Hub-and-spoke network design

Make a folder and save the IP plan checker:

New-Item -ItemType Directory -Path C:\azure-lab\hub -Force | Out-Null
Set-Location C:\azure-lab\hub
$t = @'
param([Parameter(Mandatory)][hashtable]$Plan)
function ConvertTo-Range([string]$Cidr) {
    $ip, $bits = $Cidr.Split('/')
    $b = ([Net.IPAddress]::Parse($ip)).GetAddressBytes(); [Array]::Reverse($b)
    $start = [BitConverter]::ToUInt32($b, 0)
    $size = [int64][math]::Pow(2, 32 - [int]$bits)
    [pscustomobject]@{ Start = [double]$start; End = [double]$start + $size - 1; Size = $size }
}
function ConvertTo-Ip([double]$n) {
    $b = [BitConverter]::GetBytes([uint32]$n); [Array]::Reverse($b); ([Net.IPAddress]::new($b)).ToString()
}
$rows = foreach ($name in ($Plan.Keys | Sort-Object)) {
    $r = ConvertTo-Range $Plan[$name]
    [pscustomobject]@{ Network = $name; Prefix = $Plan[$name]; First = ConvertTo-Ip $r.Start; Last = ConvertTo-Ip $r.End; Addresses = $r.Size; S = $r.Start; E = $r.End }
}
$rows | Select-Object Network, Prefix, First, Last, Addresses | Format-Table -AutoSize | Out-String -Width 150 | ForEach-Object { $_.Trim() }
$clash = for ($i = 0; $i -lt $rows.Count; $i++) { for ($j = $i + 1; $j -lt $rows.Count; $j++) {
    if ($rows[$i].S -le $rows[$j].E -and $rows[$j].S -le $rows[$i].E) { "OVERLAP: $($rows[$i].Network) $($rows[$i].Prefix) and $($rows[$j].Network) $($rows[$j].Prefix)" } } }
if ($clash) { $clash } else { 'No overlaps.' }
'@
Set-Content -Path C:\azure-lab\Test-IpPlan.ps1 -Value $t

1Check the course IP plan

Run the checker on every network the course will use:

C:\azure-lab\Test-IpPlan.ps1 -Plan @{ 'vnet-saat'='10.30.0.0/16'; 'vnet-hub'='10.40.0.0/16'; 'vnet-spoke1'='10.41.0.0/16'; 'vnet-spoke2'='10.42.0.0/16'; 'vnet-onprem'='10.80.0.0/16' }

You should see this:

Network     Prefix       First     Last          Addresses
-------     ------       -----     ----          ---------
vnet-hub    10.40.0.0/16 10.40.0.0 10.40.255.255     65536
vnet-onprem 10.80.0.0/16 10.80.0.0 10.80.255.255     65536
vnet-saat   10.30.0.0/16 10.30.0.0 10.30.255.255     65536
vnet-spoke1 10.41.0.0/16 10.41.0.0 10.41.255.255     65536
vnet-spoke2 10.42.0.0/16 10.42.0.0 10.42.255.255     65536
No overlaps.

2Check the hub’s subnets

The same script works for subnets inside one VNet:

C:\azure-lab\Test-IpPlan.ps1 -Plan @{ 'GatewaySubnet'='10.40.0.0/27'; 'AzureFirewallSubnet'='10.40.1.0/26'; 'AzureBastionSubnet'='10.40.2.0/26'; 'snet-shared'='10.40.10.0/24' }

You should see this:

Network             Prefix        First      Last         Addresses
-------             ------        -----      ----         ---------
AzureBastionSubnet  10.40.2.0/26  10.40.2.0  10.40.2.63          64
AzureFirewallSubnet 10.40.1.0/26  10.40.1.0  10.40.1.63          64
GatewaySubnet       10.40.0.0/27  10.40.0.0  10.40.0.31          32
snet-shared         10.40.10.0/24 10.40.10.0 10.40.10.255       256
No overlaps.

Take 5 off each for Azure’s reserved addresses: 59, 59, 27 and 251 usable. The gaps between them (10.40.3.0 to 10.40.9.255) are room to grow.

3Write the hub and spokes in Bicep

Save hub.bicep and build it:

$b = @'
@description('Azure region for all networks')
param location string = resourceGroup().location

@description('Spoke networks: name, address space and app subnet')
param spokes array = [
  {
    name: 'vnet-spoke1'
    prefix: '10.41.0.0/16'
    appSubnet: '10.41.1.0/24'
  }
  {
    name: 'vnet-spoke2'
    prefix: '10.42.0.0/16'
    appSubnet: '10.42.1.0/24'
  }
]

var tags = {
  course: 'saatvedha-azure'
  lesson: '45'
  keep: 'true'
}

resource hub 'Microsoft.Network/virtualNetworks@2024-05-01' = {
  name: 'vnet-hub'
  location: location
  tags: tags
  properties: {
    addressSpace: {
      addressPrefixes: [
        '10.40.0.0/16'
      ]
    }
    subnets: [
      {
        name: 'GatewaySubnet'
        properties: {
          addressPrefix: '10.40.0.0/27'
        }
      }
      {
        name: 'AzureFirewallSubnet'
        properties: {
          addressPrefix: '10.40.1.0/26'
        }
      }
      {
        name: 'AzureBastionSubnet'
        properties: {
          addressPrefix: '10.40.2.0/26'
        }
      }
      {
        name: 'snet-shared'
        properties: {
          addressPrefix: '10.40.10.0/24'
          defaultOutboundAccess: false
        }
      }
    ]
  }
}

resource spokeVnets 'Microsoft.Network/virtualNetworks@2024-05-01' = [for s in spokes: {
  name: s.name
  location: location
  tags: tags
  properties: {
    addressSpace: {
      addressPrefixes: [
        s.prefix
      ]
    }
    subnets: [
      {
        name: 'snet-app'
        properties: {
          addressPrefix: s.appSubnet
          defaultOutboundAccess: false
        }
      }
    ]
  }
}]

output hubId string = hub.id
output spokeIds array = [for (s, i) in spokes: spokeVnets[i].id]
'@
Set-Content -Path hub.bicep -Value $b
az bicep build --file hub.bicep
(Get-Content hub.bicep).Count

You should see this (no errors, no warnings):

87

The spokes are a loop over an array parameter, so adding a spoke later is one more entry, not another copy of the VNet code.

4Deploy it

The hub group stays for the rest of Phase 3:

az group create --name rg-saat-hub --location centralindia --tags course=saatvedha-azure lesson=45 keep=true -o none
az deployment group create --resource-group rg-saat-hub --name hub-spokes --template-file hub.bicep -o none
az network vnet list --resource-group rg-saat-hub --query "[].{name:name, space:addressSpace.addressPrefixes[0], subnets:length(subnets)}" -o table

You should see this:

Name         Space         Subnets
-----------  ------------  ---------
vnet-hub     10.40.0.0/16  4
vnet-spoke1  10.41.0.0/16  1
vnet-spoke2  10.42.0.0/16  1

Three VNets, no connections yet. In Lesson 46 you peer them.

Write the plan down where the whole team can see it: one table with every range, its owner and its purpose, including the ones you haven’t used yet. In a real hub-and-spoke network, that table is checked before any new VNet, VPN or partner connection is approved, and it’s the first thing an engineer opens when a route looks wrong.

✅ Checkpoint: The IP plan has no overlaps, and vnet-hub, vnet-spoke1 and vnet-spoke2 exist in rg-saat-hub, deployed from Bicep.