What is Azure Virtual WAN?
Virtual WAN is an Azure network service, managed by Microsoft, that offers you optimal and automated connectivity on a global scale. However, when this hub-and-spoke architecture first hit the market in 2019, it was still missing many important network features. And it had quite a few limitations, which meant it couldn't meet the needs of the general public: "to provide a unified framework for networking, cybersecurity, and routing".
But in the past 5 years, Microsoft has worked very hard to improve this service. They have added a whole range of new features. And lifted some of the existing limitations, which also brings many advantages. Now we have even reached a point where Azure Virtual WAN has become our favorite hub-and-spoke network architecture.
But why exactly? Let's go over the main advantages together. And look at how we can tackle potential challenges.
Key functions and features
Before we delve into the pros and cons, it might be useful to first examine the various services and components of Azure Virtual WAN. And to discover how they provide high-speed connections with the Azure backbone:
The Virtual WAN hub
Complete mesh hubs through which all traffic flows. Upon creation, you get an address space and various routing tables.
Hub-to-Hub connections
These connections ensure interregional connectivity between all on-prem and Azure network endpoints.
Virtual hub router
This component supports custom routing tables for virtual networks. And functions as a default table for branches (P2S, S2S, ER). Additionally, it also connects to routing tables. And distributes routes from connections to tables.
Connection between sites
There are different types of connections:
- Any-to-any branch to Azure
- Branch to branch
- Users to branch
- Virtual network (vNet) to virtual network transit
- VPN to ExpressRoute transit connectivity
Secure virtual hub
This provides additional security, thanks to the integration of the Azure Firewall Manager. With it, you can:
- Create a policy and apply it to multiple firewalls
- Working across regions, subscriptions, deployments, ...
- Secure your internet traffic (virtual network to internet and branch to internet)
- Secure your private traffic (virtual network to and from a branch)
When you combine these services and features, you can expand your network architecture. You ensure secure transit connectivity paths between multiple spokes, branches, and regions.

Important to know
There are 2 variants of Azure Virtual WAN: basic and standard. At Arxus, we only implement the standard version because the basic variant only supports S2S VPN connections.