Azure Virtual WAN is a global transit network service that uses a hub-and-spoke architecture. A secured virtual hub adds a firewall instance, such as Azure Firewall or a partner network virtual appliance (NVA), directly inside the hub to inspect and filter all inter-spoke, branch, and Internet traffic. This approach centralizes security controls and enforces a Zero Trust stance by denying by default and only allowing traffic that matches explicit rules. Virtual hubs connect in a full mesh, providing any-to-any connectivity across branches, VNets, and users. The hub acts as the routing fabric where policies can be consistently applied.
To protect traffic flows, you deploy Azure Firewall and define a Firewall Policy in Azure Firewall Manager. The policy can be created from scratch, derived from a base, or imported from an existing firewall. Firewall Manager lets you centrally link this policy to multiple secured virtual hubs, ensuring consistent rule sets across regions. Trusted security providers advertise a default route (0.0.0.0/0) into the hub so that private and Internet traffic can be steered through partner NVAs. This integration ensures that both Internet and private traffic are forwarded through the appropriate security stack.
Policy-based routing uses hub route tables and routing settings to steer traffic to the firewalls or NVAs. You define custom route tables with routes that specify an address prefix and a next hop (for example, the private IP of Azure Firewall or NVA). Routes are applied to the virtual hub, and connections (spoke VNets or sites) can opt in or out of forced tunneling. You can also group routes with labels and adjust hub infrastructure units for additional scale, accommodating thousands of VMs per hub without manual UDRs.
Implementation can be performed via the Azure portal or Azure PowerShell. In the portal, browse to Firewall Manager → Secured Hubs, select a hub, and configure Internet Traffic via Azure Firewall and Private Traffic via the partner, adding Private Traffic Prefixes as needed. Using PowerShell, you run cmdlets like New-AzVirtualWan, New-AzVirtualHub, New-AzFirewallPolicy, New-AzFirewall, New-AzVirtualHubRouteTable, and Update-AzVirtualHub to programmatically deploy and update hubs, firewalls, and custom routes. This approach enables automation, repeatable deployments, and zone redundancy for availability.
Secured virtual hubs with policy-based routing and firewall integration offer key benefits: centralized security with uniform policies across all regions, scalability through automated spoke setup, hub infrastructure units, and availability zones, optimized routing by leveraging Azure’s backbone for full mesh connectivity, and compliance via granular traffic inspection and logging. These capabilities allow you to enforce Zero Trust, minimize the attack surface, and maintain high availability and performance in your global Azure network.
A system architecture diagram showing spoke VNets and branch sites routing traffic through custom route tables in a secured virtual hub to Azure Firewall, with Firewall Manager linking policy and a default route enabling forced tunneling to the Internet.
Are you a guardian of your domain? Lean how to leverage your aptitude in security to protect Microsoft Azure technologies, with a goal of earning the Microsoft Certified: Azure Security Engineer Associate certification!
Prepare and test your skills
Prepare and test your skills
A secured virtual hub is an Azure Virtual WAN hub that contains an integrated firewall instance, such as Azure Firewall or a partner network virtual appliance (NVA), directly inside the hub to inspect and filter traffic across spokes, branches, and the Internet. This architecture centralizes security controls and enforces a Zero Trust posture by denying traffic by default and only permitting traffic matching explicit rules.
Policy-based routing uses custom hub route tables with defined address prefixes and next hops, such as the private IP address of Azure Firewall or a partner network virtual appliance (NVA), to direct traffic through security instances. Connected spoke virtual networks and sites can opt in or out of forced tunneling, and routes can be organized using labels to support scaling without manual user-defined routes.
Azure Firewall Manager centrally defines a Firewall Policy that can be created from scratch, derived from a base policy, or imported from an existing firewall, and links it across multiple secured virtual hubs to maintain consistent rules across regions. It also facilitates integration with trusted security providers that advertise a default route into the hub to steer Internet and private traffic through the appropriate security stack.
StudyCerts
StudyCerts