Azure Hub and Spoke Topology - Where to locate VMs with Public IP

Question

In a Azure Hub and Spoke Network Topology is the idea that every VM which needs to be accessed from external via Public IP (direct assigned, via Loadbalancer...), is located in the Hub Network?
Or is the Hub only for all Services which are shared for the Spoke Vnets?

So if I have a VM with a certain Service which is only used in one Spoke Vnet and from public but not in the other spoke vnets, should I place the VM in the Hub Network or in this certain Spoke Network? For this example I would use a LoadBalancer with a NAT for a certain Port to the VM.

Answer 1

Hi @Nathanael Santschi

IN a hub-spoke topology the idea is to place a central Azure Firewall in it's own subnet in the hub network. Any public IPs are attached to this central firewall to enable all management of access to the network in a central, easy to audit place. All the spokes should route traffic through this firewall to enable control of traffic between the spokes. Again in one central place.

This diagram on Microsoft Learn gives a good overview of the setup and the document contains a clear explanation of the various components that make a hub-spoke topology

Services are typically placed in the spokes with exceptions for some infrastructure services like central DNS for your network.

Answer 2

@Roderick Bant
Well sure that makes sense.

In the scenario where I'm wondering about that, there isn't a Azure Firewall in place right now. But other components like VPN Gateway in the Hub. So it is probably still legitimate to use the Hub and Spoke topology. Azure Firewall can be added later on if needed.

But only to make a small Service public available I don't think Azure Firewall is needed.
Using a Load Balancer with a Public IP and a NAT configured + NSGs and Subnet segmentation should be good enough as well right?

So placing the VM in the Spoke network with a Loadbalancer + NAT setup would make sense as well? And later on if this environment grows we could still add an Azure Firewall and assign the Public IPs there.