Network Topology

The network topology decides how workload networks connect to each other, to on-premises and to the internet. Getting it right before workloads depend on it avoids a painful re-addressing later. Building it before any workload needs it wastes money.

• IP Address Management
• Private Endpoints and Egress

Status: planned

No hub is deployed. connectivity-prod-westeu-00 is reserved for it.

---

When to build a hub

Build the shared network when the first of these is true:

• a workload needs private endpoints that other workloads, or people, must reach;
• traffic must be inspected or filtered centrally, for example egress through a firewall;
• on-premises or partner connectivity is needed (VPN or ExpressRoute);
• two or more workloads need to talk privately.

Until then, workloads on PaaS services with public endpoints (Static Web Apps, for example) don't need a virtual network. Adding one early only adds cost and moving parts.

Hub-and-spoke or Virtual WAN

	Hub-and-spoke (customer-managed)	Azure Virtual WAN
Hub	A VNet you build, with a firewall, gateways and Azure Bastion	A Microsoft-managed virtual hub
Control	Full: routing, NVAs, every setting	Less: routing is largely managed for you
Best for	One or two regions, small to medium estates	Many regions, many branches, large-scale VPN
Cost	Lower at small scale	A hub charge, and higher at small scale
Complexity	You manage UDRs and peering	Simpler at scale

Recommendation: use hub-and-spoke in connectivity-prod-westeu-00. The platform is single-region (westeurope) and small. Review this if a second region or many branch sites appear.

Target design

flowchart TB
    subgraph CONN["connectivity-prod-westeu-00 (hub)"]
        FW["Azure Firewall"]
        GW["VPN / ExpressRoute gateway<br/>(if needed)"]
        DNSR["DNS Private Resolver"]
        BAS["Azure Bastion"]
    end
    subgraph SPOKE1["Workload subscription (spoke)"]
        VNET1["Spoke VNet"]
    end
    subgraph SPOKE2["Workload subscription (spoke)"]
        VNET2["Spoke VNet"]
    end
    VNET1 <-->|peering| CONN
    VNET2 <-->|peering| CONN
    CONN -->|filtered egress| NET["Internet"]

• Spokes peer only with the hub. Spoke-to-spoke traffic goes through the firewall.
• Default route from each spoke to the firewall, using a route table. Enforce it with policy once the hub exists.
• Spokes are created by subscription vending, with an address range from the IP plan. Peering to the hub is made at the same time.
• Tier: the hub is Tier 1 (management plane, mg-connectivity) and is delivered through Lane B. The workload spoke VNets are Tier 2.