Enable hub‑to‑spoke propagation for automatic route advertisement. Use UDRs to control traffic flow when needed.
Hub‑Spoke Topology
The hub‑spoke topology in Azure Virtual WAN connects multiple virtual networks (spokes) to a central hub. This design simplifies connectivity, centralizes security, and optimizes routing.
Key Benefits
- Centralized traffic inspection and policy enforcement.
- Reduced number of point‑to‑point connections.
- Scalable architecture for multi‑region deployments.
- Consistent routing and security across all spokes.
When to Use
- Enterprise scenarios with many VNet workloads.
- Hybrid connectivity where on‑premises networks attach to the hub.
- Multi‑tenant SaaS platforms requiring isolated spokes.
Best Practices
Deploy Azure Firewall or a network virtual appliance in the hub to enforce security policies for all spokes.
Scale the hub’s VPN/ExpressRoute links based on aggregate traffic from spokes. Monitor with Network Watcher.
FAQ
Yes. A VNet can be peered to multiple hubs, allowing traffic to flow through different regions or security zones.
Latency depends on the distance between spokes and hub. For critical workloads, place the hub in the same region as the majority of spokes.