Skip to main content
Welcome — this lesson covers how to deploy a Network Virtual Appliance (NVA) into an Azure Virtual WAN hub. An NVA is a virtual machine that provides network functions (firewalling, SD‑WAN, WAN optimization, IDS/IPS) from third‑party vendors. Azure Virtual WAN simplifies integrating NVAs into a hub so you can centralize routing, inspection, and traffic steering without manual network plumbing. Key terms: Azure Virtual WAN, Virtual Hub, Network Virtual Appliance (NVA), Azure Marketplace, vendor licensing, scale units.

​
Quick overview

High-level deployment flow:
  1. Open your Virtual WAN resource in the Azure portal.
  2. Select the hub to host the NVA.
  3. Create a Network Virtual Appliance entry and choose a Marketplace vendor image.
  4. Configure vendor- and deployment-specific options (scale units, licensing/token, credentials, image version).
  5. Review and create — Azure provisions the NVA and integrates it with the hub routing fabric.
When evaluating vendors (Barracuda, Cisco, Check Point, Fortinet, VMware, etc.), consider required features (next‑gen firewall, SD‑WAN, IPS/IDS), existing contracts, and licensing models (BYOL vs pay‑as‑you‑go). This helps ensure consistent management and predictable cost. Common configuration items you’ll see when creating an NVA:
  • Virtual WAN hub selection — selects region and the hub attachment.
  • Infrastructure scale units — capacity units used to size the appliance for expected throughput (refer to vendor docs for exact per‑unit throughput).
  • Licensing and authentication token — vendor tokens, BYOL, or Marketplace billing options.
A slide titled "Deploying NVA in a Virtual Hub" with three teal buttons listing steps: "Select Virtual WAN hub", "Define NVA infrastructure units", and "Authentication token." To the right is a screenshot of an Azure CloudGen WAN gateway configuration panel.
Many vendor images are delivered through the Azure Marketplace. For example, Barracuda appliances commonly require an authentication token obtained from the vendor after subscribing in Marketplace; Fortinet offers both BYOL and pay‑as‑you‑go plans. Azure will provision the VM(s) and attach them into the hub’s routing fabric so traffic can be steered through the NVA.
Check vendor documentation for exact scale unit throughput and licensing requirements. Bandwidth per scale unit varies by vendor and SKU.

​
Portal walkthrough — step by step (high level)

Open your Virtual WAN resource in the Azure portal and navigate to Hubs. Then:
  • Select the hub you want to extend.
  • In the hub management blades, choose Network Virtual Appliances.
  • Click Create network virtual appliance. This opens the Marketplace and lists supported vendor images.
  • Select a vendor listing and click Create to start the deployment workflow.
  • Complete the vendor-specific configuration pages (subscription, resource group, region, license model, credentials, image version, scale units).
  • Review and create. Azure provisions and integrates the appliance into the hub.
A screenshot of the Microsoft Azure portal showing the Virtual WAN hub management page for "vwan-az700-eus-hub," with essentials (name, resource group, address space, location) and tiles for VPN, virtual network connections, ExpressRoute, and other networking options. The left navigation pane lists connectivity, routing, security, and monitoring sections.
Example: Fortinet FortiGate for Virtual WAN
  • Choose the Fortinet Marketplace listing, select the plan (BYOL or pay‑as‑you‑go), and click Create.
  • Provide FortiGate credentials, license details (or BYOL token), region, and image version.
  • Specify scale units and any vendor-specific deployment options then deploy.
A screenshot of the Microsoft Azure portal showing the "Create Azure Virtual WAN Secured by FortiGate" setup form with fields for subscription, resource group, region, FortiGate credentials, license type and image version. Tabs across the top and navigation buttons ("Previous", "Next", "Review + create") are also visible.
Because vendor forms, licensing, and token flows differ, the portal pages will vary by vendor and image. The important point: once the Marketplace deployment completes, Azure integrates the NVA into the Virtual WAN hub automatically.
Vendor-specific settings (licensing, tokens, image versions) are managed by the vendor’s Marketplace offering. Ensure you have the correct license or subscription before deploying.

​
Common configuration checklist

Configuration itemPurposeNotes
Virtual WAN hubAttach NVA to the correct hub/regionMust match hub where traffic will be steered
Scale unitsCapacity sizing for expected throughputVerify vendor documentation for per-unit throughput
Licensing/tokenLicense the appliance (BYOL, token, PAYG)Some vendors require tokens obtained after Marketplace subscription
CredentialsAdmin account and SSH/RDP optionsUse secure credential handling and Key Vault when possible
Image versionSelect vendor image and patch levelKeep images updated to address security fixes

​
Vendor selection — quick comparison

Vendor examplesTypical use cases
Fortinet (FortiGate)Next‑gen firewall, NGFW features in Virtual WAN
CiscoEnterprise firewall and SD‑WAN integration
Check PointAdvanced firewalling and threat prevention
BarracudaCloud firewalling and security services
VMwareSD‑WAN and virtualization-centric network services

​
Summary

  • NVAs are third‑party VMs that provide network functions and can be attached to Azure Virtual WAN hubs.
  • Navigate to Virtual WAN > Hubs > Network virtual appliances in the portal to create an NVA.
  • Select a Marketplace vendor image, configure hub, scale units, licensing/token, and credentials, then review and create.
  • Azure provisions the VM(s) and connects them into the hub routing fabric — always consult vendor documentation for sizing and licensing details.
This completes the lesson on deploying NVAs into an Azure Virtual WAN hub.

Watch Video