I am setting up a new azure subscription for my workplace. We are using it for two things to begin with. Firstly for ASR of our on prem vmware environment and secondly for putting some workloads in cloud with comms to our on prem network. Both to be done over an express route virtual circuit.

We currently have 200 servers in prod total. I wouldn't expect more than 10-20% growth in the next few years.

I am trying to decide between having:

  • A hub and spoke networking type setup with vnet peering (one vnet per environment eg prod front end, prod back end and dr)
  • A single large vnet carved up into subnets seperated by network security groups and routing rules.
  • A combination of both of the above having two vnets (one for prod and one for DR) and carve the prod up into front end/back end subnets.

From reading the more recent recommendations by MS is to use the hub and spoke model with vnet peering? We will be maintaining an on prem data center so only need to live in one azure region for the foreseeable future so this seems ok to me.

What are your suggestions for those that have done it before?


Before going to Hub and Spoke model you have consider some limitations such as doing it through

  • VPN connection or Express routes not both to connect with the On premises
  • Hub & Spoke model have maximum of 50 VNet peering which I think you wont exceed it as per your clarification for the current model.

Consider to implement the right DMZ in the hub by using NVAs and NSG & UDR which is the best practice as per Microsoft.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.