India’s Leading Domain & Web Hosting Provider
Support
Domain & Login
Blog
Azure Hub-Spoke, ExpressRoute & Hybrid Networking Services
Azure networking and hybrid connectivity is the set of services that carry traffic into, across and out of Azure: Virtual Network, hub-spoke or Virtual WAN topologies, VPN Gateway, ExpressRoute, Azure Firewall, Front Door and Private Link, with Azure Arc extending governance to on-premises servers. NTSPL designs these for Indian ports, school groups and manufacturers so plants, campuses and branches reach Azure privately with central inspection.
Microsoft Azure services in scope
The Problem Azure Virtual Network and VNet peering and Azure Virtual WAN Solve
Most failed Azure adoptions in India are network failures in disguise: VNets created per project with overlapping 10.0.0.0/16 ranges, PaaS services left on public endpoints, a single site-to-site VPN over a broadband link carrying ERP traffic from a plant, and DNS that resolves private endpoints only from inside Azure. Fixing this later means re-IP work and outages. The network problem is designing address space, routing, inspection and name resolution once, so every future workload lands in a spoke that already has private connectivity, egress control and on-premises reachability.
NTSPL designs the network before the first workload: an IP plan with non-overlapping ranges for every region and site, a hub in Central India (or a Virtual WAN hub where there are dozens of branches), ExpressRoute with VPN failover for sites that carry production traffic, Azure Firewall as the single egress and east-west inspection point, and a DNS Private Resolver so on-premises clients resolve privatelink zones correctly. Azure Arc brings on-premises servers under the same policy and patching model.
When Your Sites Need Azure Hub-Spoke, Virtual WAN or ExpressRoute (and When They Don't)
Signals that point to networking & hybrid on Microsoft Azure
- VPN tunnels from plants or terminals drop more than twice a month, or round-trip latency to Azure exceeds 40 ms with visible jitter on ERP or MES sessions.
- Three or more teams have created VNets with overlapping address ranges and new peering requests are blocked by IP conflicts.
- Storage accounts, SQL databases or Key Vaults still accept connections from the public internet.
- Auditors ask for a single log of all outbound connections from cloud workloads and none exists.
- More than 15 branches or campuses need to reach Azure and each other, and the current mesh of tunnels is managed by hand.
When a different approach is better
- A single small office with a handful of users reaching Microsoft 365 and one web app: a point-to-site VPN or Entra Private Access is simpler than a hub with ExpressRoute.
- Public web applications needing only global acceleration and WAF: Azure Front Door in front of App Service handles that without hybrid networking.
- Plants requiring deterministic sub-5 ms control loops to Azure: keep control on-site and use Azure IoT Operations or Azure Local at the edge rather than routing control traffic to a region.
Azure Network Building Blocks: VNets, Virtual WAN, VPN Gateway, ExpressRoute, Firewall and Private Link
| Service | Role in the architecture | Choose it when |
|---|---|---|
| Azure Virtual Network and VNet peering | Provides isolated address spaces with subnets, NSGs and route tables; peering joins spokes to a hub over the Microsoft backbone with low latency. | Workloads need private IPs, segmentation by subnet and controlled routing to on-premises or the internet. |
| Azure Virtual WAN | Provides Microsoft-managed hubs with built-in any-to-any transit between branches, VNets, VPN and ExpressRoute, plus routing intent to force traffic through a secured hub firewall. | There are more than about 15-20 branches or multiple regions, and hand-managed hub routing would become a burden. |
| Azure ExpressRoute | Connects on-premises networks to Azure over a private circuit from a connectivity provider at a peering location, with BGP routing and an SLA. | A site carries production ERP, MES or terminal-operating traffic where internet VPN jitter or outages would stop operations. |
| Azure VPN Gateway | Terminates IPsec site-to-site and point-to-site tunnels on zone-redundant gateways, in active-active mode with BGP. | Smaller sites need encrypted connectivity, or an ExpressRoute circuit needs a tested backup path. |
| Azure Firewall (Standard, Premium) | Inspects and filters north-south and east-west traffic with FQDN rules, threat intelligence and, in Premium, TLS inspection, IDPS and URL filtering. | All spoke egress and inter-spoke traffic must pass one logged, policy-controlled inspection point. |
| Azure Private Link and Azure DNS Private Resolver | Exposes PaaS services on private endpoints inside VNets; the resolver answers private DNS zones for on-premises clients through inbound and outbound endpoints. | Storage, SQL or Key Vault must be unreachable from the internet but still resolve correctly from plants and offices. |
| Azure Arc-enabled servers | Projects on-premises and edge Windows and Linux servers into Azure Resource Manager for Azure Policy, Update Manager, Defender for Servers and monitoring. | Servers must remain on-site for latency, OT or validation reasons but should follow the same governance as Azure VMs. |
Central India hub-spoke with dual ExpressRoute and secured egress
Central India hub-spoke with dual ExpressRoute and secured egress
Plant and office traffic enters through ExpressRoute circuits at two Indian peering locations, with zone-redundant VPN as failover, into a hub VNet in Central India where Azure Firewall Premium inspects it before forwarding to application spokes. PaaS services are reached only through private endpoints resolved by DNS Private Resolver, and internet-facing apps are published through Front Door Premium with Private Link origins.
