When your network spans multiple regions and requires connectivity between on-premises sites and Azure, a simple hub-and-spoke model may not be enough. Azure Virtual WAN is a managed networking service that brings together networking, security, and routing functionalities into a single operational interface. It's designed to simplify large-scale, global transit network architectures.

The foundation of your Virtual WAN deployment is the SKU you choose. This choice dictates the capabilities and scale of your network from the outset. For small-scale deployments, a Basic SKU might suffice, but enterprise needs typically demand the Standard SKU.

The Standard SKU unlocks the full potential of Virtual WAN, enabling transitive routing between all connected spokes. This means a branch office in one region can communicate with a VNet in another, all routed through the managed Virtual WAN hubs, without complex user-defined routes (UDRs) or extensive VNet peering configurations.

For global enterprises, a multi-hub architecture is the standard. You deploy a Virtual WAN hub in each Azure region where you have a presence. These hubs are automatically connected to each other via Microsoft's global backbone, creating a full mesh network. This setup allows for low-latency paths between regions without you having to manage the underlying connectivity.

Traffic between two VNets in different regions, or between a branch in Europe and a VNet in Asia, will automatically route through the nearest hubs and across the Microsoft network. This avoids hairpinning traffic through a single central point and significantly improves performance for globally distributed users and applications.

The real power of the Standard Virtual WAN hub lies in its sophisticated routing engine. It acts as a cloud-native router that you can customize to meet specific traffic engineering requirements. Unlike traditional hub-and-spoke setups that rely on UDRs and NVAs in a central VNet, Virtual WAN centralizes and simplifies this control.

You can create custom route tables within each hub. These tables allow you to segregate traffic and create isolated routing domains. For example, you can have one route table for production traffic and another for development, ensuring they never mix. Route maps can then be used to apply these tables to specific VNet connections or branch sites.

This granular control is essential for integrating Network Virtual Appliances (NVAs) like third-party firewalls. Instead of complex UDRs, you can simply create a route in the hub's route table that directs all internet-bound traffic (0.0.0.0/0) or traffic between specific spokes to the NVA for inspection. This simplifies management and reduces the potential for misconfiguration.

Branch-to-branch connectivity is also enabled by default with the Standard SKU. Two remote offices connected to the same Virtual WAN can communicate with each other through the nearest hubs, with traffic flowing over the Microsoft backbone, ensuring reliable and performant connectivity without needing to set up direct links between them.

A single Virtual WAN hub is not a single virtual machine. It's a scalable, managed service. The capacity of a hub is measured in routing infrastructure units. Each unit provides a certain amount of aggregate throughput for VNet and branch connectivity.

The default deployment starts with two units for redundancy, providing up to 2 Gbps of throughput. As your traffic demands grow, you can scale the hub's capacity up. A Standard hub can scale to support up to 50 Gbps for VNet-to-VNet traffic, ensuring it can handle the demands of large and growing enterprise networks.

It's time to test your knowledge on these advanced routing concepts.

Understanding these Virtual WAN capabilities is crucial for designing scalable, secure, and performant global networks on Azure.