Azure Network Virtual Hub
This page shows how to write Terraform and Azure Resource Manager for Network Virtual Hub and write them securely.
azurerm_virtual_hub (Terraform)
The Virtual Hub in Network can be configured in Terraform with the resource name azurerm_virtual_hub
. The following sections describe 10 examples of how to use the resource and its parameters.
Example Usage from GitHub
resource "azurerm_virtual_hub" "HUB-WestEurope" {
address_prefix = "10.0.0.0/24"
location = "WestEurope"
name = "HUB-WestEurope"
resource_group_name = var.lab-rg
virtual_wan_id = azurerm_virtual_wan.vwan-demo.id
resource "azurerm_virtual_hub" "microhack-eus2-hub" {
name = "microhack-eus2-hub"
resource_group_name = azurerm_resource_group.vwan-microhack-hub-rg.name
location = var.location-hub-1
virtual_wan_id = azurerm_virtual_wan.microhack-vwan.id
address_prefix = var.hub1-cidr
resource "azurerm_virtual_hub" "microhack-we-hub" {
name = "microhack-we-hub"
resource_group_name = azurerm_resource_group.vwan-microhack-hub-rg.name
location = var.location-vwan-we-hub
virtual_wan_id = azurerm_virtual_wan.microhack-vwan.id
address_prefix = "192.168.0.0/24"
resource "azurerm_virtual_hub" "vhub" {
count = length(var.hubnames)
name = var.hubnames[count.index]
resource_group_name = var.rsg
address_prefix = var.adress_prefixes[count.index]
resource "azurerm_virtual_hub" "vhub" {
count = length(var.hubnames)
name = var.hubnames[count.index]
resource_group_name = var.rsg
address_prefix = var.adress_prefixes[count.index]
resource "azurerm_virtual_hub" "vwan-001-hub-neu" {
name = "neu-vwan-hub-001"
resource_group_name = azurerm_resource_group.neu-rsg-vwan-001.name
location = azurerm_resource_group.neu-rsg-vwan-001.location
virtual_wan_id = azurerm_virtual_wan.vwan-001.id
resource "azurerm_virtual_hub" "test" {
name = "cwan-vhub"
resource_group_name = azurerm_resource_group.test.name
location = azurerm_resource_group.test.location
virtual_wan_id = azurerm_virtual_wan.test.id
address_prefix = "10.0.1.0/24"
resource "azurerm_virtual_hub" "westeu_vHub" {
name = "westeu_vHub"
resource_group_name = azurerm_resource_group.cloudteam_mremini_vWAN.name
location = "westeurope"
virtual_wan_id = azurerm_virtual_wan.cloudteam_mremini_vWAN.id
address_prefix = "10.80.0.0/24"
resource "azurerm_virtual_hub" "main" {
for_each = { for hub in var.hubs : hub.region => hub }
name = each.key
resource_group_name = var.resource_group_name
location = var.resource_group_location
virtual_wan_id = azurerm_virtual_wan.main.id
resource "azurerm_virtual_hub" "example" {
count = var.enabled ? 1 : 0
name = var.hub_names
resource_group_name = azurerm_resource_group.example.name
location = azurerm_resource_group.example.location
virtual_wan_id = azurerm_virtual_wan.example.id
Parameters
-
address_prefix
optional - string -
id
optional computed - string -
location
required - string -
name
required - string -
resource_group_name
required - string -
sku
optional - string -
tags
optional - map from string to string -
virtual_wan_id
optional - string -
route
set block-
address_prefixes
required - list of string -
next_hop_ip_address
required - string
-
-
timeouts
single block
Explanation in Terraform Registry
Manages a Virtual Hub within a Virtual WAN.
Tips: Best Practices for The Other Azure Network Resources
In addition to the azurerm_network_security_group, Azure Network has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.
azurerm_network_security_group
Ensure to disable RDP port from the Internet
It is better to disable the RDP port from the Internet. RDP access should not be accepted from the Internet (*, 0.0.0.0, /0, internet, any), and consider using the Azure Bastion Service.
azurerm_network_security_rule
Ensure to set a more restrictive CIDR range for ingress from the internet
It is better to set a more restrictive CIDR range not to use very broad subnets. If possible, segments should be divided into smaller subnets.
azurerm_network_watcher_flow_log
Ensure to enable Retention policy for flow logs and set it to enough duration
It is better to enable a retention policy for flow logs. Flow logs show us all network activity in the cloud environment and support us when we face critical incidents.
Microsoft.Network/virtualHubs (Azure Resource Manager)
The virtualHubs in Microsoft.Network can be configured in Azure Resource Manager with the resource name Microsoft.Network/virtualHubs
. The following sections describe how to use the resource and its parameters.
