Appendix: Azure Hub and Spoke Configuration
This appendix contains the complete SSR PCLI configuration for the azure-hub-router and azure-spoke-router deployments described in this guide. This configuration reflects the final state after completing all steps through Step 4 — Configure Hub and Spoke Routers.
important
Replace all placeholder values (shown in angle brackets) with values from your environment before applying:
<conductor-public-ip>— public IP of the conductor VM.<conductor-vmbus-uuid>— VMBus UUID of the conductor management interface (found indevicemap.jsonon the conductor VM).<hub-wan-vmbus-uuid>— VMBus UUID of the hub router WAN NIC (ge-0-0).<hub-lan-vmbus-uuid>— VMBus UUID of the hub router LAN NIC (ge-0-1).<spoke-wan-vmbus-uuid>— VMBus UUID of the spoke router WAN NIC (ge-0-0).<spoke-lan-vmbus-uuid>— VMBus UUID of the spoke router LAN NIC (ge-0-1).
Network Design Reference
The following IP addressing and naming scheme is used consistently throughout this guide. Substitute your own values when configuring your network.
| Parameter | Example Value | Description |
|---|---|---|
| Azure Region | eastus | Azure region for all deployed resources |
| Resource Group | SSR-RG | Azure resource group containing all resources |
| VNet Name | SSR-VNet | Virtual network address space 10.0.0.0/16 |
| Conductor Subnet | ssr-conductor-subnet | Conductor management subnet (10.0.0.0/24) |
| Conductor Private IP | 10.0.0.10 | Static private IP assigned within the conductor subnet |
| Conductor Public IP | <auto-assigned> | Azure-assigned public IP — used for SSH, GUI, and as the conductor address |
| Authority Name | Authority128 | SSR organizational authority name |
| Conductor Name | Conductor | Conductor system name |
| Hub WAN Subnet | ssr-hub-wan | Hub router public (WAN) subnet (10.0.1.0/24) |
| Hub LAN Subnet | ssr-hub-lan | Hub router private (LAN) subnet (10.0.2.0/24) |
| Hub Router Name | azure-hub-router | Hub router system name |
| Hub Node Name | node0 | Hub router node name |
| Hub WAN Device Interface | wan-dev | Hub WAN device interface name |
| Hub WAN Network Interface | wan1 | Hub WAN network interface name |
| Hub LAN Device Interface | lan-dev | Hub LAN device interface name |
| Hub LAN Network Interface | lan1 | Hub LAN network interface name |
| Hub LAN IP | 10.0.2.1/24 | LAN gateway address assigned to the hub LAN interface |
| Hub Tenant | hub-corp | Hub LAN-side user tenant |
| Spoke WAN Subnet | ssr-spoke-wan | Spoke router public (WAN) subnet (10.0.3.0/24) |
| Spoke LAN Subnet | ssr-spoke-lan | Spoke router private (LAN) subnet (10.0.4.0/24) |
| Spoke Router Name | azure-spoke-router | Spoke router system name |
| Spoke Node Name | node0 | Spoke router node name |
| Spoke WAN Device Interface | wan-dev | Spoke WAN device interface name |
| Spoke WAN Network Interface | wan1 | Spoke WAN network interface name |
| Spoke LAN Device Interface | lan-dev | Spoke LAN device interface name |
| Spoke LAN Network Interface | lan1 | Spoke LAN network interface name |
| Spoke LAN IP | 10.0.4.1/24 | LAN gateway address assigned to the spoke LAN interface |
| Spoke Tenant | spoke-corp | Spoke LAN-side user tenant |
| Service Name | Internet-Traffic | Internet breakout service |
| Service Address | 0.0.0.0/0 | All internet-bound traffic |
| Neighborhood | internet | SVR peering neighborhood name |
Applying This Configuration
This configuration can be applied to the conductor using the PCLI import function.
-
Save the configuration below to a file — for example,
azure-hub-spoke.cfg. -
Copy the file to the conductor:
scp -i azure-hub-spoke.cfg t128@:/tmp/ -
Log in to the conductor PCLI:
ssh -i t128@<conductor-public-ip>su admin -
Enter configuration mode and import:
admin@node0.Conductor# import config /tmp/azure-hub-spoke.cfg -
Review any validation warnings, then commit:
admin@node0.Conductor (config)# commitAre you sure you want to commit the candidate config? [y/N]: y
Alternatively, you may copy and paste each block into the PCLI while in configure → edit mode.
note
The authority-level objects the routers depend on (hub-corp tenant, spoke-corp tenant, Internet-Traffic service, authority name, and conductor address) are included in the configuration block below. If your conductor already has an Internet-Traffic service or other conflicting objects, reconcile those before importing.
