Sorry in advance if this seems like a basic question, but I'm trying to wrap my head around the best way to structure a service catalogue.

A lot of the guidance online suggests to write it from the user perspective, to provide them with clear guidance on what services the business offers. However from an IT perspective, I also care about the infrastructure underlying all the services, and how these are provided.

So do people have a separate catalogue for these? Is it all in one, and can users see both, and just separated using categories?

I'll preface this by saying I've very little experience with BGP, so sorry in advance if I've missed something obvious!

What I'm trying to establish

When using an active-active VPN gateway in Azure, they require you to use BGP to establish routes. They provide 2 public IP addresses to terminate 2 IPSec tunnels, and 2 private IPs in the VPN gateway subnet, to peer with for BGP. There's one IP per tunnel.

However for the local connection, Azure only lets you specify 1 local BGP peer IP address for your local public IP address. This means you can't have 2 local addresses to peer with for BGP for each shared public IP. The solution then would be to use a loopback address with a dedicated IP, that both Azure instances behind each tunnel could peer with. However I can't seem to get it working.

What's Working

IPsec VPN connected to Azure gateway

Tunnel is assigned a private IP address, that matches local BGP peer IP address configured in Azure.

Remote address on tunnel is first Azure BGP peer IP address in gateway subnet.

Remote BGP neighbour on FortiGate configured with first Azure BGP peer IP address, set to use tunnel interface.

BGP routes start Peering.

What's not working

IPsec VPN connected to Azure gateway

Loopback Interface is assigned a private IP address, that matches local BGP peer IP address configured in Azure.

Firewall rule allows BGP traffic from tunnel to loopback

Static route created for Azure BGP peer IP address, telling it to go via Azure tunnel

I can see BGP traffic hitting the loopback Interface, but the neighbors are stuck on idle.

What am I missing?

I'll preface this by saying that although I have good networking knowledge, this is my first foray into Azure networking.

I have a Hub and Spoke Landing Zone design for my Azure tenancy, with a VPN Gateway in my Hub network for on-premises connectivity. However my VMs currently have default outbound access, which I'd like to move to a NAT gateway design.

I've added an extra subnet to my hub VNET and deployed a NAT gateway to it, however all the designs I've seen online include an NVA, with a UDR on the spoke VNET route table to point to the private IP of the NVA, which then has default outbound access by virtue of being in a VNET with an attached NAT Gateway.

Is an NVA or Azure Firewall actually required here, or do I simply need a UDR to point the default route for each spoke network to the hub network?

Thanks in advance!