Skip to main content
Welcome to this lesson on deploying a Network Virtual Appliance (NVA) into an Azure Virtual WAN hub. An NVA is a virtual machine (VM) that provides network functions such as firewalling, WAN optimization, or SD‑WAN; these are typically provided by third‑party vendors. Azure Virtual WAN simplifies integrating NVAs into the hub so they participate directly in the hub’s routing fabric, enabling centralized security and traffic inspection for hub‑connected networks. Overview
  • Choose the Virtual WAN hub where the NVA will be deployed (this determines region and which networks can use the appliance).
  • Select a supported NVA vendor from Azure Marketplace (examples: Barracuda, Cisco, Check Point, Fortinet, VMware).
  • Configure vendor- and deployment-specific parameters such as scale/infrastructure units, licensing, and any required authentication tokens.
  • Review and create. Azure provisions the NVA and integrates it with the hub.
When selecting a vendor, consider your organization’s security, throughput, licensing model (BYOL vs. PAYG), and existing vendor relationships. Integrating an NVA into the hub brings enterprise-grade inspection and policy enforcement to Azure without complex manual routing.
The image is a guide titled "Deploying NVA in a Virtual Hub" with steps to select a virtual WAN hub, define NVA infrastructure units, and use an authentication token, accompanied by a setup interface screenshot.
Key configuration options
Always check vendor documentation for scale-unit definitions and licensing requirements—these details vary by vendor and affect throughput and billing.
Step-by-step: Deploying an NVA from the Azure portal
  1. Open the Azure portal and navigate to your Virtual WAN resource.
  2. From the Virtual WAN overview, select Hubs and open the hub where you want to deploy the appliance.
  3. Inside the hub blade, choose Network virtual appliances and click Create.
  4. Select a vendor/solution from the supported NVA list and click Create to open that vendor’s Marketplace offer.
  5. On the Marketplace page, choose a plan (BYOL vs PAYG), supply vendor-specific details (e.g., licensing token, admin credentials, instance size), and follow the Create flow.
  6. Review + create. Azure will provision the appliance and automatically register it with the hub’s routing fabric.
If you already have a Virtual WAN and hub, the process is primarily a guided Marketplace flow with vendor prompts.
The image shows a Microsoft Azure portal interface displaying details of a virtual hub named "vwan-az700-eus-hub," including its connectivity options, status, and configuration features like VPN and ExpressRoute settings.
Marketplace and vendor configuration
  • After selecting a solution (for example, Fortinet FortiGate), the Marketplace entry displays available SKUs, pricing, and deployment options.
  • Complete any vendor-specific configuration (admin credentials, network interface settings, license/token). Some vendors provide onboarding or license activation steps in their portal.
  • Confirm networking configuration: ensure the NVA’s interfaces are attached to the correct hub subnet(s) and that route propagation to hub-connected spokes/branches is as expected.
  • Finish the deployment and validate that the NVA appears under the hub’s Network virtual appliances list.
The image shows a Microsoft Azure portal interface for creating an Azure Virtual WAN secured by FortiGate, with fields to input details like subscription, resource group, region, and FortiGate credentials.
Licensing and operational considerations
  • BYOL vs PAYG: BYOL may require you to bring a license key or register with the vendor portal. PAYG charges are billed via Azure Marketplace.
  • High availability: Check the vendor’s HA recommendations and whether multiple instances or availability zones are required for resilience.
  • Monitoring and logging: Integrate NVA logs with Azure Monitor, SIEM, or the vendor’s logging solution for visibility.
  • Throughput limits: Match scale units to your expected traffic patterns. Scale-up/scale-down processes and billing details differ by vendor.
Vendor licensing and tokens are critical—if you skip required registration or token entry, the NVA may not fully function or may incur unexpected charges. Confirm license activation before production traffic flows.
Summary Deploying an NVA into an Azure Virtual WAN hub allows you to centralize advanced network functions (firewalling, SD‑WAN, inspection) inside the hub’s routing fabric. The Azure Marketplace guides vendor selection, licensing, and instance sizing; Azure handles provisioning and integration with the hub so hub-connected VNets and branch sites can leverage the appliance. Links and references I hope this lesson clarified how to deploy NVAs into your Virtual WAN hub.

Watch Video