Skip to main content
Welcome. In this lesson you’ll learn how Network Virtual Appliances (NVAs) are used inside Azure Virtual Hubs — why they matter, common deployment patterns, and the management tasks you’ll perform once an NVA is running. Network Virtual Appliances are virtualized network devices — for example, firewalls, routers, and load balancers — delivered as virtual machines or marketplace images. In Azure Virtual Hubs, NVAs centralize inspection, routing, and security enforcement for hub-and-spoke topologies, enabling consistent policy enforcement and advanced traffic processing across multiple spokes. This lesson covers both conceptual and operational tasks so you can design, deploy, and maintain an NVA in a Virtual Hub. What you will learn
  • Manage an NVA in a Virtual Hub:
    • Monitor health and metrics.
    • Configure settings and policies.
    • Apply updates and manage lifecycle.
  • Deploy an NVA into a Virtual Hub:
    • Choose an appropriate appliance image or VM size.
    • Integrate the NVA with hub routing and security constructs.
    • Verify traffic flow and policies.
This lesson focuses on the conceptual steps and management tasks for NVAs in an Azure Virtual Hub. A basic understanding of Azure Virtual Hubs, hub routing, and virtual machine administration will help you follow along.
Why use an NVA in a Virtual Hub?
  • Centralized security and inspection: route inter-spoke or egress traffic through a firewall or DPI appliance.
  • Advanced routing: run custom routing or packet manipulation not supported by built-in hub routing.
  • Vendor features: leverage third-party firewall, WAN optimization, or IDS/IPS features available through marketplace appliances.
When to prefer an NVA vs native Azure services
Use CasePrefer NVA whenPrefer native Azure service when
Deep packet inspection, Stateful firewallYou need vendor-specific features (IDS/IPS, WAF, advanced logging)Basic network security via Azure Firewall or NSGs
Complex routing, protocol manipulationAppliance supports custom routing policies or non-standard protocolsHub route tables and Route Server suffice
Integrated management and loggingYou need central management across multiple hubs/spokesAzure-native solutions integrate more tightly with Azure Monitor and services
Recommended prerequisites
  • Familiarity with Azure Virtual Hub architecture and hub/spoke network design.
  • Basic VM management (images, sizes, NICs).
  • Access to the Azure subscription with network contributor or higher role.
Helpful references
A presentation slide titled "Learning Objectives" with a teal gradient panel on the left. It lists two items: "Learning to Manage an NVA in a Virtual hub" and "Learning to Deploy an NVA in your Virtual hub."

Watch Video