33 ‐ HUB and SPOKE Model - SanjeevOCI/Ocidocs GitHub Wiki
The Hub-and-Spoke Model is a network topology where multiple spoke networks (subnets, VCNs, or regions) connect to a central hub that manages communication and security policies.
- The Hub acts as the central network component that connects and manages multiple Spokes.
- Spokes are independent networks (e.g., VCNs in OCI, branch offices in an enterprise) that connect to the Hub.
- All communication between spokes goes through the Hub.
📌 Analogy: Think of an airline network where a major airport (Hub) connects to multiple regional airports (Spokes). Flights (data) between regional airports must go through the Hub.
OCI supports Hub-and-Spoke architecture for better network segmentation, security, and centralized management.
- Typically a VCN with a Dynamic Routing Gateway (DRG).
- Connects to on-premises networks via VPN or FastConnect.
- Can have firewalls, security tools, and monitoring to manage traffic.
- These are separate VCNs (e.g., dev, prod, test).
- Communicate via the Hub instead of direct VCN peering.
- Can connect to shared services like databases, logging, or security appliances hosted in the Hub.
📌 Example OCI Setup:
- Hub VCN: Connects to on-premises via DRG, provides centralized security and monitoring.
- Spoke VCNs: Separate application workloads (e.g., web apps, databases, analytics, etc.).
- Traffic between Spokes must go through the Hub, ensuring better security and monitoring.
✅ Centralized Security – The Hub manages security, firewalls, and monitoring.
✅ Improved Network Control – Spokes don’t communicate directly, reducing complexity.
✅ Scalability – New Spokes can be added without major changes.
✅ Cost Efficiency – Shared resources in the Hub prevent duplication in Spokes.
✅ Multi-Region Connectivity – Works well for multi-cloud and hybrid networking.
| Feature | Hub-and-Spoke | Full Mesh |
|---|---|---|
| Connectivity | Spokes talk via Hub | Spokes talk directly |
| Security | Centralized in Hub | Managed per Spoke |
| Complexity | Easier to manage | Harder to scale |
| Cost | Lower | Higher due to multiple peerings |
The Hub-and-Spoke model is ideal for cloud networking, multi-VPC/VCN setups, and hybrid cloud architectures. OCI uses DRG, Local Peering, and Firewalls to implement it efficiently.