Example Usage from GitHub
"type": "Microsoft.Network/virtualHubs",
"apiVersion": "2021-02-01",
"name": "[parameters('routeserverName')]",
"location": "[parameters('location')]",
"properties": {
"sku": "Standard",
"type": "Microsoft.Network/virtualHubs",
"apiVersion": "2020-05-01",
"name": "[variables('virtual_hub1_cfg').name]",
"location": "[parameters('hub1_location')]",
"dependsOn": [
"[resourceId('Microsoft.Network/virtualWans', parameters('vWANname'))]"
"type": "Microsoft.Network/virtualHubs",
"apiVersion": "2020-05-01",
"name": "[variables('virtual_hub_cfg').name]",
"location": "[parameters('location')]",
"properties": {
"addressPrefix": "[variables('virtual_hub_cfg').addressSpacePrefix]",
"type": "Microsoft.Network/virtualHubs",
"apiVersion": "2020-05-01",
"name": "[variables('virtual_hub1_cfg').name]",
"location": "[parameters('hub1_location')]",
"dependsOn": [
"[resourceId('Microsoft.Network/virtualWans', parameters('vWANname'))]"
"type": "Microsoft.Network/virtualHubs",
"apiVersion": "2020-05-01",
"name": "[variables('virtual_hub1_cfg').name]",
"location": "[parameters('hub1_location')]",
"dependsOn": [
"[resourceId('Microsoft.Network/virtualWans', parameters('vWANname'))]"
"type": "Microsoft.Network/virtualHubs",
"apiVersion": "2020-05-01",
"name": "[variables('virtual_hub1_cfg').name]",
"location": "[parameters('hub1_location')]",
"dependsOn": [
"[resourceId('Microsoft.Network/virtualWans', parameters('vWANname'))]"
"type": "Microsoft.Network/virtualHubs",
"apiVersion": "2020-05-01",
"name": "[variables('virtual_hub1_cfg').name]",
"location": "[parameters('hub1_location')]",
"dependsOn": [
"[resourceId('Microsoft.Network/virtualWans', parameters('vWANname'))]"
"type": "Microsoft.Network/virtualHubs",
"apiVersion": "2020-05-01",
"name": "[variables('virtual_hub1_cfg').name]",
"location": "[parameters('hub1_location')]",
"dependsOn": [
"[resourceId('Microsoft.Network/virtualWans', parameters('vWANname'))]"
"type": "Microsoft.Network/virtualHubs",
"apiVersion": "2020-06-01",
"name": "[parameters('firstRouteServerName')]",
"location": "[parameters('location')]",
"dependsOn": [
"[resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName'))]",
"type": "Microsoft.Network/virtualHubs",
"apiVersion": "2020-05-01",
"name": "[variables('virtual_hub1_cfg').name]",
"location": "[parameters('hub1_location')]",
"dependsOn": [
"[resourceId('Microsoft.Network/virtualWans', parameters('vWANname'))]"
Parameters
name
required - stringtype
required - stringapiVersion
required - stringlocation
required - stringResource location.
tags
optional - stringResource tags.
properties
requiredvirtualWan
optionalid
required - stringResource ID.
vpnGateway
optionalid
required - stringResource ID.
p2SVpnGateway
optionalid
required - stringResource ID.
expressRouteGateway
optionalid
required - stringResource ID.
azureFirewall
optionalid
required - stringResource ID.
securityPartnerProvider
optionalid
required - stringResource ID.
addressPrefix
optional - stringAddress-prefix for this VirtualHub.
routeTable
optionalroutes
optional arrayaddressPrefixes
optional - arrayList of all addressPrefixes.
nextHopIpAddress
optional - stringNextHop ip address.
securityProviderName
optional - stringThe Security Provider name.
virtualHubRouteTableV2s
optional arrayproperties
optionalroutes
optional arraydestinationType
optional - stringThe type of destinations.
destinations
optional - arrayList of all destinations.
nextHopType
optional - stringThe type of next hops.
nextHops
optional - arrayNextHops ip address.
attachedConnections
optional - arrayList of all connections attached to this route table v2.
name
optional - stringThe name of the resource that is unique within a resource group. This name can be used to access the resource.
sku
optional - stringThe sku of this VirtualHub.
routingState
optional - stringThe routing state.
virtualRouterAsn
optional - integerVirtualRouter ASN.
virtualRouterIps
optional - arrayVirtualRouter IPs.
allowBranchToBranchTraffic
optional - booleanFlag to control transit for VirtualRouter hub.
Frequently asked questions
What is Azure Network Virtual Hub?
Azure Network Virtual Hub is a resource for Network of Microsoft Azure. Settings can be wrote in Terraform.
Where can I find the example code for the Azure Network Virtual Hub?
For Terraform, the SzkolaDevNet/Terraform-Azure-vWAN, zipphreak/azure-vwan-microhack2.0 and mddazure/azure-vwan-microhack source code examples are useful. See the Terraform Example section for further details.
For Azure Resource Manager, the dmauser/azure-hub-spoke-base-lab, naveenpolla/ARM-Templates and s-KaiNet/monaco-csharp-poc source code examples are useful. See the Azure Resource Manager Example section for further details.