Hub-and-Spoke at Scale: When to Add Another Hub
A hub is a regional resource. The interesting question isn't "do I need a hub?" — it's "when do I need a second one in the same region?"
Microsoft's Cloud Adoption Framework is unambiguous about hub placement: "A hub is a regional resource. We recommend that you use at least one hub per region and connect only spokes from the same region to those hubs."
That's the bulkhead pattern applied to networking. Cross-region peering through a single hub means a regional incident in the hub's region takes out your global routing. Don't do it.
The four-stage evolution
- Single regional hub — Firewall + AppGW + NAT GW. Fits 95% of mid-size workloads.
- Multi-AppGW in same hub — when traffic per workload exceeds AppGW's 125-instance ceiling. Front Door above multiple AppGW shards.
- Multiple hubs in same region — when total egress saturates a single Firewall (~30 Gbps Standard, 100 Gbps Premium) or a single ExpressRoute gateway. Use Azure Firewall Manager for shared policy.
- Virtual WAN — past 5 regions or 30+ branch SD-WAN sites.
Saturation triggers worth memorizing
- AppGW v2: max 125 instances × 10 CU each.
- Firewall Standard: 30 Gbps; Premium: 100 Gbps.
- SNAT through Firewall PIP alone: 2,496 ports per PIP × ≤250 PIPs.
- SNAT via NAT Gateway attached to AzureFirewallSubnet: 64,512 ports per PIP × 16 PIPs.
Alert at 50-75% of capacity, never 90%. Scale-out events take minutes; you can't claw back saturated minutes.