Explanation:
You do not need to create the virtual Wide Area Network (WAN) named VWAN-CompanyA with type Basic to support the required remote connection types. In order to support the site-to-site (S2S) virtual private network (VPN) and the ExpressRoute connection type, you need to create the virtual WAN with type Standard. The Basic type virtual WAN supports site-to-site VPN only.
The Standard type supports the following connection types:
- ExpressRoute
- User VPN (P2S)
- VPN (site-to-site)
- Inter-hub and VNet-to-VNet transiting through the virtual hub
- Azure Firewall
- Network Virtual Appliance (NVA) in a virtual WAN
You should create a virtual hub inside the VWAN-CompanyA virtual WAN entity to create the S2S VPN connection. The virtual hub is the representation of the region that you want to connect the different remote and virtual networks to. A virtual WAN can contain different hub entities representing different regions. By design, the resource in different hubs can communicate with each other and you do not need to configure any special connectivity for that.
A virtual WAN hub gateway should be used to connect VNet1, VNet2, and VNet3 with the head office resources via S2S VPN connection. You can create different VPN sites inside the virtual hub and then simply connect from there. In order to enable connectivity between the virtual networks and the remote VPN users, you will also need to associate the required VNets to the virtual WAN hub entity.