CIDR for vWAN HUB

Question

CIDR for vWAN HUB

AzurePro 80

I want to create two HUB in single VWAN

one is for Security solution SAAS
one is SD-WAN NVA.

for security solution hub - i have given x.x.x.x/23

do i need to assign x.x.x.x/23 again for SD-WAN hub? isn't that too much space is allocated for each hub?

0 comments

Answer accepted by question author

Ravi Varma Mudduluru 12,625 Microsoft External Staff Moderator

Hello @ AzurePro,

Thanks for reaching out to Microsoft Q&A.
You can’t re-use the exact same CIDR block for two hubs in one vWAN — each hub needs its own non-overlapping address space. A quick rundown:

Hub address space rules

• Minimum size is /24

• Recommended is /23 (or larger) to allow growth

• If you’re running Azure Firewall in a hub, you need at least /22

• If you’re only hosting NVAs (like your SD-WAN devices), you can often get away with /24

Why you can’t overlap

• Once a hub is created its CIDR can’t be changed

• The vWAN control plane enforces no overlap between: – Any two hub private address spaces in the same vWAN – On-prem networks – Any spoke VNets connected to your hubs

What you can do

• Keep your Security-as-a-Service hub at x.x.x.x/23

• Carve out a different /24 (or /23) for your SD-WAN/NVA hub — adjust based on how many NVA instances you’ll deploy

That way each virtual hub has room for its subnets (VPN, ER, P2S, firewall or NVA) without colliding.

References:

Getting Started with Virtual WAN https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about
About virtual hub settings (address space requirements) https://learn.microsoft.com/azure/virtual-wan/hub-settings#virtual-hub-address-space

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

0 comments

1 additional answer

Your answer

Answer 1

Each virtual hub in a Virtual WAN must have its own, non-overlapping private address space. The hub address space:

Cannot be reused between hubs in the same Virtual WAN.
Must not overlap with other hubs, on-premises networks, or connected VNets.

From the guidance:

Minimum hub size is /24.
Recommended size is /23 or larger for future scalability.
If Azure Firewall is used in a hub, a minimum of /22 is required.

So for the second hub (SD-WAN NVA hub), another different CIDR block is required, for example:

Security hub: 10.0.0.0/23
SD-WAN hub: 10.0.2.0/23

Both are /23, but they must not overlap. Using /23 per hub is normal and recommended for scalability; it is not considered “too much” for production designs, especially when using NVAs or firewalls.

References: