Design a Virtual WAN architecture

2.4 Azure Virtual WAN

📘Microsoft Azure Networking Solutions (AZ-700)

---

Overview

Azure Virtual WAN is a networking service that helps you connect branches, on-premises sites, and users to Azure securely and efficiently. It’s designed for large-scale networks with many locations, and it simplifies network management and connectivity.

Think of it as a central hub in Azure where all your network connections converge, managed centrally.

Key features:

1. Centralized connectivity management – Manage multiple connections in one place.
2. Global reach – Connect users and offices worldwide.
3. Built-in routing – Automatically routes traffic between branches, hubs, and VNets.
4. Optimized performance – Uses Microsoft backbone for faster and more reliable connectivity.

---

Key Components of Virtual WAN Architecture

When designing a Virtual WAN, you need to understand its components:

1. Virtual WAN (VWAN) resource
   • This is the top-level Azure resource.
   • Acts as the container for hubs, connections, and routing policies.
2. Hubs
   • Each hub is an Azure region deployment within your VWAN.
   • Provides VPN, ExpressRoute, and SD-WAN connectivity.
   • Can host firewalls, routing policies, and other network appliances.
   • Types of hubs:
     • Standard Hub – For general connectivity.
     • Secure Hub – With Azure Firewall integration for security policies.
3. Virtual Hub
   • A regional instance of the hub.
   • Connects VNets, branch offices, and users in that region.
   • Each hub has its own IP address range and routing table.
4. Connections
   • Ways to connect to the hub:
     • Site-to-Site VPN – Connect on-premises networks.
     • Point-to-Site VPN – Connect individual users.
     • ExpressRoute – For high-speed private connections to Azure.
     • VNet peering – Connect Azure VNets to the hub.
   • Each connection uses the hub as a central routing point.
5. Routing and Security
   • Virtual WAN provides automated routing between hubs and connections.
   • You can enforce security with Azure Firewall, NVA (Network Virtual Appliance), or security policies.

---

Design Considerations for Virtual WAN

When designing Virtual WAN, you must decide:

1. Hub Placement

• Place hubs in regions where most traffic originates.
• Consider latency, performance, and regional compliance requirements.
• Multiple hubs can be connected for cross-region routing.

2. Connection Types

• Branch offices – Typically use Site-to-Site VPN or SD-WAN integration.
• Data centers – Prefer ExpressRoute for speed and reliability.
• Remote users – Use Point-to-Site VPN for secure access.
• VNets in Azure – Use hub-and-spoke model to connect to the virtual hub.

3. Routing Strategy

• Hub-to-Hub – Traffic between hubs flows through Microsoft backbone.
• Hub-to-Spoke (VNet) – Use VWAN routing to simplify VNet connectivity.
• Forced tunneling – Direct traffic from branches through a firewall for inspection.

4. Security Design

• Azure Firewall can be deployed in a secure hub.
• Routing policies can force branch traffic through firewalls.
• Network Security Groups (NSGs) still apply in VNets connected to the hub.

5. High Availability

• Use multiple hubs for redundancy in different regions.
• Each hub supports active-active VPN connections.
• ExpressRoute can have redundant circuits for reliability.

6. Monitoring and Management

• Virtual WAN integrates with Azure Monitor and Network Watcher.
• You can see connection status, performance, and routing details.
• Helps in troubleshooting network issues across all branches and VNets.

---

Virtual WAN Design Patterns

For the AZ-700 exam, you need to know common patterns:

1. Hub-and-Spoke
   • One or more hubs in regions.
   • VNets connect to hubs (spokes).
   • Traffic between VNets flows through the hub.
2. Branch-to-Hub-to-VNet
   • Branch offices connect via VPN or SD-WAN to the hub.
   • Hub routes traffic to VNets.
3. Multi-Region Hubs
   • Hubs in different Azure regions.
   • Traffic between regions uses Microsoft backbone.
   • Supports disaster recovery and load balancing.
4. Secure Hub
   • Hub with Azure Firewall.
   • Forces traffic through firewall for inspection before reaching VNets or on-premises.

---

Best Practices for Exam

1. Use one hub per region unless you have high traffic requirements.
2. Use hub-and-spoke model for simplicity.
3. Enable built-in routing instead of managing individual route tables.
4. Integrate Azure Firewall for centralized security.
5. Design for redundancy with multiple hubs and ExpressRoute/VPN circuits.
6. Monitor connections using Azure Monitor.

---

Summary for the Exam

When asked about designing a Virtual WAN architecture, remember these points:

• Virtual WAN = central hub for all connectivity (branches, VNets, users).
• Components: Virtual WAN resource → Hubs → Connections → Routing/Security.
• Design considerations: hub placement, connection types, routing, security, availability.
• Patterns: hub-and-spoke, branch-to-hub, multi-region hubs, secure hub.
• Best practices: centralized routing, Azure Firewall, monitoring, redundancy.