Azure Virtual WAN
What it is
Azure Virtual WAN is a managed hub-and-spoke networking service that consolidates branch (site-to-site), remote-user (point-to-site), VPN, and ExpressRoute connectivity into a set of virtual hubs Microsoft operates across regions. Each hub carries routing, and can host Azure Firewall and network security groups.
Why it exists
Traditional hub-and-spoke with separate VPN gateways, route tables, NSGs, and peering is complex to operate at scale across many regions. Virtual WAN gives one management plane for branch/remote/hybrid connectivity with global transit routing — administrators connect spokes to a hub instead of hand-managing peering and gateways per region.
Key ideas
- Virtual hubs — regional hubs that own routing, gateways (VPN Site-to-Site, Point-to-Site, ExpressRoute) and optional Azure Firewall.
- Global transit — spokes in different regions route through hubs; transitive routing (unlike plain peer non-transitivity) is handled by the hub/routing infrastructure.
- Branch-to-VNet, VNet-to-VNet, VNet-to-branch over the Microsoft backbone; no internet egress between them.
- Standard vs Basic tiers: Standard adds ExpressRoute, global transit, fireworks integration, etc.
- Routing is propagated automatically to spokes; you can override with custom route destinations (UDR style).
How it fits
[Branch A]─┐ ┌─[Spoke VNet 1]
[Branch B]─┼─► [Virtual Hub A] ┼─[Spoke VNet 2]
[Remote user] ├─(peer to hub)
[ER circuit] └─► transit to [Virtual Hub B] (other region)
Diagram courtesy of Microsoft Learn / Azure docs: virtual-wan/virtual-wan-about
Exam notes
- Virtual WAN provides transitive connectivity via its hub, a contrast to basic vnet-peering.
- One Virtual WAN per region; standard tier required for ExpressRoute and global transit.
- Deleting a hub/vWAN removes underlying gateways; be careful with
Dependencyand billing.
Related
Home · vnet · vpn-gateway · expressroute · vnet-peering · azure-firewall
📘 Source: Microsoft Learn — Virtual Wan