How to create HUB and Spoke network topology with multiple subscription?

Question

How to create HUB and Spoke network topology with multiple subscription?

Siya Kumari 536

Hello team,

We want to set up Azure Hub and Spoke network topology with multiple Azure Subscription and with on-premises connectivity i.e. our Hub should be in different Azure Subscription and Spokes should be in different Azure subscriptions.

Can anyone suggest any blog to which I can refer?

Thanks!

KapilAnanth-MSFT 49,611 Reputation points Microsoft Employee Moderator

2023-11-02T06:14:08.86+00:00
@Siya Kumari

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you would like to know the best practices for Azure Hub and Spoke network topology with multiple Azure Subscription(s).

May I ask,

Are you planning to use Azure vWAN or regular Hub VNet and Spoke VNet(s) topology?

For OnPremise connectivity, are you planning to use VPN or ExpressRoute?

In any case, please note :

#1 - Azure Subscription is a logical boundary for billing. It does not affect Peering between two VNETs (Hub and Spoke) in two different subscriptions.

Refer : Create a virtual network peering in different subscriptions

Regular VNET:

You can refer to the documentation on Hub-spoke network topology in Azure for more details on Hub VNet and Spoke VNet(s) topology.

Please make sure the VNET Gateway and the Hub VNET are in the same subscription/resource group.

Make sure Gateway Transit is enabled between the peering(s) from Spoke VNet(s) to Hub VNet.

vWAN

For vWAN scenario, refer: Hub-spoke network topology with Azure Virtual WAN

Hope this helps.

Cheers,

Kapil.
Siya Kumari 536 Reputation points

2023-11-03T05:12:26.9933333+00:00

Hi @KapilAnanth-MSFT thanks for your quick response. I just want to know if we use Azure Virtual WAN for Azure Hub and Spoke network topology then is it possible to customize the topology? As in the case of Azure VWAN Infrastructure is managed by Microsoft.
KapilAnanth-MSFT 49,611 Reputation points Microsoft Employee Moderator

2023-11-03T05:40:01.89+00:00
@Siya Kumari

You're welcome.

Yes, Azure vWAN only masks the Hub from you. You can still define the address range of the Hub

It let's you manage :

Virtual Networks (Spokes only) to be connect to the Hub

Azure Firewall which is directly deployed into the Hub

ExpressRoute/VPN Gateway that is deployed into the Hub

Most of the use cases of traditional Hub Spoke VNET architecture can be achieved by using a vWAN as well.

Kindly let us know if this helps or you need further assistance on this issue.

Thanks,

Kapil
Siya Kumari 536 Reputation points

2023-11-06T06:07:19.03+00:00

Thanks, @KapilAnanth-MSFT , I'm currently using Regular Vnet (Azure Virtual Network Manager) for Hub and Spoke network topology. I'll work with Azure VWAN in the future then I would like to get help from you.

Thanks!
KapilAnanth-MSFT 49,611 Reputation points Microsoft Employee Moderator

2023-11-06T06:12:18.4933333+00:00

@Siya Kumari

Sure.

You are most welcome.

I have summarized my comments and posted it as a new answer.

I would highly appreciate if you could Accept the answer and close this thread

Original posters help the community find answers faster by identifying the correct answer.

Thanks,

Kapil
KapilAnanth-MSFT 49,611 Reputation points Microsoft Employee Moderator

2023-11-07T11:44:03.64+00:00

@Siya Kumari

Reaching out to check if there are any questions on this.

Please let us know if we can be of any further assistance here.

Thanks,

Kapil

Please Accept an answer if correct.

Original posters help the community find answers faster by identifying the correct answer.
KapilAnanth-MSFT 49,611 Reputation points Microsoft Employee Moderator

2023-11-08T06:33:52.42+00:00

@Siya Kumari

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Thanks,

Kapil

Accepted answer

0 additional answers

Your answer

KapilAnanth-MSFT 49,611 Reputation points Microsoft Employee Moderator

2023-11-02T06:14:08.86+00:00

@Siya Kumari

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you would like to know the best practices for Azure Hub and Spoke network topology with multiple Azure Subscription(s).

May I ask,

Are you planning to use Azure vWAN or regular Hub VNet and Spoke VNet(s) topology?

