In a spoke hub architecture, is the DMZ another spoke (I.e. peered to the hub), a stand-alone vent, or the hub itself (for example as a subnet)?

This question is mostly for azure implementation.


Hub-spoke architecture refers to site interconnects. You've got a central hub (location) that all other sites connect to. All traffic between sites runs through the hub. n sites means you've got (n-1) links.

The exact opposite of hub-spoke is a full mesh. There's one connection between any two sites. Traffic only goes the shortest path but you've got n(n-1)/2 links. In practice you often have basic hub-spoke with some meshing for redundancy.

A DMZ is a zone in your security model. You can connect one on each site or just at the hub, depending on your requirements.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.