To route inbound traffic from a VPN gateway through a Network Virtual Appliance (NVA), a

route table must be associated with the GatewaySubnet. A user-defined route (UDR) is then

created to direct traffic. The address prefix 10.0.0.0/16 is used to capture all traffic destined

for the VNet1 address space, overriding the default system route. The next hop type must

be Virtual appliance to specify the NVA as the target. The next hop address is the private IP

of the NVA, VM1, which is 10.0.1.4. This configuration ensures all traffic from the gateway

destined for the VNet is first sent to VM1 for processing.

1. Microsoft Azure Documentation, "Route tables for gateway subnets": This document

explicitly states, "To make sure your on-premises traffic is routed to a network virtual

appliance (NVA), you need to associate a route table to the gateway subnet." It also

provides an example of creating a UDR with the next hop type as 'Virtual Appliance'.

URL: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-route-tables

2. Microsoft Azure Documentation, "Virtual network traffic routing - User-defined": This

document details how user-defined routes (UDRs) override Azure's default system routes. It

defines the 'Virtual appliance' next hop type for routing traffic to an NVA.

URL: https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-udroverview#user-defined

3. Microsoft Azure Documentation, "Create, change, or delete a route table - Create a

route": This guide shows the required parameters for creating a route, including the

destination address prefix, the next hop type, and the next hop IP address.

URL: https://learn.microsoft.com/en-us/azure/virtual-network/manage-route-table#create-aroute