Azure Networking: the Hub-Spoke Topology Explained

The network is the silent foundation

When something goes wrong in the cloud, the root cause is often the network: traffic that should not flow, unexpected latency, difficulty applying security consistently. A well-designed network is invisible when it works and catastrophic when improvised. In Azure, the pattern that solves most enterprise scenarios is the hub-spoke topology.

As a Microsoft partner and CSP, RHC designs these networks to provide segmentation, traffic control, and hybrid connectivity without turning operations into a maze.

Basic blocks: VNets and subnets

Everything starts with the Virtual Network (VNet), the private address space where your resources live. Inside it, you create subnets to segment workloads — web, application, database — each with its own rules. Traffic between subnets and from outside is controlled by Network Security Groups (NSGs), which act as network-layer firewalls.

A common mistake is poorly planning the address space. Mis-sized IP ranges or ones overlapping the on-premises environment cause headaches that are hard to reverse. IP planning must consider growth and hybrid integration from the start.

The hub-spoke model

In the hub-spoke topology, you separate responsibilities:

• Hub — the central VNet that concentrates shared services: firewall, hybrid connectivity gateway, DNS, and traffic inspection.
• Spokes — satellite VNets that host workloads, isolated from each other.

Spokes connect to the hub via VNet peering, and all sensitive traffic passes through the hub for inspection. This provides a single security control point and simplifies governance.

Central firewall and routing

The Azure Firewall in the hub inspects traffic going to the internet and between spokes, applying rules centrally. To force traffic through the firewall, you use user-defined routes (UDR), which direct packets from spokes to the hub before continuing. This design prevents each workload from having its own uncontrolled internet exit.

To protect published web applications, the Application Gateway with WAF (Web Application Firewall) adds a defense layer against common attacks at the edge.

Hybrid connectivity

Few companies migrate everything at once, so the cloud must talk to the local environment. There are two main options, anchored in the hub's gateway:

• Site-to-Site VPN — creates an encrypted tunnel over the internet. Fast to deploy and suitable for moderate bandwidth.
• ExpressRoute — a dedicated private connection that does not traverse the public internet. It offers low, predictable latency and high bandwidth, ideal for critical workloads and large volumes.

Many companies start with VPN and evolve to ExpressRoute as cloud dependence grows.

Segmentation and security

The network is where defense in depth is applied. Essential practices:

1. Isolate workloads by spoke and subnet — the database should never be directly reachable from the internet.
2. Restrictive NSGs — allow only necessary traffic, deny the rest.
3. Private Endpoints — access PaaS services (like managed databases and storage) over a private IP, removing them from public exposure.
4. No unnecessary public IP — each public IP is one more door for the attacker.
5. Private DNS for consistent internal resolution.

The zero-trust concept applies to the network: nothing is trusted by default, every access is verified.

Azure Virtual WAN for global scale

When a company has many branches and regions, managing peering and gateways manually becomes a burden. Azure Virtual WAN offers a managed hub that simplifies global connectivity, integrating branches, VPNs, ExpressRoute, and spokes into a mesh administered by Microsoft. It is the natural evolution of hub-spoke for large, distributed environments.

Checklist / Key takeaways

• Plan the IP address space considering growth and the hybrid environment.
• Adopt the hub-spoke topology to centralize security and connectivity.
• Force traffic through the Azure Firewall in the hub with user-defined routes.
• Choose VPN to start and ExpressRoute for critical workloads.
• Use restrictive NSGs and Private Endpoints to reduce exposure.
• Consider Azure Virtual WAN for global, multi-branch environments.

A well-designed network is what lets you grow in Azure securely and without rework. RHC architects this foundation aligned with the landing zone and the company's governance rules.