Skip to content

Commit 648d13a

Browse files
author
Michael Bender
committed
Initial commit - moved branch
1 parent 1fbba4a commit 648d13a

File tree

2 files changed

+213
-0
lines changed

2 files changed

+213
-0
lines changed

‎articles/virtual-network-manager/how-to-deploy-spoke-to-spoke-topology-two-hubs.md

Lines changed: 213 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,213 @@
1+
---
2+
title: How to deploy Spoke-to-Spoke with two hubs
3+
description: Learn how to deploy a Spoke-to-Spoke topology with two hubs using Virtual Network Manager.
4+
author: mbender-ms
5+
ms.author: mbender
6+
ms.date: 05/07/2024
7+
ms.service: virtual-network-manager
8+
ms.topic: how-to
9+
# customer intent: As a network administrator, I want to deploy a Spoke-to-Spoke topology with two hubs using Virtual Network Manager.
10+
---
11+
12+
# How to deploy Spoke-to-Spoke topology with two hubs
13+
14+
In this article, you'll learn how to deploy a Spoke-to-Spoke topology with two hubs using Virtual Network Manager. This scenario is useful when you have a hub and spoke architecture in multiple Azure regions. In the past, customers with firewalls or network virtual appliances performed many manual operations to do cross-hub and spoke in the past. Users needed many user-defined routes to be set up by hand, and when there were changes in spoke virtual networks, such as adding new spoke virtual networks and subnets, they also needed to change user-defined routes and route tables. UDR management with Virtual Network Manager can help you automate these tasks.
15+
16+
## Prerequisites
17+
18+
:::image type="content" source="media/how-to-deploy-spoke-to-spoke-topology-two-hubs/spoke-to-spoke-two-hubs-topology-network-manager.png" alt-text="Diagram of spoke to spoke topology with two hub and spoke networks and resources.":::
19+
20+
- An Azure subscription with a Virtual Network Manager deployed with UDR management enabled.
21+
- Two hub and spoke topologies deployed in different Azure regions.
22+
- Azure firewall instances deployed in each regional hub - total of two instances.
23+
- Hub virtual networks in each region are peered with each other.
24+
- Virtual machines deployed in the spoke virtual networks in each region to confirm network connectivity across regions.
25+
26+
> [!NOTE]
27+
> For this scenario, you need to have two hub and spoke topologies deployed in different Azure regions. Examples in this scenario will use **West US 2** as **Region 1** and **West US 3** as **Region 2**. You may use any other Azure regions as needed.
28+
29+
## Create network groups
30+
31+
In this step, you deploy four network groups to represent the spoke virtual networks in each hub and spoke topology. You also create network groups for the subnet of the Azure firewall instances in each region.
32+
33+
| **Network group name**| **Description** | **Member type** | **Members** |
34+
|--------------------|-------------|
35+
| ng-spoke-<region1> | Network group for spoke virtual networks in region 1. | Virtual network | Spoke virtual networks in region 1. |
36+
| ng-spoke-<region2> | Network group for spoke virtual networks in region 2. | Virtual network | Spoke virtual networks in region 2. |
37+
| ng-azfw-<region1> | Network group for Azure Firewall subnet in region 1. | Subnet | Azure Firewall subnet in region 1. |
38+
| ng-azfw-<region2> | Network group for Azure Firewall subnet in region 2. | Subnet | Azure Firewall subnet in region 2. |
39+
40+
1. In the Azure portal, navigate to your network manager instance.
41+
2. In the left pane, select **Network groups** under **Settings**.
42+
3. Select **+ Create**.
43+
4. In the **Create a network group** window, enter the following details then select **Create**:
44+
| **Field** | **Value** |
45+
|-------|-------|
46+
| **Name** | Enter **ng-spoke-<region1>** or the name of the network of the first hub virtual network in region one. |
47+
| **Description** | Enter a description for the network group. |
48+
| **Member type** | Select **Virtual network** from the dropdown menu. |
49+
1. Repeat the steps create the remaining network groups for the spoke virtual networks in region 2 and the Azure Firewall subnets in each region based on the table above.
50+
51+
## Add members to the network groups
52+
53+
In this step, you add the spoke virtual networks and Azure Firewall subnets to the network groups you created.
54+
55+
1. In the network manager instance, navigate to **Network groups** under **Settings**.
56+
2. Select the network group for the spoke virtual networks in region 1 - **ng-spoke-<region1>**.
57+
3. Under **Manage membships of your network group**, select **Add virtual networks**.
58+
4. In the **Manually add members** window, select the spoke virtual networks in region 1, then select **Add**.
59+
60+
## Deploy hub and spoke topologies in each region
61+
62+
In this step, you deploy two hub and spoke topologies in different Azure regions. You use connectivity configurations in your network manager.
63+
64+
1. In your network manager instance, navigate to **Configurations** under **Settings**.
65+