Complete Configuration
config
authority
conductor-address <conductor-public-ip>
router conductor-1
name conductor-1
node node0
name node0
asset-id conductor-1
platform-type "Virtual Machine"
exit
exit
router ssr-router-2
name ssr-router-2
inter-node-security internal
dns-config static
mode static
address 1.1.1.1
address 8.8.8.8
exit
node node0
name node0
asset-id ssr-router-2
role combo
platform-type "Virtual Machine"
device-interface wan-dev
name wan-dev
vmbus-uuid 00224879-yourvmbusuuidhere
network-interface wan1
name wan1
global-id 1
conductor true
default-route true
neighborhood internet
name internet
exit
inter-router-security internal
source-nat true
host-service ssh
service-type ssh
access-policy 0.0.0.0/0
source 0.0.0.0/0
exit
exit
management true
management-vector
name mgmt-vec-wan
priority 100
exit
dhcp v4
exit
exit
device-interface lan-dev
name lan-dev
vmbus-uuid 00224879-yourvmbusuuidhere
network-interface lan1
name lan1
global-id 2
tenant spoke-corp
source-nat true
address 10.8.2.5
ip-address 10.8.2.5
prefix-length 24
exit
exit
exit
exit
service-route internet-via-hub
name internet-via-hub
service-name Internet-Traffic
peer ssr-hub-router-1
exit
exit
router ssr-hub-router-1
name ssr-hub-router-1
inter-node-security internal
dns-config static
mode static
address 1.1.1.1
address 8.8.8.8
exit
node node0
name node0
asset-id ssr-hub-router-1
role combo
platform-type "Virtual Machine"
device-interface wan-dev
name wan-dev
vmbus-uuid 002248be-yourvmbusuuidhere
network-interface wan1
name wan1
global-id 3
conductor true
default-route true
neighborhood internet
name internet
topology hub
exit
inter-router-security internal
source-nat true
host-service ssh
service-type ssh
access-policy 0.0.0.0/0
source 0.0.0.0/0
exit
exit
management true
management-vector
name mgmt-vec-wan
priority 100
exit
dhcp v4
exit
exit
device-interface lan-dev
name lan-dev
vmbus-uuid 002248be-yourvmbusuuidhere
network-interface lan1
name lan1
global-id 4
tenant hub-corp
source-nat true
address 10.8.6.4
ip-address 10.8.6.4
prefix-length 24
exit
exit
exit
exit
service-route internet-breakout
name internet-breakout
service-name Internet-Traffic
next-hop node0 wan1
node-name node0
interface wan1
exit
exit
exit
tenant hub-corp
name hub-corp
exit
tenant spoke-corp
name spoke-corp
exit
service Internet-Traffic
name Internet-Traffic
security internal
address 0.0.0.0/0
access-policy hub-corp
source hub-corp
exit
access-policy spoke-corp
source spoke-corp
exit
exit
exit
exit
Interface Summary
Hub Router (azure-hub-router)
| Interface | Device Interface | VMBus UUID | Type | Configuration |
|---|---|---|---|---|
wan1 | wan-dev | <hub-wan-vmbus-uuid> | External | DHCP v4, conductor, default-route, source-nat, management, neighborhood internet topology hub |
lan1 | lan-dev | <hub-lan-vmbus-uuid> | External | Tenant hub-corp, static 10.0.2.1/24, source-nat |
Spoke Router (azure-spoke-router)
| Interface | Device Interface | VMBus UUID | Type | Configuration |
|---|---|---|---|---|
wan1 | wan-dev | <spoke-wan-vmbus-uuid> | External | DHCP v4, conductor, default-route, source-nat, management, neighborhood internet topology spoke |
lan1 | lan-dev | <spoke-lan-vmbus-uuid> | External | Tenant spoke-corp, static 10.0.4.1/24, source-nat |
Service Route Summary
| Router | Service Route | Service | Type | Next Hop | Effect |
|---|---|---|---|---|---|
azure-hub-router | internet-breakout | Internet-Traffic | service-agent | node0/wan1 | Hub LAN and spoke SVR traffic breaks out directly to the internet. |
azure-spoke-router | internet-via-hub | Internet-Traffic | peer | azure-hub-router | Spoke internet traffic is forwarded over the SVR peer path to the hub for breakout. |
Traffic Flow Reference
The following table describes how internet traffic flows in the completed hub-and-spoke network.
| Source | Destination | Path |
|---|---|---|
| Hub LAN device (10.0.2.x) | Internet | Hub LAN → hub-corp tenant → Internet-Traffic service → internet-breakout route → hub wan1 → internet |
| Spoke LAN device (10.0.4.x) | Internet | Spoke LAN → spoke-corp tenant → Internet-Traffic service → internet-via-hub peer route → SVR path → hub wan1 → internet |
| Hub or spoke router | Conductor | Management over forwarding on wan1 using port 930/4505/4506; management-vector priority 100 on each router's WAN interface |