Thinking about which azure network topology in my case !!

Question

Hello ,

we have a datacenter head office and small datancenters for branch offices in the world and only one azure subscription
we have an only one vnet in this subscription linked via vpn gateway to the datacenter head office .for billing purpose , i will create for each branch office an azure subscription and i ll create a subscription for shared services to be used for all branch offices .so i'm thniking for the best network topology for my case .Should i create a virtual hub network in the shared subscription then create vpn gateway for all branch offices and a peering network between branch offices subscription and shared subscription with enabling transit gateway ?

to simplify
Head Office : A
Head Office Azure Subscription : SA
Branch offices : B1,B2,B3
Branch office Azure subscription : SB1,SB2,SB3
Shared Subscription : SH

So , i ll create a vrtual hub on SH with vpn gateways to B1,B2 and B3
then create peering between vnets SH/SB1 ,SH/SB2,SH,SB3

Please help!

Answer 1

Hi @APTOS ,

if I got your requirement and scenario right you could just create peerings between the vNets in different subscriptions.
https://learn.microsoft.com/en-us/azure/virtual-network/create-peering-different-subscriptions

There is no need to install a VPN Gateway in each subscription (vNets).

I would recommend one "hub vNet" with the VPN Gateway to the on-premises environment and peerings to all "branch vNets" with the option to use the VPN Gateway in the "hub vNet".

----------

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards
Andreas Baumgarten

Answer 2

Hello ,
I thank you.

for the hub vNet .could i control network branch offices to be isolated ?so vnet SB1 can't connect to vnet SB2 ....

Regards