Architecting Hub-and-Spoke Network Topologies in Microsoft Azure

Introduction

As enterprise cloud footprints expand, managing network security and connectivity across dozens of independent subscriptions becomes a substantial challenge. Deploying a decentralized network model often results in fragmented security rules, redundant firewalls, and escalated costs. The Hub-and-Spoke topology addresses this complexity by centralizing shared infrastructure within a single “Hub” network.

Core Pillars of the Architecture

• The Hub: A Virtual Network (VNet) acting as the central point of connectivity. It hosts shared components such as Azure Firewall, Azure Bastion, Virtual Network Gateways, and central DNS servers.
• The Spokes: Separate VNets hosting specific application workloads. Spokes do not connect directly to each other; they connect only to the Hub via VNet Peering.

Defining a Route Table via Bicep

To enforce traffic filtering, user-defined routes (UDRs) inside Route Tables redirect outgoing spoke traffic through the central firewall:

resource spokeRouteTable 'Microsoft.Network/routeTables@2023-05-01' = {
  name: 'spoke-to-hub-rt'
  location: resourceGroup().location
  properties: {
    routes: [
      {
        name: 'RouteToHubFirewall'
        properties: {
          addressPrefix: '0.0.0.0/0'
          nextHopType: 'VirtualAppliance'
          nextHopIpAddress: '10.0.0.4'
        }
      }
    ]
  }
}