Azure Virtual WAN Overview
Azure Virtual WAN Overview

Organizations use site-to-site VPNs and ExpressRoute to connect on-premises networks to Azure. As an organization grows, so does the complexity of implementing and managing connectivity between the cloud and on-premises locations.

In this course, we review Azure Virtual Wide Area Network (WAN). Azure Virtual WAN creates a hub-and-spoke topology that provides a single interface for managing branch connectivity, user access, and connectivity between VNets. We also cover how Azure Virtual WAN hubs connect with other network resources to create a full mesh topology that serves as a backbone of a hybrid network.

Learning Objectives

  • Design an Azure Virtual WAN architecture
  • Understand the SKUs and related features of a Virtual WAN
  • Create a Virtual WAN hub
  • Create a network virtual appliance (NVA) in a virtual hub
  • Configure virtual hub routing
  • Understand connection units and scale units

Intended Audience

  • System or network administrators with responsibilities for connecting an on-premises network to Azure
  • Anyone preparing for the Azure AZ-700: Designing and Implementing Microsoft Azure Networking Solutions exam


  • A basic understanding of networking, routing, and VPN concepts
  • An Azure subscription (sign up for a free trial at if you don’t have a subscription)

The best place to start any journey is at the beginning. With this course, we'll start with what an Azure Virtual WAN or a WAN for that matter is. WAN stands for Wide Area Network. A WAN is used to connect two or more local area networks or LANs. For example, computers in an office are connected to a high-speed network, either physical or wireless. If the organization has multiple offices, they're connected by a WAN.

Now, it's expensive to run cable or fiber across long distances. Most organizations don't have the resources to connect remote sites with their own network. There are several solutions available for WAN connectivity. First is a site-to-site VPN between the locations. Another is to purchase a service such as MPLS or Dark Fibre or a software-defined WAN, also known as an SD WAN, could be used to connect the sites. Microsoft has their own solution with Azure Virtual WAN. That's the solution this course will focus on. Let's consider two design options for deploying a WAN. The first is what's called a hub and spoke network. With a hub and spoke network, all traffic is routed through a central location or hub. Each site connects to the hub and is referred to as a spoke. The remote site only requires one connection to the hub to pass traffic to the other sites.

This is a functional option, but has one rather significant flaw. Should the hub become unavailable, all communication between the sites would also become unavailable. The hub is a single point of failure in this model. The second option is a mesh network. With a mesh network, each node has a connection to the other nodes in the network. There is no single point of failure with a mesh network. If a node fails, the other nodes can still communicate, but there's a problem with mesh networks.

In the example on the screen, we have a total of six connections to connect four sites. As the number of sites increase, the number of connections needed to connect them grow as well. Adding two more nodes increases the number of connections to 12. As sites are added, the number of point-to-point connections required to connect a mesh network becomes unmanageable. So what we need is the best of both worlds, the reliability of a mesh network and the simplicity of a hub and spoke network. That's the value Azure Virtual WAN offers.

Azure Virtual WAN is a service that brings networking, security, and routing in one management plane to build a highly available hybrid network supporting cloud and on-premises services, as well as VPN clients. With Azure Virtual WAN, hubs are created in a given region. Once in place, endpoints connect to the Azure Virtual WAN. These endpoints can be site-to-site VPN, user VPN, ExpressRoute, or even VNets in Azure. Multiple connection points or hubs are created in Azure regions. This reduces latency by connecting endpoints to the Azure network in the same region. These regions are connected in a full mesh network.

In the end, we have multiple endpoints connecting to different hubs. Those hubs are connected to a full mesh network, providing that easy to manage highly available WAN network connecting your on-premises and remote sites to your cloud resources. Not only does this enable connectivity between cloud and on-premises resources, it also provides a global transit network architecture, allowing connectivity not just between on-premises and the Azure cloud, but also between all endpoints in the virtual WAN, leveraging Microsoft's private high-speed network for traffic between the hubs.

Now that we have an understanding of what Azure Virtual WAN is and the problems it's intended to solve, let's take a look at the services and specific Azure SKUs supported with Azure Virtual WAN.

About the Author

Travis Roberts is a Cloud Infrastructure Architect at a Minneapolis consulting firm, a Microsoft MVP, MCT, and author. Travis has 20 years of IT experience in the legal, pharmaceutical, and marketing industries and has worked with IT hardware manufacturers and managed service providers. In addition, Travis has held numerous technical certifications throughout his career from Microsoft, VMware, Citrix, and Cisco.