2. Select **+ Create**>**Connectivity configuration**.
66+
3. In the **Basic** tab of the **Create a connectivity configuration** window, enter a name and description for the first connectivity configuration.
67+
4. Select the **Topology** tab or **Next: Topology**.
68+
5. In the **Topology** tab, select the following details:
69+
70+
| **Field** | **Value** |
71+
|-------|-------|
72+
| **Topology** | Select **Hub and spoke**. |
73+
| **Hub** | Choose **Select a hub** and select the hub virtual network in region 1. |
74+
| **Spoke network groups** | Select **Add*.</br>In the **Add network groups** window, select the spoke network groups from region 1: **ng-spoke-<region1>**,**ng-spoke-<region2>** |
75+
76+
6. Select the **Visualization** tab or **Next: Visualization** to review the topology.
77+
7. Select **Review + create** then **Create and start deployment** to deploy the connectivity configuration.
78+
8. In the **Deploy a configuration** window, select your configuration for region 1 under **Connectivity configurations**.
79+
9. Under **Regions**, select all regions where you want to deploy the configuration.
80+
10. Select **Next** and **Deploy** to deploy the configuration in region 1.
81+
11. Repeat the steps to create and deploy a connectivity configuration for the second hub and spoke topology in region 2.
82+
83+
## Create a Routing configuration and Rule collections
84+
85+
In this step, you create a routing configuration containing four rule collections to manage the network groups created earlier.
86+
87+
| **Rule collection name** | **Description** | **Target network group** |
88+
|-----------------------|-------------|----------------------|
89+
| rc-spoke-<region1> | Rule collection for spoke virtual networks in region 1. | ng-spoke-<region1> |
90+
| rc-spoke-<region2> | Rule collection for spoke virtual networks in region 2. | ng-spoke-<region2> |
91+
| rc-azfw-<region1> | Rule collection for Azure Firewall subnet in region 1. | ng-azfw-<region1> |
92+
| rc-azfw-<region2> | Rule collection for Azure Firewall subnet in region 2. | ng-azfw-<region2> |
93+
94+
1. In your network manager instance, navigate to **Configurations** under **Settings**.
95+
2. Select **+ Create**>**Routing configuration - Preview**.
96+
3. In the **Create a routing configuration** window, enter a name and description for the routing configuration.
97+
4. Select **Next: Rule collections** or the **Rule collections** tab.
98+
5. In the **Rule collections** tab, select **+ Add** or **Add**.
99+
6. In the **Add a rule collection** window, enter or select the following details, then select **Add**:
100+
101+
| **Field** | **Value** |
102+
|------|-------|
103+
| **Name** | Enter a name for the rule collection for **ng-spoke-<region1>**. |
104+
| **Description** | Enter a description for the rule collection. |
105+
| **Local route setting** | Select **Not specified**. |
106+
| **Target network group** | Select the network group for the spoke virtual networks in region 1. |
107+
108+
7. Repeat the steps to create rule collections for the remaining network groups: **ng-spoke-<region2>**, **ng-azfw-<region1>**, and **ng-azfw-<region2>**.
109+
8. Select **Add** to add the rule collections to the routing configuration.
110+
9. select **Next: Review + create** or **Review + create** to review the routing configuration.
111+
10. Select **Create** to create the routing configuration.
112+
113+
114+
## Create routing rules for each Rule collection
115+
116+
In these steps, you create routing rules in each rule collection to manage traffic between the spoke virtual networks and the Azure Firewall subnets in each region.
117+
118+
### Create a routing rule for spoke virtual networks in region 1
119+
In this step, you create a routing rule for the spoke virtual networks in region 1 allowing communication with the Azure Firewall subnet in region 1.
120+
121+
1. In your network manager instance, navigate to **Configurations** under **Settings**.
122+
2. Select the routing configuration you created for the spoke virtual networks in region 1.
123+
3. In the left pane, select **Rule collections** and select your first rule collection - **rc-spoke-<region1>**.
124+
4. In the **Edit a rule collection** window, select **+ Add**.
125+
5. In the **Add a routing rule** window, enter or select the following information:
126+
127+
| **Field** | **Value** |
128+
|------|-------|
129+
| **Name** | Enter a name for the routing rule for. |
130+
| **Destination type** | Select **IP Address**. |
131+
| **Destination IP addresses/CIDR ranges** | Enter the default route of **0.0.0.0/0**.|
132+
| **Next hop type** | Select **Virtual appliance**.</br> Select **Import Azure firewall private IP address**. Select the Azure Firewall in region 1. |
133+
134+
6. Select **Add** to add the routing rule to the rule collection.
135+
7. Select the **X** to close the **Edit a rule collection** window.
136+
137+
### Create a routing rule for Azure Firewall in region 1
138+
139+
In these steps, you create a routing rule for the Azure Firewall subnet in region 1 allowing communication with the spoke virtual networks in region 2.
