LAB 48 ‐ Difference between Hub ‐spoke & Mesh topology(asymmetric routing) - DevWithNehaCloud/Oracle-Cloud-Infrastructure-wiki GitHub Wiki
Hub-and-Spoke vs Mesh Topology in OCI
Overview
When designing enterprise networks in Oracle Cloud Infrastructure (OCI), two common network architectures are:
- Hub-and-Spoke Topology
- Mesh Topology
Choosing the right architecture is important for scalability, security, routing simplicity, and operational management.
Hub-and-Spoke Topology
Definition
Hub-and-Spoke is a network architecture where multiple VCNs (Spokes) communicate through a central VCN called the Hub.
The Hub VCN typically hosts shared services such as:
- Firewall
- Bastion Server
- NAT Gateway
- DNS Services
- Monitoring Tools
- Security Appliances
Spoke VCN = Applications + Databases + Compute
- Subnets
- Compute Instances
- Application Servers
- Databases
- Load Balancers
- Route Tables
- Security Lists
- NSGs
Hub VCN hosts shared networking and security services, whereas Spoke VCNs host the actual business applications and workloads.
Architecture
Spoke VCN-A
|
|
|
Spoke VCN-B ---- Hub VCN ---- Spoke VCN-C
|
|
|
Spoke VCN-D
OCI Example
Suppose an organization has the following VCNs:
| VCN | Purpose |
|---|---|
| Hub VCN | Firewall, Bastion, Shared Services |
| Dev VCN | Development Environment |
| Test VCN | Testing Environment |
| Prod VCN | Production Environment |
Traffic Flow:
Dev VCN ---> Hub VCN ---> Prod VCN
Instead of creating direct connections between every VCN, all traffic passes through the Hub VCN where security inspection can occur.
Advantages
- Centralized security management
- Easier route management
- Simplified operations
- Shared services can be reused
- Easier auditing and monitoring
- Scales well for large environments
Disadvantages
- Hub can become a bottleneck if not designed properly
- Additional hop may increase latency slightly
- Requires careful route table configuration
Mesh Topology
Definition
In a Mesh topology, every VCN is directly connected to every other VCN.
There is no central hub.
Architecture
VCN-A -------- VCN-B
|\ /|
| \ / |
| \ / |
| \ / |
| \ / |
| \ / |
| \ / |
VCN-C -------- VCN-D
OCI Example
Consider four VCNs:
- Dev VCN
- Test VCN
- UAT VCN
- Prod VCN
Required connections:
Dev <-> Test
Dev <-> UAT
Dev <-> Prod
Test <-> UAT
Test <-> Prod
UAT <-> Prod
Each VCN has a direct route to every other VCN.
As the number of VCNs grows, the number of connections increases significantly.
Advantages
- Direct communication
- Lower latency
- No central point of failure
- Simpler traffic flow between two VCNs
Disadvantages
- Difficult to scale
- Complex route management
- Security becomes harder to manage
- Increased administrative overhead
- More routing and peering configurations
Hub-and-Spoke vs Mesh Topology
| Feature | Hub-and-Spoke | Mesh |
|---|---|---|
| Architecture | Central Hub | Direct Connections |
| Scalability | High | Low |
| Security Management | Centralized | Distributed |
| Route Complexity | Low | High |
| Cost | Lower | Higher |
| Shared Services | Easy | Difficult |
| Governance | Easier | More Complex |
| Suitable For | Enterprise Environments | Small Networks |
| OCI Recommendation | Preferred | Limited Use Cases |
Asymmetric Routing
Definition
Asymmetric Routing occurs when request traffic and response traffic follow different network paths.
In simple words:
- Request uses Path A
- Response uses Path B
This causes routing asymmetry.
Example
Request Path
Server-A
|
v
Firewall
|
v
Server-B
Response Path
Server-B
|
v
Direct Route
|
v
Server-A
The request passes through the firewall, but the response bypasses the firewall.
This is called Asymmetric Routing.
Why Is Asymmetric Routing a Problem?
Most enterprise firewalls are stateful.
When traffic passes through a firewall, the firewall creates a session table entry.
