← Azure projects

Azure · Reference Architecture

Azure Hub-and-Spoke Network Architecture

Centralize shared connectivity, inspection, and DNS in an Azure hub while keeping workload networks isolated in spokes with deliberate routing between them.

PlatformAzure
DomainNetworking
LevelAdvanced
Last reviewed2026-09-19
Use whenProvide scalable shared networking for multiple Azure workloads while keeping workload networks isolated and centrally governed.
Key decisionKeep workloads out of the hub
Primary servicesAzure Virtual Network · VNet Peering · Azure Firewall
Cost focusAzure Firewall
On this page

Building blocks

Azure Virtual NetworkVNet PeeringAzure FirewallVPN GatewayExpressRouteAzure BastionAzure Private DNS

Design goal

Scale connectivity across multiple workloads without turning the network into an any-to-any mesh or placing application resources inside the shared-services hub.

Architecture

A central hub hosts shared connectivity and security services. Application workloads remain in spoke VNets and use peering plus controlled routing to consume shared services.

On-premisesHub VNetSpoke ASpoke BShared Services
On-premises
Hub VNet
Hub provides independent connectivity to
Spoke A
Spoke B
Shared Services

Architecture decisions

Decision

Keep workloads out of the hub

Why

Use the hub for shared platform services and keep application resources in spokes.

Trade-off

A clean hub keeps shared services stable, but spoke teams must use explicit routes and shared-service interfaces instead of local shortcuts.

Decision

Centralize inspection

Why

Use Azure Firewall or another approved inspection layer when traffic policy requires centralized enforcement.

Trade-off

Central inspection improves policy consistency and observability, but can add latency, processing cost, routing complexity, and a shared failure domain.

Networking

Make the traffic path explicit. Use non-overlapping address spaces, explicit route intent, and centralized DNS resolution for hybrid and private endpoint scenarios.

Security

Protect the control and data paths deliberately. Apply least-privilege network rules, centralized logging, controlled egress, and private endpoints for PaaS where appropriate.

Availability

Design for the failure domain that must be survived. Design gateway, firewall, and shared services for zone resilience where supported and avoid single dependencies in DNS or identity.

Disaster recovery

Treat regional recovery as a separate operating state. Duplicate required hub services in the recovery region when multiregion recovery is required; workload DR remains workload-specific.

Cost drivers

  • Azure Firewall
  • VPN/ExpressRoute gateways
  • Bastion
  • Private DNS Resolver
  • inter-region and peering traffic

Design assumptions

  • Address spaces are non-overlapping
  • Central networking ownership is defined
  • Routing and DNS requirements are documented

Implementation plan

  1. Define non-overlapping address space and decide which connectivity, inspection, DNS, and management services belong in the hub.
  2. Build the hub with the required gateway, firewall/NVA, resolver, and shared-service subnets while keeping application resources in spokes.
  3. Peer spokes to the hub and configure gateway transit or remote-gateway use only where the connectivity model requires it.
  4. Create route tables that make inspection and egress paths explicit; avoid route propagation that creates unintended spoke-to-spoke reachability.
  5. Link the required Private DNS zones/resolvers and validate routing, name resolution, and failure behavior from representative spokes.

Validate the design

  • Inspect effective routes from representative spokes and confirm ingress, egress, hybrid, and inspection paths match the design.
  • Attempt a disallowed spoke-to-spoke flow and confirm routing/security policy blocks it.
  • Resolve representative on-premises and private-endpoint names from a spoke and confirm the intended DNS path.
  • Fail or bypass a planned hub dependency in a controlled test and confirm the documented failure behavior.

Architecture basis

Continue a learning path