Send all traffic to the internet through the Check Point firewall except Entra Domain services

HASSAN BIN NASIR DAR 326

I have a Check Point firewall in Azure, and I want to send all traffic to the internet through the Check Point firewall except Entra Domain services. I have deployed a user-defined route and added two routes.

The first route is configured as follows:

Address Prefix: 0.0.0.0/0

Next Hop: Virtual Appliance

Next Hop Address: Private Ip address of firewall

The second route is configured as:

Address Prefix: Specific address range (using Entra Domain Services)

Next Hop: Virtual Network

Next Hop Address: Blank

Everything is working fine, but I am getting the following error:

A user defined route table has detected that includes a 0.0.0.0/0 route where the next hop is not configured for Internet.

Please I need a solution as soon as possible.

Rohith Vinnakota 1,515 Reputation points Microsoft Vendor

2024-11-28T22:09:33.2566667+00:00

Hi HASSAN BIN NASIR DAR,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that two routes are working fine, but you're experiencing the error.

A user defined route table has detected that includes a 0.0.0.0/0 route where the next hop is not configured for Internet.

This warning is to alert you that the route is not directing all internet-bound traffic.

Kindly let us know if the above helps or you need further assistance on this issue.

Thanks,

Rohith.
HASSAN BIN NASIR DAR 326 Reputation points

2024-11-28T23:35:42.75+00:00

I have critical warning in Entra Domain Services after i have pointed a 0.0.0.0/0 route to the checkpoint firewall

How can I fix or remove this warning?

regards
Rohith Vinnakota 1,515 Reputation points Microsoft Vendor

2024-11-28T23:53:28.1366667+00:00

Hi HASSAN BIN NASIR DAR,

Thank for getting back.

I hope it helps

Refer this doc: https://zcusa.951200.xyz/en-us/entra/identity/domain-services/network-considerations?source=recommendations#user-defined-routes

Thanks,
Rohith
HASSAN BIN NASIR DAR 326 Reputation points

2024-11-29T00:40:21.72+00:00

I have already studied this article but I could not understand.

Can you please define me in easy way with practical approach if you have solved this issue before.

I have explained you what routes I have added. What should I do next? Should I change the route? If “yes” then please tell me what route should be added. Thanks

regards
Rohith Vinnakota 1,515 Reputation points Microsoft Vendor

2024-11-29T22:46:45.3733333+00:00

Hi HASSAN BIN NASIR DAR,
We are looking into it and will get back to you soon.
Thank you.
Rohith
HASSAN BIN NASIR DAR 326 Reputation points

2024-12-02T09:41:58.5+00:00

Hi

any update?

regards
Rohith Vinnakota 1,515 Reputation points Microsoft Vendor

2024-12-02T23:46:30.95+00:00

Hi HASSAN BIN NASIR DAR,

Thank for getting back.

By default, there is a route where 0.0.0.0/0 points to the internet. We created a new user-defined route where the destination 0.0.0.0/0 points to the next-hop firewall. This configuration overrides the default route that points to the internet. You can verify this in the NIC's effective routes, where you will see that the 0.0.0.0/0 route with the next hop as "internet" is marked as invalid. Additionally, the 0.0.0.0/0 route with the next hop as "firewall" is in a valid state.

Machines in the subnet associated with the route table will use the firewall's private IP to access the internet. As stated earlier, the 0.0.0.0/0 route with the next hop as "internet" is invalid, which is causing the error.

Please let me know the source of the error message you're receiving.

Note: The Entra Domain Services subnet does not support a 0.0.0.0/0 UDR.

Thanks,
Rohith
HASSAN BIN NASIR DAR 326 Reputation points

2024-12-03T12:16:07.8066667+00:00

Hi

thanks for your reply.

actually we want to protect our all traffic through firewall. Thats why we use 0.0.0.0/0

Everything is OK. Nothing dropped. But we are getting warning for entra domain services from the logs.

I just wanted to know that can it be any problem for any service like patching etc or not?

Regards
Rohith Vinnakota 1,515 Reputation points Microsoft Vendor

2024-12-04T20:56:49.6166667+00:00

Hi HASSAN BIN NASIR DAR,

We appreciate your Patience!

I just wanted to know that can it be any problem for any service like patching etc or not?

It should not affect services such as patching or synchronization, and the warning can be safely ignored.
Hope this helps!

Thanks,

Rohith
Rohith Vinnakota 1,515 Reputation points Microsoft Vendor

2024-12-05T18:13:24.52+00:00

Hi HASSAN BIN NASIR DAR,

Good day!

Just checking in to see if you have got a chance to see my response to your question in resolving the issue.

Looking forward to your response and appreciate your time on this.

Regards,

Rohith

1 answer

Rohith Vinnakota 1,515 Reputation points Microsoft Vendor

2024-12-09T16:42:24.3366667+00:00
Hi HASSAN BIN NASIR DAR,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that two routes are working fine, but you're experiencing the error.

A user defined route table has detected that includes a 0.0.0.0/0 route where the next hop is not configured for Internet.

This warning can be safely ignored.

Because by default, there is a route where 0.0.0.0/0 points to the internet. We created a new user-defined route where the destination 0.0.0.0/0 points to the next-hop firewall. This configuration overrides the default route that points to the internet. You can verify this in the NIC's effective routes, where you will see that the 0.0.0.0/0 route with the next hop as "internet" is marked as invalid. Additionally, the 0.0.0.0/0 route with the next hop as "firewall" is in a valid state.

Machines in the subnet associated with the route table will use the firewall's private IP to access the internet. As stated earlier, the 0.0.0.0/0 route with the next hop as "internet" is invalid, which is causing the error.

Please let me know the source of the error message you're receiving.

Note: The Entra Domain Services subnet does not support a 0.0.0.0/0 UDR.

Refer this link:
https://zcusa.951200.xyz/en-us/entra/identity/domain-services/network-considerations?source=recommendations#user-defined-routes

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Send all traffic to the internet through the Check Point firewall except Entra Domain services

1 answer

Your answer