A reference network design for enterprise Azure environments, built around Azure Virtual WAN as the hub with spoke VNets for workload isolation and centralized security inspection.
Why hub-and-spoke over a flat network
Centralizing egress, firewall inspection, and shared services (DNS, identity, monitoring) in the hub avoids duplicating security infrastructure per workload team while still giving each spoke VNet full network isolation from its neighbors.
Hub components
Azure Firewall Premium for centralized egress inspection and TLS inspection where compliance requires it; a shared services subnet for domain controllers and DNS forwarders; and ExpressRoute or VPN Gateway for on-premises connectivity.
Spoke design patterns
Each business unit or application gets its own spoke VNet peered to the hub, with network security groups enforcing east-west restrictions and user-defined routes forcing all egress through the hub firewall rather than direct internet access.
Leave a Reply