Because VNet1 and VNet2 are peered, and VNet1 already has a VPN gateway using static routing, the most cost-effective method is to use service chaining with UDRs. This allows: * Traffic from on-premises to traverse the VPN gateway * Routing across peered VNets without deploying additional gateways * No additional ExpressRoute or firewall costs Microsoft documentation states: "User-defined routes enable custom routing across peered virtual networks for transit scenarios." Azure Firewall and Application Gateway add unnecessary cost. ExpressRoute is the most expensive option.