You have an Azure subscription that contains two peered virtual networks named VNet1 and VNet2. VNet1 has a VPN gateway that uses static routing, The on-premises network has a VPN connection that…

Azure Firewall would incur significant additional costs and might be an unnecessary overhead for simple routing needs.

To extend on-premises connectivity to a peered virtual network (VNet2) through VNet1's existing VPN gateway, you must enable 'Gateway transit' on the VNet peering connection from VNet1 to VNet2. Additionally, User-Defined Routes (UDRs) in VNet2 should be configured to direct traffic destined for the on-premises network back through VNet1's gateway, leveraging existing infrastructure and minimizing costs.

Azure Application Gateway is a Layer 7 load balancer and web application firewall, not a routing solution for on-premises to peered VNet traffic, and would add substantial cost.

Deploying ExpressRoute circuits to VNet2 would be a costly and complex solution, requiring a new ExpressRoute setup, which violates the 'minimize costs' requirement.