You have a Site-to-Site VPN between an on-premises network and an Azure VPN gateway. BGP is disabled for the Site-to-Site VPN. You have an Azure virtual network named Vnet1 that contains a subnet…

Adding an additional Site-to-Site VPN is unnecessary and would complicate the network architecture; a single VPN gateway can route to multiple subnets within its VNet.

Adding a private endpoint is for privately accessing Azure services over a private IP address from a VNet, not for enabling general connectivity from on-premises to a new Azure subnet.

Adding a route table to Subnet2 might be necessary for outbound traffic from Subnet2 or for overriding default Azure routing, but it does not address the issue of the on-premises network not knowing how to reach Subnet2.

When BGP is disabled on a Site-to-Site VPN, routes between the on-premises network and Azure are not automatically exchanged. When a new subnet (Subnet2) is added to the Azure VNet, the on-premises routers will not automatically learn about this new address space. To allow connectivity from on-premises to Subnet2, the routing table on the on-premises routers must be manually updated to include a static route for Subnet2's address range, pointing traffic towards the Azure VPN gateway.