Hub-and-Spoke Cloud Network & Multi-Cloud VPN

A hub-and-spoke redesign of the organization's enterprise cloud network on Azure: a shared hub VNet carrying the VPN gateway and shared services, with every workload VNet peered in as a spoke, and Site-to-Site VPN connectivity out to both on-premises and Huawei Cloud.

I analyzed the existing network, designed the new architecture around it, and validated every real-world requirement, on-prem connectivity, cross-tenant spoke onboarding, multi-cloud VPN to Huawei Cloud, and Microsoft Entra Domain Services from the hub, in a test environment before rolling it out and decommissioning the redundant gateways.

As the organization's production environment grew, multiple VNets were created across production tenants, each connecting back to the on-premises network through its own VPN gateway. That per-VNet gateway sprawl was costing the organization a significant amount every month in Azure spend, just to maintain connectivity that didn't need to be duplicated in the first place.

The network was also difficult to maintain and difficult to reason about. Granting a resource in the enterprise network access from on-premises meant navigating whichever gateway and routing setup that particular VNet happened to have, with no consistent pattern across the environment.

1. Started by analyzing the entire existing enterprise cloud network: which VNets, gateways, and network appliances were already provisioned, and how they were actually being used.

2. Designed the new network architecture around what already existed, rather than a clean-slate redesign, since the solution had to work with the enterprise's current resources and network appliances, not replace them wholesale.

3. Based on that research, decided a hub-and-spoke architecture was the best fit: a central hub VNet holding the shared VPN gateway and shared services, with every workload VNet peered to the hub as a spoke instead of maintaining its own gateway.

4. Built a test environment on Azure to simulate every real network requirement before touching production: connectivity between on-premises and the hub, access from an on-premises device to a device on a spoke network routed through the hub, Site-to-Site VPN between on-premises and the hub gateway, and a separate Site-to-Site VPN between the hub gateway and Huawei Cloud VPCs.

5. Worked out how to onboard a spoke across tenant boundaries, since not every workload VNet lived in the same Azure tenant as the hub, so peering had to work across tenants rather than assuming everything sat under one.

6. Also validated how Microsoft Entra Domain Services would work from the hub network, since shared identity services needed to be reachable the same way from every spoke.

7. Segmented traffic with NSGs and coordinated DNS across the hub and spokes, and steered spoke-to-spoke and spoke-to-on-prem traffic through the hub using user-defined routes, rather than letting each spoke manage its own routing.

8. Rolled the architecture out and decommissioned the redundant per-VNet VPN gateways once their traffic was migrated onto the shared hub gateway.