Azure
Networking
advanced
Hub-Spoke Network Topology — Azure Architecture Template
Central hub VNet with firewall, VPN and bastion services peered to isolated production and development spokes.
Why this architecture works
- Shared services (firewall, VPN, bastion) live once in the hub instead of duplicated per workload
- Spoke-to-spoke and egress traffic is forced through the firewall by user-defined routes
- Firewall Manager applies one policy set across environments for consistent egress rules
- Bastion removes public RDP/SSH from every VM in every spoke
- Prod and dev spokes are separate VNets, so a dev misconfiguration cannot reach production
What's inside (11 resources)
Firewall Policy
firewall-manager
VPN Gateway
vpn-gateway
On-Prem Site
local-network-gateway
Hub Firewall
firewall
Hub VNet
virtual-network
Bastion
bastion-host
Spoke: Prod
virtual-network
UDR via Firewall
route-table
Spoke: Dev
virtual-network
Flow Logs
network-watcher
Logs
log-analytics-workspace
From template to running infrastructure
- Open this template in the CloudForge visual designer (free account, no credit card).
- Customize resources, names, and connections on the drag-and-drop canvas — or ask Vani, the AI architect, to adapt it.
- Generate production-ready Terraform, ARM, or Bicep in one click.
- Review the plan diff and security scan, then deploy with human approval.