In a previous post, I showcased how to: Create a Single Gateway, Multi-Region, VPN Architecture in Microsoft Azure. If testing with Windows didn’t work, it may be because Windows has to have its route tables updated to know how to tunnel past the gateway into the different regions. MAC and Linux can use IKEv2 without additional route adding, because those clients pick up the pushed routes from the IKEv2 negotiation itself; the Windows VPN client does not, which is why it needs the fix below.

A. For Windows, by default, it chooses IKEv2, we need to add a route to your spoke VNET

Windows route print output listing the network interfaces and the IPv4 route table, with the Interface column highlighted to show the VPN adapter address

Suppose the VNET spoke address space is 10.2.0.0 255.255.0.0, and Client VPN interface IP is 172.16.100.130

Command prompt running route add 10.2.0.0 mask 255.255.0.0 172.16.100.130, which returns OK!

B. We also need to test the CMAK or manually create a SSTP VPN profile to Azure on Windows client.