140+
141+
For this example, the remote regions address prefixes will be summarized. Summarizing address prefixes offers the benefit of not needing to change the routing rules for the FW subnet even if new spokes are added to each region. However, it's important to pre-define the address prefixes used in each region, including for future use.
142+
143+
1. In the **Rule collections** window, select the rule collection for the Azure Firewall subnet in region 1 - **rc-azfw-<region1>**.
144+
2. 4. In the **Edit a rule collection** window, select **+ Add**.
145+
3. In the **Add a routing rule** window, enter or select the following information:
146+
147+
| **Field** | **Value** |
148+
|------|-------|
149+
| **Name** | Enter a name for the routing rule for. |
150+
| **Destination type** | Select **IP Address**. |
151+
| **Destination IP addresses/CIDR ranges** | Enter the summarized address prefix for the remote region - region 2. In this example, **10.1.0.0/16** is used.|
152+
| **Next hop type** | Select **Virtual appliance**.</br> Select **Import Azure firewall private IP address**. Select the remote Azure Firewall in region 2. |
153+
154+
155+
4. Select **Add** to add the routing rule to the rule collection.
156+
5. Select the **X** to close the **Edit a rule collection** window.
157+
158+
> [!NOTE]
159+
> A summarized prefix allows you to use a larger address range for the destination IP addresses. This is useful when you have multiple spoke virtual networks in each region and you want to avoid adding multiple routing rules for each spoke virtual network. Also, future changes to the spoke virtual networks in each region will not require changes to the routing rules for the Azure Firewall subnet.
160+
161+
### Create a routing rule for spoke virtual networks in region 2
162+
163+
In this step, you create a routing rule for the spoke virtual networks in region 2 allowing communication with the Azure Firewall subnet in region 2.
164+
165+
1. In the **Rule collections** window, select the rule collection for the spoke virtual networks in region 2 - **rc-spoke-<region2>**.
166+
2. In the **Edit a rule collection** window, select **+ Add**.
167+
3. In the **Add a routing rule** window, enter or select the following information:
168+
169+
| **Field** | **Value** |
170+
|------|-------|
171+
| **Name** | Enter a name for the routing rule for. |
172+
| **Destination type** | Select **IP Address**. |
173+
| **Destination IP addresses/CIDR ranges** | Enter the default route of **0.0.0.0/0**.|
174+
| **Next hop type** | Select **Virtual appliance**.</br> Select **Import Azure firewall private IP address**. Select the Azure Firewall in region 2. |
175+
176+
4. Select **Add** to add the routing rule to the rule collection.
177+
5. Select the **X** to close the **Edit a rule collection** window.
178+
179+
### Create a routing rule for Azure Firewall in region 2
180+
181+
In these steps, you create a routing rule for the Azure Firewall subnet in region 2 allowing communication with the spoke virtual networks in region 1.
182+
183+
1. In the **Rule collections** window, select the rule collection for the Azure Firewall subnet in region 2 - **rc-azfw-<region2>**.
184+
2. In the **Edit a rule collection** window, select **+ Add**.
185+
3. In the **Add a routing rule** window, enter or select the following information:
186+
187+
| **Field** | **Value** |
188+
|------|-------|
189+
| **Name** | Enter a name for the routing rule for. |
190+
| **Destination type** | Select **IP Address**. |
191+
| **Destination IP addresses/CIDR ranges** | Enter the summarized address prefix for the remote region - region 1. In this example, **10.0.0.0/16** is used.|
192+
| **Next hop type** | Select **Virtual appliance**.</br> Select **Import Azure firewall private IP address**. Select the remote Azure Firewall in region 1. |
193+
194+
4. Select **Add** to add the routing rule to the rule collection.
195+
5. Select the **X** to close the **Edit a rule collection** window.
196+
197+
## Deploy the routing configuration
198+
199+
In this step, you deploy the routing configuration to apply the routing rules to the spoke virtual networks and Azure Firewall subnets in each region.
200+
201+
1. Browse to **Configurations** under **Settings** in your network manager instance.
202+
2. Select the checkbox next to the routing configuration you created, and select **Deploy** from the taskbar.
203+
3. In the **Deploy a configuration** window, select all regions where you want to deploy the routing configuration.
204+
4. Select **Next** and **Deploy** to deploy the routing configuration.
205+
206+
## Adding spoke virtual network to the existing Multi Hub-Spoke topologies
207+
208+
## Next steps
209+
210+
## Next steps
211+
212+
> [!div class="nextstepaction"]
213+
> [How to deploy hub and spoke topology with Azure Firewall](how-to-deploy-hub-spoke-topology-with-azure-firewall.md)

‎articles/virtual-network-manager/media/how-to-deploy-spoke-to-spoke-topology-two-hubs/spoke-to-spoke-two-hubs-topology-network-manager.png

58.4 KB
Loading

0 commit comments

Comments
 (0)