Skip to main content
Implementing Virtual Network Traffic Routing In this lesson we break down how network traffic is routed inside Microsoft Azure so you can control, understand, and optimize how your resources communicate — both within a virtual network and with the outside world. You’ll learn the fundamentals of Azure routing, how to override defaults with custom route tables, how to force internet-bound traffic through on-premises or inspection appliances, and how to use dynamic routing (BGP) and NVAs for hybrid or advanced scenarios. Finally, you’ll get hands-on troubleshooting techniques that help you verify and diagnose routing behavior.
A slide titled "Learning Objectives" listing four Azure networking topics: how traffic moves between subnets and services, setting up custom routing tables, redirecting internet-bound traffic to on‑premises for security inspection, and enabling dynamic BGP routing with third‑party NVAs. The slide has a blue gradient sidebar with colorful numbered markers (01–04).
What you will achieve in this lesson:
ObjectiveWhat you’ll learnWhy it matters
Azure default routingHow Azure’s system routes work for intra-VNet and inter-subnet trafficUnderstand the baseline behavior before making changes
Custom route tables (UDR)How to create and assign custom routes to subnets to override system routesDirect traffic for security, performance, or compliance
Forced tunneling & inspectionHow to redirect outbound internet traffic via on-prem or security appliances (NVAs)Inspect, filter, and log traffic before it leaves Azure
Dynamic routing with BGP & NVAsIntegrating BGP with VPN/ExpressRoute and third‑party NVAsEnable adaptive routing for complex/hybrid topologies
Troubleshooting & verificationUse Network Watcher, effective route tables, and packet captureQuickly diagnose and resolve routing issues
Before you start: make sure you have an Azure subscription, permissions to create networking resources (VNet, route tables, NSGs), and a basic familiarity with subnets and virtual machines. These prerequisites let you follow along with hands-on examples.
How we’ll approach the material
  • Start with Azure’s built-in system routes so you understand the default behavior.
  • Add custom routes (UDRs) to take explicit control over packet forwarding.
  • Demonstrate forced tunneling and redirecting internet-bound traffic to on‑premises or NVAs for inspection.
  • Introduce BGP-based dynamic routing for hybrid links and NVAs.
  • Conclude with practical troubleshooting and verification steps you can use in production.
Warning: Modifying route tables or enabling forced tunneling can change connectivity for production workloads. Always validate changes in a test environment and understand the effective routes for each subnet before applying updates in production.
Quick reference — key Azure routing concepts and tools
Concept / ToolPurposeQuick command / link
System routesDefault Azure routing for VM-to-VM, subnet-to-subnet, internethttps://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview
User-Defined Routes (UDR) / Route tablesOverride or augment system routes for subnetsCreate via Portal/ARM/Bicep/Terraform
Forced tunnelingRoute internet-bound traffic to on-prem or gatewayshttps://learn.microsoft.com/azure/virtual-network/virtual-networks-frequently-asked-questions#forced-tunneling
BGP (VPN / ExpressRoute)Exchange routes dynamically between Azure and on-premhttps://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings
Network Watcher — effective routesInspect the effective route table applied to a VM’s NICaz network watcher show-effective-route-table —resource-group RG —vm VMName
Example: check effective routes for a VM (Azure CLI) 
# Requires Network Watcher enabled in the region
az network watcher show-effective-route-table \
  --resource-group MyResourceGroup \
  --vm MyVM \
  --output table
Useful links and references Let’s get started with our first topic: how Azure routes traffic by default and what happens under the hood when a VM in one subnet communicates with another resource.

Watch Video