Global Vnet Peering (None Paired Region)

Question

Hello Experts,

If I have a hub & spoke set up in an azure region, is it optimal to set up global vnet to connect it with another Non paired secondary so that the non paired secondary region can make use of the shared services in the hub (such as the NVA) for traffic inspection and routing.

Answer 1

Hi,

Unfortunately, the answer is "it depends" (sorry, I don't like when people answer this).

It really depends on your requirements and preferences.
My recommendation would be to have a central hub and indeed have all the spoke connecting to it. That being said, while this is the ideal architecture from a security point of view (central point of management), it might not be the ideal architecture from a networking perspective.
Depending on your requirements, you might find that it is better to have multiple hub and spokes networks, all with their own NVA, connected together through each Hub. This of course increases the cost (appliances, maintenance, etc.), and the security exposure, but it's a much better design from a networking perspective.

I would also recommend to look at Azure Virtual WAN:
https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-about
https://www.youtube.com/watch?v=UcOogJIu3Dw

Hope this helps,

Stephane

(Please don't forget to accept helpful replies as answer)