Connecting to nested AzSHOSTn VMs from root of resource group

[shishirm-cohesity]

We have deployed a HCIBox instance inside a dedicated resource group. For a specific test case, we need to communicate from a VM at the root of the resource group to the AzSHOSTn VMs inside HCIBox. The reverse channel seems to work but that's not what we're looking for. Any recommendations about how this can be accomplished? Any HCIBox deployment tweaks that could help?

[rbrk-tpm-jshaver]

I need the same for some testing... Need to be able to communicate with the AzSHOST's from outside of HCI-Client.

[Arnth]

I've been banging my head on this for a bit this week. I'm not an expert on how the network was architected for the HCIClient box, however, if you create static NetNat mappings for inbound NAT ports to an internally hosted resource, it will work. I just haven't been able to make all traffic flow. For example, mapping 3392 to 3389 onto the AzMgmt box works:

Add-NetNatStaticMapping -NatName InternalNAT -ExternalIPAddress "0.0.0.0" -ExternalPort 3392 -Protocol TCP -InternalIPAddress "192.168.128.5" -InternalPort 3389

https://learn.microsoft.com/en-us/powershell/module/netnat/add-netnatstaticmapping?view=windowsserver2022-ps

I'd love to know how to make all inbound traffic work. I deployed a Virtual Network Gateway to the vNet. From the HCIClient where I've deployed RRAS and setup a S2S tunnel, nothing routes beyond allowing other Azure resources to hit the internal interfaces of the HCIClient VM, but nothing further downstream.

I'm trying to get this working so I can deploy some AVD session hosts into Azure for connecting to the HCI infrastructure and jumpstart.local domain as a demo/test environment.