The vWAN approach
Gathers ER/VPN/P2S/VNet connections into a vHub, managed with route tables and propagation. Suited for environments with frequent site additions or where stronger standardization is desired.
Landing Zone Network Guide
3 Choosing Between vWAN and Hub-Spoke
vWAN consolidates managed wide-area connectivity; Hub-Spoke is a VNet-centric design with fine-grained self-control. Neither is the single right answer; choose by scale and operational policy.
Key points of this chapter
- vWAN is strong for many sites and regions
- Hub-Spoke makes fine control of UDR and NVA easier
- For east-west DR, whether the west side can operate alone is important
Explanation note
First explain the flow with a diagram, then supplement only the key points in text. For those unfamiliar with networking, showing where traffic flows before terminology is effective.
The Hub-Spoke approach
Places Gateway, Firewall, NVA, DNS, and so on in the Hub VNet, and connects Spoke VNets via peering. Suited for existing configurations and fine-grained route control.