# Hub-and-Spoke VPN Topology

DevFeed: [Hub-and-Spoke VPN Topology](<https://devfeed.tech/articles/hub-and-spoke-vpn-topology-11069.md>)

Original publisher: [Read original article](<https://blog.ipspace.net/2024/09/hub-spoke-vpn-topology/>)

Published: 2024-09-16T06:24:00Z

Content type: tutorial

Language: en

Sources: [ipSpace.net blog](<https://devfeed.tech/sources/ipspace-net-blog.md>)

Topics: [MPLS VPN](<https://devfeed.tech/topics/mpls-vpn.md>), [networking](<https://devfeed.tech/topics/networking.md>), [Firewall](<https://devfeed.tech/topics/firewall.md>), [Routing (disambiguation)](<https://devfeed.tech/topics/routing.md>), [BGP](<https://devfeed.tech/topics/bgp.md>), [evpn](<https://devfeed.tech/topics/evpn.md>)

Tags: [bgp](<https://devfeed.tech/tags/bgp.md>), [design](<https://devfeed.tech/tags/design.md>), [evpn](<https://devfeed.tech/tags/evpn.md>), [firewall](<https://devfeed.tech/tags/firewall.md>), [mpls-vpn](<https://devfeed.tech/tags/mpls-vpn.md>), [network](<https://devfeed.tech/tags/network.md>), [ospf](<https://devfeed.tech/tags/ospf.md>), [routing](<https://devfeed.tech/tags/routing.md>)

## AI overview

This article examines hub-and-spoke VPN topology in MPLS/VPN and EVPN networks, focusing on routing traffic through a central firewall. It explains VRF separation, route propagation and leaking, firewall interface designs, stateful inspection challenges, and routing protocol considerations.

## Source excerpt

Hub-and-spoke topology is by far the most complex topology I've ever encountered in the MPLS/VPN (and now EVPN) world. It's used when you want to push all the traffic between sites attached to a VPN (spokes) through a central site (hub), for example, when using a central firewall. You get the following diagram when you model the traffic flow requirements with VRFs. The forward traffic uses light yellow arrows, and the return traffic uses dark orange ones. Read more ...