Select any component
Central India hub-spoke with dual ExpressRoute and secured egress: click any of its 10 components to see its role and the design choice NTSPL makes for it, or trace the 5-step primary path.
Azure Network Engineering Decisions: IP Plan, Topology, Circuit Resilience, Inspection and DNS
IP address plan
Allocate a summarizable block per region and per site group before deployment, for example 10.20.0.0/14 for Central India, 10.24.0.0/14 for South India and 10.100.0.0/12 for on-premises sites. Size the hub at /22 to fit GatewaySubnet (/27 minimum), AzureFirewallSubnet (/26), Bastion (/26) and resolver subnets. Give each spoke at least a /22 so subnet growth does not force re-IP. Summarized prefixes keep BGP route counts low on ExpressRoute.
Hub-spoke or Virtual WAN
Customer-managed hub-spoke gives full control over route tables, third-party NVAs and gateway placement, and suits up to about 15 sites in one or two regions. Virtual WAN Standard removes manual transit routing, connects SD-WAN branches through partner integration and, with routing intent, forces all traffic through a secured hub firewall. Choose Virtual WAN when branches number in the dozens or several regions need any-to-any connectivity without maintaining UDRs.
ExpressRoute resilience and provider selection
One circuit has two links but a single peering location, so a facility outage takes it down. For production plants, use two circuits at different peering locations with different providers, or at minimum a VPN Gateway backup over a separate ISP. Test failover by withdrawing BGP routes, not by assuming it works. Size circuit bandwidth to the 95th percentile of measured traffic plus 30 percent, and consider a metered plan when outbound volume is low.
Firewall tier and rule hierarchy
Standard covers FQDN filtering, threat intelligence and DNS proxy for most estates. Choose Premium when you need TLS inspection of outbound traffic, signature-based IDPS or URL-path filtering, typical for regulated plants and student networks. Build a parent Firewall Policy for organization-wide rules and child policies per environment so production and development diverge only where intended. Enable DNS proxy so FQDN rules resolve consistently.
Private endpoint DNS
Private endpoints fail most often on DNS, not routing. Centralize all privatelink zones in the hub subscription, link them to every spoke, and assign zone records through Azure Policy when endpoints are created. On-premises DNS servers forward privatelink suffixes to the DNS Private Resolver inbound endpoint. Never create duplicate privatelink zones in spokes, because the resolution split causes intermittent failures that are hard to trace.
How NTSPL Builds an Azure Hub-Spoke Network with ExpressRoute and Private Link
IP plan and site traffic baseline
Collect current subnets from every site and Azure subscription, measure peak throughput per site, and publish a non-overlapping, summarizable allocation.
Hub and gateway build as code
Deploy the hub VNet, zone-redundant ExpressRoute and VPN gateways, Azure Firewall and DNS Private Resolver through a Bicep or Terraform pipeline.
Circuit order and BGP failover test
Order circuits from two providers, configure private peering and BGP preferences, then prove failover by withdrawing routes during a maintenance window.
Private Link and DNS cutover
Centralize privatelink zones, add on-premises conditional forwarders, create private endpoints and disable public network access service by service.
Spoke onboarding with forced tunnelling
Peer workload spokes, apply route tables sending egress and site traffic to the firewall, and enable Network Manager security admin rules.
Arc onboarding and monitoring
Onboard remaining site servers to Azure Arc over the private path and set Connection Monitor tests with alert thresholds per site.
What you receive
Securing Azure Networks: Firewall Premium, Private Endpoints, Network Manager Rules and DDoS Protection
Network threats in Azure are uninspected egress, PaaS services reachable from the internet, lateral movement between spokes and exposed management ports. NTSPL routes all spoke traffic through Azure Firewall, disables public access on PaaS with Private Link, applies Network Manager security admin rules that block inbound management ports organization-wide, and keeps OT or GxP networks in separate spokes with explicit allow rules only.
