Landing Zone and
Networking
A guide to WAN, Hub-Spoke, on-premises connectivity, BGP, FW, UDR, and NSG that anyone can follow step by step. Grasp the roles from the overall map first, then dig into only the chapters you need.
First, see the whole as a map
Networking is an area where looking only at individual settings can be confusing. First organize where to connect, where to separate, where to protect, and which path to route through.
Chapter list
For meeting materials or customer briefings, explaining in the order of big picture, connectivity, Hub-Spoke, BGP, traffic control, and operations gets the message across well.
Big Picture: Landing Zone and Networking
Landing Zone networking should be considered as a set of connectivity, separation, routing, traffic control, and operations. Before diving into individual service names, confirm the overall roles on a map.
→ 2WAN / Connectivity: ER, VPN, vWAN
ExpressRoute, VPN, and Virtual WAN are all connectivity options, but their purposes differ. What matters is deciding the entry point based on the number of sites, bandwidth, SLA, and operational structure.
→ 3Choosing Between vWAN and Hub-Spoke
vWAN consolidates managed wide-area connectivity; Hub-Spoke is a VNet-centric design with fine-grained self-control. Neither is the single right answer; choose by scale and operational policy.
→ 4Hub-Spoke Network
The Hub holds shared functions and entry points; Spokes are where business systems reside. Design Gateway Transit, UDR, and Firewall routing control as a set.
→ 5Connecting On-premises and Azure / BGP
BGP is a mechanism where routers automatically exchange routes. Many routes appearing in Azure's effective routes are learned from ExpressRoute or the on-premises side.
→ 6Effective Routes and Longest Match
The routes used by VM traffic are the effective routes, a combination of system routes, UDR, and BGP routes. 0.0.0.0/0 is the last resort; more specific routes take priority.
→ 7Roles of FW, UDR, and NSG
NSG allows/denies, UDR changes routes, and Azure Firewall does centralized inspection. Designing each role separately helps avoid unintended bypasses.
→ 8Operations / DR, Monitoring, Standardization
For networks, being able to explain and fail over during incidents is key. Keep effective routes, Next Hop, logs, and DR procedures ready in normal times.
→Key messages for explanations
When effective routes or BGP are involved as in this case, first establish the following three as a shared understanding.
Route tables alone are not enough
What a VM actually uses is the effective routes. UDR, BGP, and system routes are combined.
Determined by longest match
More specific routes such as /24 or /16 take priority over 0.0.0.0/0.
BGP advertises automatically
Routes received from the peer router may appear as Gateway Routes on the Azure side.
Intended as reference material
This page is structured as an entry point for customer briefings, design discussions, and internal reviews. For detailed design, always cross-check Microsoft Learn with your environment's effective routes, Next Hop, and BGP-advertised routes.