Example:
A ---> Firewall ---> B
Firewall records:
Source: A
Destination: B
State: Established
Now suppose the return traffic follows a different path:
B ---> A
The firewall never sees the return packet.
As a result:
Session Validation Failed
The firewall may drop the connection.
Symmetric Routing vs Asymmetric Routing
Symmetric Routing (Correct)
A ---> Firewall ---> B
B ---> Firewall ---> A
Result:
- Firewall sees both directions
- Session is maintained
- Traffic succeeds
Asymmetric Routing (Incorrect)
A ---> Firewall ---> B
B ---> Direct Route ---> A
Result:
- Firewall sees only one direction
- Session is broken
- Traffic may fail
Hub-and-Spoke and Asymmetric Routing
A common OCI design is:
Dev VCN
|
|
v
Hub Firewall
|
|
v
Prod VCN
Correct Traffic Flow:
Dev VCN ---> Hub Firewall ---> Prod VCN
Prod VCN ---> Hub Firewall ---> Dev VCN
This is Symmetric Routing.
Incorrect Traffic Flow:
Dev VCN ---> Hub Firewall ---> Prod VCN
Prod VCN ---> Direct Route ---> Dev VCN
This creates Asymmetric Routing.
OCI and Software Defined Networking (SDN)
OCI networking is built on Software Defined Networking (SDN).
SDN provides:
- Centralized network management
- Automated route handling
- Network virtualization
- Scalability
- Simplified operations
Because OCI uses SDN internally, network resources such as:
- VCNs
- Subnets
- Route Tables
- Security Lists
- NSGs
can be managed efficiently without dealing with physical networking hardware.
Application Isolation Using Spoke VCNs
A common enterprise design is to place application servers inside private spoke networks.
Example:
Internet
|
v
Load Balancer
|
v
Private Application Server
|
v
Database
Application servers are not directly exposed to the internet.
Benefits:
- Reduced attack surface
- Improved security
- Better compliance
- Controlled access
Real-World Example (Swiggy-Like Architecture)
For an application such as Swiggy:
Users
|
v
Public Load Balancer
|
v
Private Application Servers
|
v
Private Database
Application servers are deployed in private subnets and are not assigned public IP addresses.
Only the Load Balancer is exposed to the internet.
This architecture provides:
- Better security
- Network isolation
- Controlled access
- Protection from direct internet attacks
Key Takeaways
- Hub-and-Spoke is the preferred enterprise architecture.
- All spoke networks communicate through the Hub.
- Symmetric routing should be maintained whenever firewalls are used.
- Asymmetric routing can cause firewall and connectivity issues.
- Mesh topology becomes difficult to manage as the environment grows.
- OCI uses Software Defined Networking (SDN) for scalable network management.
- Application servers should typically be deployed in private subnets.
- Public exposure should be limited to components such as Load Balancers or Bastion Hosts.
OCI Best Practices
- Ensure forward and return traffic follow the same path.
- Route inter-VCN traffic through the same firewall when inspection is required.
- Validate route tables in both source and destination VCNs.
- Use DRG route distribution carefully.
- Verify firewall policies for bidirectional traffic.
- Avoid asymmetric routing when using stateful firewalls.
- Test traffic flow after every routing change.
Interview Answer
What is Hub-and-Spoke Topology?
Hub-and-Spoke is a network architecture where multiple VCNs communicate through a central Hub VCN. The Hub typically contains shared services such as firewalls, bastion hosts, NAT gateways, and monitoring tools. It provides centralized security and simplified network management.
What is Mesh Topology?
Mesh topology is a network architecture where every VCN is directly connected to every other VCN. It provides direct communication and low latency but becomes difficult to manage as the number of VCNs increases.
What is Asymmetric Routing?
Asymmetric Routing occurs when request and response traffic follow different paths. This can cause issues with stateful firewalls because the firewall only sees one side of the connection and cannot properly maintain session state.
Which topology is preferred in OCI?
Hub-and-Spoke topology is generally preferred in OCI because it provides centralized security, simplified routing, easier governance, and better scalability for enterprise environments.