Azure Virtual WAN Architecture
A unified, global network architecture that connects branches, remote users, and datacenters to Azure and each other.
Overview
Azure Virtual WAN provides a central hub that aggregates multiple connectivity options—site‑to‑site VPN, ExpressRoute, point‑to‑site (P2S) VPN, and Azure Firewall—as well as routing, security, and monitoring capabilities.
Core Components
- Virtual WAN Hub – Central routing and security point per Azure region.
- VPN Gateways – Site‑to‑site and point‑to‑site gateways attached to the hub.
- ExpressRoute Circuits – Private, dedicated connections to Azure datacenters.
- Azure Firewall (optional) – Centralized network threat protection.
- Branch Connectivity – Azure Virtual WAN uses VPN devices or SD‑WAN appliances.
- Policy & Routing – Automated routing tables, BGP, and security policies.
Hub‑and‑Spoke Topology
The hub acts as a transit hub for traffic between spokes (virtual networks, on‑premises sites, and remote users). This model simplifies management and reduces the number of required peering relationships.
az network vnet create \
--resource-group MyResourceGroup \
--name SpokeVNet \
--address-prefixes 10.1.0.0/16
az network vnet peering create \
--resource-group MyResourceGroup \
--name SpokeToHub \
--vnet-name SpokeVNet \
--remote-vnet MyVwanHubVNet \
--allow-forwarded-traffic \
--allow-gateway-transit
Branch Connectivity
Branches can connect via IPsec/IKE VPN or supported SD‑WAN appliances. Azure Virtual WAN automatically provisions the VPN gateway and distributes configuration to the devices.
| Device Type | Supported Protocols | Typical Use‑Case |
|---|---|---|
| Cisco ISR | IPsec, IKEv2 | Enterprise branch with existing Cisco infrastructure |
| Palo Alto Panorama | IPsec, SSL VPN | Secure branch with firewall integration |
| Azure VPN Appliance (Linux/Windows) | OpenVPN, SSTP | Lightweight remote‑office setup |
Security & Governance
Azure Virtual WAN integrates with Azure Firewall, Azure DDoS Protection, and Azure Policy to enforce security and compliance across the network.
- Centralized threat detection with Azure Firewall Manager.
- Route filtering using Azure Firewall policy and network security groups.
- Compliance reporting via Azure Monitor and Log Analytics.
Best Practices
- Use a single hub per Azure region, and hub‑to‑hub connectivity for global reach.
- Enable Azure Firewall for default deny‑all inbound traffic.
- Leverage Azure Policy to enforce naming conventions and security standards.
- Monitor bandwidth and latency with Azure Monitor metrics dashboards.
- Implement BGP prefixes for dynamic routing with ExpressRoute.