Merge pull request #184719 from laghimp/ddos-branch

Added section for Hub-and-Spoke topology with Firewall and Bastion in Hub, both protected by DDoS Standard.

Author: Court72

articles/ddos-protection/ddos-protection-reference-architectures.md

@@ -2,14 +2,13 @@
 title: Azure DDoS Protection reference architectures
 description: Learn Azure DDoS protection reference architectures.
 services: ddos-protection
-documentationcenter: na
 author: aletheatoh
 ms.service: ddos-protection
 ms.topic: article
-ms.tgt_pltfrm: na
 ms.workload: infrastructure-services
-ms.date: 09/08/2020
+ms.date: 01/19/2022
 ms.author: yitoh
+ms.custom: fasttrack-edit
 ---
 
 # DDoS Protection reference architectures
@@ -74,6 +73,26 @@ In this architecture, traffic destined to the HDInsight cluster from the interne
 For more information on this reference architecture, see the [Extend Azure HDInsight using an Azure Virtual Network](../hdinsight/hdinsight-plan-virtual-network-deployment.md?toc=%2fazure%2fvirtual-network%2ftoc.json)
 documentation.
 
+
+> [!NOTE]
+> Azure App Service Environment for PowerApps or API management in a virtual network with a public IP are both not natively supported.
+
+## Hub-and-spoke network topology with Azure Firewall and Azure Bastion
+
+This reference architecture details a hub-and-spoke topology with Azure Firewall inside the hub as a DMZ for scenarios that require central control over security aspects. Azure Firewall is a managed firewall as a service and is placed in its own subnet. Azure Bastion is deployed and placed in its own subnet.
+
+There are two spokes that are connected to the hub using VNet peering and there is no spoke-to-spoke connectivity. If you require spoke-to-spoke connectivity, then you need to create routes to forward traffic from one spoke to the firewall, which can then route it to the other spoke.
+
+:::image type="content" source="./media/ddos-best-practices/image-14.png" alt-text="Screenshot showing Hub-and-spoke architecture with firewall, bastion, and DDoS Protection Standard" lightbox="./media/ddos-best-practices/image-14.png":::
+
+Azure DDoS Protection Standard is enabled on the hub virtual network. Therefore, all the Public IPs that are inside the hub are protected by the DDoS Standard plan. In this scenario, the firewall in the hub helps control the ingress traffic from the internet, while the firewall's public IP is being protected. Azure DDoS Protection Standard also protects the public IP of the bastion.
+
+DDoS Protection Standard is designed for services that are deployed in a virtual network. For more information, see [Deploy dedicated Azure service into virtual networks](../virtual-network/virtual-network-for-azure-services.md#services-that-can-be-deployed-into-a-virtual-network).
+
+> [!NOTE]
+> DDoS Protection Standard protects the Public IPs of Azure resource. DDoS Protection Basic, which requires no configuration and is enabled by default, only protects the Azure underlying platform infrastructure (e.g. Azure DNS). For more information, see [Azure DDoS Protection Standard overview](ddos-protection-overview.md).
+For more information about hub-and-spoke topology, see [Hub-spoke network topology](/azure/architecture/reference-architectures/hybrid-networking/hub-spoke?tabs=cli).
+
 ## Next steps
 
 - Learn how to [create a DDoS protection plan](manage-ddos-protection.md).