For OnPremise connectivity, are you planning to use VPN or ExpressRoute?

In any case, please note :

#1 - Azure Subscription is a logical boundary for billing. It does not affect Peering between two VNETs (Hub and Spoke) in two different subscriptions.

Refer : Create a virtual network peering in different subscriptions

Regular VNET:

You can refer to the documentation on Hub-spoke network topology in Azure for more details on Hub VNet and Spoke VNet(s) topology.

Please make sure the VNET Gateway and the Hub VNET are in the same subscription/resource group.

Make sure Gateway Transit is enabled between the peering(s) from Spoke VNet(s) to Hub VNet.

vWAN

For vWAN scenario, refer: Hub-spoke network topology with Azure Virtual WAN

Hope this helps.

Cheers,

Kapil.
Siya Kumari 536 Reputation points

2023-11-03T05:12:26.9933333+00:00

Hi @KapilAnanth-MSFT thanks for your quick response. I just want to know if we use Azure Virtual WAN for Azure Hub and Spoke network topology then is it possible to customize the topology? As in the case of Azure VWAN Infrastructure is managed by Microsoft.
KapilAnanth-MSFT 49,611 Reputation points Microsoft Employee Moderator

2023-11-03T05:40:01.89+00:00

@Siya Kumari

You're welcome.

Yes, Azure vWAN only masks the Hub from you. You can still define the address range of the Hub

It let's you manage :

Virtual Networks (Spokes only) to be connect to the Hub

Azure Firewall which is directly deployed into the Hub

ExpressRoute/VPN Gateway that is deployed into the Hub

Most of the use cases of traditional Hub Spoke VNET architecture can be achieved by using a vWAN as well.

Kindly let us know if this helps or you need further assistance on this issue.

Thanks,

Kapil
Siya Kumari 536 Reputation points

2023-11-06T06:07:19.03+00:00

Thanks, @KapilAnanth-MSFT , I'm currently using Regular Vnet (Azure Virtual Network Manager) for Hub and Spoke network topology. I'll work with Azure VWAN in the future then I would like to get help from you.

Thanks!
KapilAnanth-MSFT 49,611 Reputation points Microsoft Employee Moderator

2023-11-06T06:12:18.4933333+00:00

@Siya Kumari

Sure.

You are most welcome.

I have summarized my comments and posted it as a new answer.

I would highly appreciate if you could Accept the answer and close this thread

Original posters help the community find answers faster by identifying the correct answer.

Thanks,

Kapil
KapilAnanth-MSFT 49,611 Reputation points Microsoft Employee Moderator

2023-11-07T11:44:03.64+00:00

@Siya Kumari

Reaching out to check if there are any questions on this.

Please let us know if we can be of any further assistance here.

Thanks,

Kapil

Please Accept an answer if correct.

Original posters help the community find answers faster by identifying the correct answer.
KapilAnanth-MSFT 49,611 Reputation points Microsoft Employee Moderator

2023-11-08T06:33:52.42+00:00

@Siya Kumari

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Thanks,

Kapil

Answer 1

@Siya Kumari

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you would like to know the best practices for Azure Hub and Spoke network topology with multiple Azure Subscription(s).

Please note that Azure Subscription is a logical boundary for billing. It does not affect Peering between two VNETs (Hub and Spoke) in two different subscriptions.

Refer : Create a virtual network peering in different subscriptions

With Regular VNET Hub and Spoke:

You can refer to the documentation on Hub-spoke network topology in Azure for more details on Hub VNet and Spoke VNet(s) topology.

Please make sure the VNET Gateway and the Hub VNET are in the same subscription/resource group.
Make sure Gateway Transit is enabled between the peering(s) from Spoke VNet(s) to Hub VNet.

With Azure vWAN,

This only masks the Hub from you.

It still let's you manage :

Virtual Networks (Spokes only) to be connect to the Hub
Azure Firewall which is directly deployed into the Hub
ExpressRoute/VPN Gateway that is deployed into the Hub
Define the address range of the Hub even

Almost all of the use cases of traditional Hub Spoke VNET architecture can be achieved by using a vWAN as well.

Thanks,

Kapil

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

Share via

How to create HUB and Spoke network topology with multiple subscription?

0 additional answers

Your answer