Hub-and-Spoke Cloud Network on Azure
A hub-and-spoke topology on Azure that centralizes firewall, gateway, and DNS services in a hub while isolating each workload in a peered spoke. It gives consistent connectivity, central inspection, and clean isolation that scales across teams and regions.
What and When
The hub-and-spoke topology centralizes shared network services in a single hub virtual network and isolates each workload in its own spoke. Spokes connect to the hub through peering and route outbound and cross-spoke traffic through shared appliances. Use it when many teams need consistent connectivity, central inspection, and clean isolation without each team rebuilding firewalls and gateways.
This is the default network topology in most Azure landing zones because it scales to dozens of workloads while keeping security controls in one place.
Components
- Hub virtual network hosts shared services: the firewall, gateways, and DNS.
- Azure Firewall inspects and filters east-west and north-south traffic with threat intelligence.
- VPN Gateway (or ExpressRoute) provides hybrid connectivity to on-premises data centers.
- VNet peering links each spoke to the hub with low-latency private routing.
- Private DNS zones resolve private endpoints consistently across spokes.
- Azure Bastion gives secure RDP/SSH access without public IPs; Network Watcher provides flow logs and diagnostics.
Data Flow
A workload in a spoke needs to reach the internet or another spoke. User-defined routes send the traffic to the Azure Firewall in the hub, which applies allow rules and logs the flow. Traffic to on-premises crosses the VPN Gateway over an encrypted tunnel. Private endpoints in spokes resolve through the central private DNS zones, so workloads reach managed services without traversing the public internet.
Scaling and Resilience
New workloads onboard by deploying a spoke and peering it to the hub; no change to existing spokes is needed. Azure Firewall scales automatically and supports availability zones. Deploy gateways zone-redundant, and use multiple hubs (one per region) joined by global peering for multi-region resilience. Because peering is non-transitive, spoke-to-spoke traffic must route through the hub, which keeps inspection centralized.
Security
All cross-segment traffic passes through the firewall, giving a single choke point for inspection and logging. Spokes cannot talk to each other directly, limiting lateral movement. Apply network security groups for host-level rules, route management access through Bastion, and disable public IPs on workloads. Feed firewall and flow logs into a SIEM and align segmentation with zero-trust principles.
Trade-offs and Alternatives
Central inspection adds latency and a potential bottleneck, and the firewall becomes a critical dependency. Virtual WAN is a managed alternative that simplifies large multi-region meshes but offers less control. A flat network is cheaper and simpler for a handful of workloads but does not scale securely. For very large estates, combine multiple hubs with Azure Virtual WAN to balance control and operational overhead.