Deploying Azure Hub and Spoke Routers
This guide walks you through deploying a hub router and a spoke router on Azure as conductor-managed SSR instances using the Bring Your Own License (BYOL) plan. When you complete this guide, both routers will be running SSR 7.1.4, connected to a pre-existing SSR conductor, and forwarding traffic with the following behavior:
- Hub router — provides direct internet breakout for hub LAN users and acts as the internet gateway for the spoke router over an SVR peer path.
- Spoke router — provides LAN services for spoke users and routes internet-bound traffic through the hub router via SVR.
- Both routers — reach the conductor using management over forwarding on their WAN interfaces.
This guide assumes a conductor is already installed and running SSR 7.1.4. If you have not yet deployed a conductor, complete the Azure Conductor Deployment Guide first.
Guide Topics
| Step | Topic | Description |
|---|---|---|
| 1 | Create the Hub Router VM | Deploy the BYOL Hub Router VM from the Azure Marketplace |
| 2 | Create the Spoke Router VM | Deploy the BYOL Spoke Router VM from the Azure Marketplace |
| 3 | Verify Installation and Discover VMBus UUIDs | Wait for SSR 7.1.4 installation to complete and identify NIC VMBus UUIDs for both routers |
| 4 | Configure Hub and Spoke Routers | Configure both routers on the conductor with WAN, LAN, and internet routing |
| — | Appendix — Hub and Spoke Configuration | Complete PCLI configuration reference for both routers |
Network Topology
The diagram below shows the logical network this guide builds.
Roles
| Device | Type | Role |
|---|---|---|
Conductor | Azure VM (BYOL) | Pre-existing conductor — centralized management and provisioning |
azure-hub-router | Azure VM (BYOL) | Hub router — internet breakout for hub LAN and spoke SVR traffic |
azure-spoke-router | Azure VM (BYOL) | Spoke router — LAN services, routes internet via hub SVR peer |
This guide uses an Azure deployed conductor in the examples. However, any type of SSR conductor can be used, hardware or virtual.
Network Design Reference
The following IP addressing and naming scheme is used consistently throughout this guide. Substitute your own values when configuring your network.
| Parameter | Example Value | Description |
|---|---|---|
| Azure Region | eastus | Azure region for all deployed resources |
| Resource Group | SSR-RG | Azure resource group containing all resources |
| VNet Name | SSR-VNet | Virtual network address space 10.0.0.0/16 |
| Conductor Subnet | ssr-conductor-subnet | Conductor management subnet (10.0.0.0/24) |
| Conductor Private IP | 10.0.0.10 | Static private IP assigned within the conductor subnet |
| Conductor Public IP | <auto-assigned> | Azure-assigned public IP — used for SSH, GUI, and as the conductor address |
| Authority Name | Authority128 | SSR organizational authority name |
| Conductor Name | Conductor | Conductor system name |
| Hub WAN Subnet | ssr-hub-wan | Hub router public (WAN) subnet (10.0.1.0/24) |
| Hub LAN Subnet | ssr-hub-lan | Hub router private (LAN) subnet (10.0.2.0/24) |
| Hub Router Name | azure-hub-router | Hub router system name |
| Hub Node Name | node0 | Hub router node name |
| Hub WAN Device Interface | wan-dev | Hub WAN device interface name |
| Hub WAN Network Interface | wan1 | Hub WAN network interface name |
| Hub LAN Device Interface | lan-dev | Hub LAN device interface name |
| Hub LAN Network Interface | lan1 | Hub LAN network interface name |
| Hub LAN IP | 10.0.2.1/24 | LAN gateway address assigned to the hub LAN interface |
| Hub Tenant | hub-corp | Hub LAN-side user tenant |
| Spoke WAN Subnet | ssr-spoke-wan | Spoke router public (WAN) subnet (10.0.3.0/24) |
| Spoke LAN Subnet | ssr-spoke-lan | Spoke router private (LAN) subnet (10.0.4.0/24) |
| Spoke Router Name | azure-spoke-router | Spoke router system name |
| Spoke Node Name | node0 | Spoke router node name |
| Spoke WAN Device Interface | wan-dev | Spoke WAN device interface name |
| Spoke WAN Network Interface | wan1 | Spoke WAN network interface name |
| Spoke LAN Device Interface | lan-dev | Spoke LAN device interface name |
| Spoke LAN Network Interface | lan1 | Spoke LAN network interface name |
| Spoke LAN IP | 10.0.4.1/24 | LAN gateway address assigned to the spoke LAN interface |
| Spoke Tenant | spoke-corp | Spoke LAN-side user tenant |
| Service Name | Internet-Traffic | Internet breakout service |
| Service Address | 0.0.0.0/0 | All internet-bound traffic |
| Neighborhood | internet | SVR peering neighborhood name |
Prerequisites
Before beginning, ensure the following are available:
- Pre-existing SSR conductor — running SSR 7.1.4 with a static public IP reachable from the hub and spoke WAN interfaces. This guide uses the conductor from the Azure Conductor Deployment Guide.
- Azure subscription — with permission to create VMs, VNets, network security groups, and managed identities.
- Azure VNet —
SSR-VNetwith at least the following subnets already created:ssr-hub-wan— hub router WAN subnet; must have internet egress.ssr-hub-lan— hub router LAN subnet.ssr-spoke-wan— spoke router WAN subnet; must have internet egress.ssr-spoke-lan— spoke router LAN subnet.
- Azure Managed Identity — with the minimum read permissions listed in Step 1.
- Juniper software access credentials — Artifactory username and token for SSR software downloads.
Software Version Requirements
This guide installs SSR 7.1.4 on both routers. The conductor must be running SSR 7.1.4 or newer before deploying the routers.
The router software version must be lower than or equal to the conductor software version.