azure Virtual Hub. For more information, see Associate a Microsoft Azure Non SD-WAN Destination to an SD-WAN Profile.
You must add SD-WAN routes into Azure network manually. For more information, see Edit a VPN Site.
After associating a Profile to the Microsoft Azure Non SD-WAN Destination, you can return to the Non SD-WAN Destinations via Gateway section by navigating to Configure > Network Services, and then configure the BGP settings for the Non SD-WAN Destination. Scroll to the name of your Non SD-WAN Destination, and then click the Edit link in the BGP column. For more information, see Configure BGP Over IPsec from Gateways.
In the Non SD-WAN Destinations via Gateway area, click the Edit link in the BFD column for a Non SD-WAN Destination, to configure the BFD settings. For more information, see Configure BFD for Gateways.