Difference between Hub -spoke & Mesh topology(asymmetric routing)

What is Hub-Spoke Topology

A Hub-and-Spoke topology is a network architecture where a central network (Hub) connects to multiple independent networks (Spokes). Instead of spokes communicating directly with each other, all traffic flows through the hub.

Diagram

How It Works

• The Hub hosts shared network services.
• Each Spoke connects only to the hub.
• If one spoke needs to communicate with another, the traffic passes through the hub.
• The hub enforces routing and security policies.

Components

Hub

The hub is the central network that provides shared infrastructure, such as:

• Firewall
• Bastion host
• NAT Gateway
• Internet Gateway
• DNS services
• Logging and monitoring
• Shared storage

Spokes

Spokes are separate networks that host specific workloads, such as:

• Production applications
• Development environment
• Testing environment
• Database servers

Advantages

• Centralized management – Shared services are maintained in one place.
• Improved security – All traffic can be inspected by a central firewall.
• Network isolation – Each spoke is isolated from the others.
• Scalability – New spokes can be added without redesigning the network.
• Reduced cost – Shared services are deployed once in the hub instead of being duplicated.

Disadvantages

• The hub can become a traffic bottleneck if not sized correctly.
• If the hub is unavailable and there is no redundancy, communication between spokes is interrupted.
• Routing through the hub may introduce slightly higher latency than direct communication.

Hub-and-Spoke in OCI

In Oracle Cloud Infrastructure (OCI), a Hub-and-Spoke topology is commonly implemented using:

• A Hub VCN that contains shared networking components (firewalls, NAT Gateway, Internet Gateway, Bastion, etc.).

• Multiple Spoke VCNs for different applications or environments.

• Local Peering Gateways (LPGs) for communication between VCNs in the same region, or Dynamic Routing Gateways (DRGs) for larger or hybrid network designs.

Example

Suppose an organization has three environments:

• Dev VCN
• Test VCN
• Production VCN

Instead of placing a firewall and internet gateway in each VCN, these shared services are deployed only in the Hub VCN. When the Dev VCN needs to access the Production VCN, the traffic follows this path:

Dev VCN → Hub VCN → Production VCN

This design ensures that all traffic passes through the central security controls.

Mesh Topology (Asymmetric Routing)

A Mesh topology is a network architecture in which every network (or VCN) is directly connected to every other network. Unlike a Hub-and-Spoke topology, there is no central hub through which traffic must pass.

Each VCN has a direct connection to every other VCN.

How It Works

Suppose VCN A wants to communicate with VCN B.

Since they have a direct connection, the traffic flows as:

VCN A → VCN B

Similarly:

VCN A ↔ VCN C VCN A ↔ VCN D VCN B ↔ VCN D

No central hub is required.

Advantages

• Low latency because traffic takes a direct path.
• No central bottleneck, as traffic is distributed.
• Fast communication between networks.
• Suitable for small environments where all networks need to communicate frequently.

Disadvantages

• Complex to manage as the number of networks grows.
• Routing tables become more difficult to maintain.
• Higher chance of routing mistakes, including asymmetric routing.

What is Asymmetric Routing?

Asymmetric routing occurs when the forward path (request) and the return path (response) are different.

Example

Forward traffic:

Client
   |
Firewall A
   |
Server

Return traffic:

Server
   |
Firewall B
   |
Client

The request passes through Firewall A, but the response returns through Firewall B.

Why is this a problem?

Most enterprise firewalls are stateful.

A stateful firewall:

Records information about a new connection. Allows only packets that belong to that connection.

Example:

Client sends a request through Firewall A. Firewall A stores the session information. The server sends the reply through Firewall B. Firewall B has no record of the session. Firewall B drops the packet.

As a result, the connection fails.

Asymmetric Routing in a Mesh Topology

Because multiple paths exist between networks, traffic may not return over the same route.

Example:

Forward:
VCN A → Firewall 1 → VCN B

Return:
VCN B → Firewall 2 → VCN A

Or:

Forward:
A → B

Return:
B → C → A

Difference Between Hub-and-Spoke and Mesh Topology (Asymmetric Routing)

The key difference between Hub-and-Spoke and Mesh topology is how networks communicate and how traffic is routed. A Hub-and-Spoke design uses a central hub for all communication, while a Mesh design allows direct communication between networks, which can introduce asymmetric routing if not carefully configured.