- Azure Firewall Premium IDPS and TLS inspection for outbound traffic from regulated spokes
- Network Manager security admin rules that NSG owners cannot override
- Private endpoints with public network access disabled on SQL, Storage and Key Vault
- Azure DDoS Network Protection on hub and Front Door-adjacent public IPs
- Microsoft Defender for Cloud network recommendations and just-in-time access to remaining management ports
Azure Networking Pricing Levers: Circuit Bandwidth, Gateway SKUs, Firewall Tiers and Data Transfer
Azure networking bills ExpressRoute by circuit bandwidth and plan (metered or unlimited data), gateways by SKU-hour, Azure Firewall by deployment hour plus GB processed, VNet peering per GB in each direction, private endpoints per hour plus data processed, and internet egress per GB. Firewall and peering data charges grow quietly, so traffic paths matter as much as SKU choices.
- Metered ExpressRoute when outbound volume is low; unlimited when backups or replication push large outbound volumes
- Gateway SKUs sized to measured peak with one-circuit-failure headroom, not to maximum theoretical throughput
- Azure Firewall Basic or Standard for non-regulated environments; Premium only where IDPS or TLS inspection is required
- Keeping chatty application tiers in the same spoke to avoid repeated peering and firewall processing charges
- Front Door caching for static assets to reduce origin egress
Azure ExpressRoute vs site-to-site VPN: which should connect my plant or office to Azure?
Decide on four criteria. Reliability: ExpressRoute uses a private provider circuit with an SLA and is not affected by internet congestion; VPN depends on the public internet. Latency consistency: ExpressRoute gives predictable latency for ERP, MES or terminal systems; VPN latency varies with ISP conditions. Bandwidth: VPN Gateway aggregate throughput is limited by SKU, while ExpressRoute circuits scale to 10 Gbps through providers and 100 Gbps with ExpressRoute Direct (400 Gbps in limited peering locations). Cost and lead time: VPN is cheaper and live in days; ExpressRoute needs a provider order that can take several weeks. NTSPL rule: ExpressRoute for any site where a network outage stops production, with VPN as its backup; VPN alone for offices and small branches.
Key facts about networking & hybrid on Microsoft Azure
Networking & Hybrid on Microsoft Azure in Practice
3 networking & hybrid scenarios from Ports & container terminals, K-12 education, Pharmaceutical manufacturing: the starting position, the services chosen, the architecture, the rollout and the measured outcome.
Container terminal links TOS, gate automation and Azure over dual ExpressRoute
School group connects 14 campuses through Virtual WAN with filtered student internet
Pharma manufacturer connects 4 GxP plants to Azure with validated network-as-code
Diagnostics chain runs its Windows LIS on zone-spread Azure VMs with sub-second lookups
Mining operator cuts dispatch-server spend 41% with Savings Plan and Spot simulation runs
News channel moves 1.4 PB of footage from LTO tape to tiered Blob Storage
Dealership group cuts OEM warranty claim rejections by integrating DMS through Service Bus
Networking & Hybrid on Microsoft Azure: Frequently Asked Questions
What does Azure ExpressRoute cost in India?
ExpressRoute cost has two parts: Microsoft's monthly circuit charge, which depends on bandwidth and whether you choose a metered or unlimited data plan, and the connectivity provider's charge for the last-mile link to the peering location, quoted separately in INR. Gateways in Azure are billed per hour. NTSPL compares metered and unlimited plans against your measured outbound volume before ordering.
Which ExpressRoute peering locations can Indian sites use?
Microsoft has ExpressRoute peering locations in several Indian cities, including Mumbai and Chennai, served by multiple Indian connectivity providers; check Microsoft's current location list for others. Plants and offices connect to the nearest location through their provider. For production resilience, NTSPL places two circuits at different peering locations so a single facility outage does not cut connectivity.
How do we migrate from our existing VPN mesh to a hub-spoke design?
Build the new hub and IP plan alongside the current setup, connect sites to the hub one at a time, and move workloads into spokes in waves. Where address ranges overlap, re-IP the smaller side or use NAT on the VPN Gateway temporarily. NTSPL keeps the old tunnels as a fallback until each site has passed a week of monitored traffic.
Does traffic between Azure regions in India stay inside India?
Traffic between Azure VNets in Central India, South India and West India uses peering over the Microsoft global network rather than the public internet. Choosing Indian regions for both primary and DR, and Indian peering locations for ExpressRoute, keeps the data path within the country, which supports DPDP Act, RBI and sector data-localization commitments.
Why do private endpoints work from Azure but fail from our office?
Almost always DNS. Office clients resolve the service's public name to its public IP because on-premises DNS does not know the privatelink zone. Fix it by deploying Azure DNS Private Resolver in the hub and adding conditional forwarders on office DNS servers for privatelink suffixes pointing to the resolver's inbound endpoint.
What does Azure Arc add for servers that stay on-premises?
Azure Arc gives on-premises servers an Azure resource identity so you can apply Azure Policy, patch through Azure Update Manager, protect with Defender for Servers and collect logs with Azure Monitor, all from the same portal as Azure VMs. Some management capabilities are billed per server. It suits plant and terminal servers that cannot move to the cloud.