So you’ve designed it, deployed it, and secured it, now comes the unglamorous but critical part: operating it. A secure hub-and-spoke without monitoring and governance is like buying a coffee machine and never descaling it: it looks impressive, but eventually it’ll clog and let you down.
Operationalising the Hub-and-Spoke
A successful deployment needs three things in steady state:
- Monitoring & Analytics
- Governance & Cost Controls
- Referenceable End-State Architecture
Monitoring with Azure Native Tools
You can’t secure what you can’t see. Wire in visibility from day one:
- Azure Monitor — Baseline telemetry for VNets, connections, NSGs, and traffic flows.
- Traffic Analytics — Analyses NSG flow logs to surface patterns, hotspots, and potential misconfigurations.
- Azure Sentinel (Microsoft Sentinel) — SIEM integration for correlation, detections, and incident response. Ingest logs from Firewall, App GW WAF, VPN, and NSGs.
- Workbooks & Dashboards — Don’t forget simple dashboards for the teams who need quick answers.
Governance & Cost Considerations
Security appliances don’t run on goodwill alone:
- Firewall vs NVA
- Azure Firewall Premium is scalable and integrated, but NVAs may be justified for niche features (advanced user-ID, IPSec termination).
- Traffic Costs
- Remember: inter‑VNet traffic via hubs incurs data processing and bandwidth charges. Don’t be surprised when east-west chatter racks up bills.
- Policy Governance
- Centrally manage NSGs and Firewall Policy using Azure Policy definitions.
- Deploy guardrails for subnet creation, route changes, or direct internet exposure.
End-State Reference Architecture
At this stage, you’ve got all the ingredients in place:
graph TD
Internet --> FW[Azure Firewall Premium]
FW --> AGW[App Gateway + WAF v2]
AGW --> WebApp["Web Spoke(s)"]
FW --> Data["Data Spoke(s)"]
FW --> Shared[Shared Services]
Monitor[Azure Monitor/Sentinel] --> FW
Monitor --> AGW
Monitor --> NSGs
Everything feeds into monitoring, everything is governed by policy, and every spoke routes securely via the hub.
Checklist (End-State Readiness)
- Hub contains Firewall, Gateway, Logging
- Spokes use UDRs routing to Firewall
- NSGs applied for subnet boundaries
- App Gateway WAF fronting inbound web apps
- Logs flowing to Sentinel/Log Analytics
- Azure Policy applied for guardrails
- Cost reviews scheduled regularly
Gotchas & Edge Cases
- Log Noise — Sentinel dashboards can swamp you if you don’t tune. Get your query hygiene sorted.
- Certificate Lifecycle — Between TLS inspection and AppGW listeners, be ready for cert renewal processes.
- Multi‑Region Scaling — If you replicate the hub, keep Firewall Policy consistent across regions to avoid drift.
Best Practices
- Bake operational logging into your IaC modules — don’t make it a manual add‑on.
- Leverage Azure Policy for drift correction (e.g. enforce NSG, UDR rules).
- Benchmark firewall usage costs monthly and optimise rules to avoid excess logging or unnecessary routing.
- Run periodic architecture reviews — networks sprawl quickly; a neat hub-and-spoke can turn into spaghetti if left unchecked.
Brewed Insight: It’s tempting to treat hub-and-spoke as a “set and forget” — but that’s how you end up with stale beans and bitter coffee. To actually deliver value, you need ongoing monitoring, cost awareness, and policy enforcement. A well‑run hub-and-spoke is less about the tech and more about the discipline.