Skip to content
🚀 Azure Launchpad (SMB / SMEC Edition)

Full scenario

Approx. cost: ~$616 / month (Firewall Basic + VpnGw2AZ).

What you get

Everything from Firewall and VPN:

  • Spoke route table sends 0.0.0.0/0 through the firewall
  • VPN Gateway on GatewaySubnet, gateway transit enabled across hub ↔ spoke peering
  • NAT Gateway is not deployed — firewall is the sole egress path

When to choose it

  • Regulated workloads or customer compliance needs
  • Hybrid connectivity and centralized egress inspection
  • Future expansion expected (more spokes can attach via additional peerings)

Deploy

Terminal window
terraform workspace select -or-create full
terraform apply -var-file=scenarios/full.tfvars

Operational notes

  • Tighten the empty firewall policy to allow only required FQDNs/CIDRs before pushing real workloads
  • Add a azurerm_local_network_gateway + connection (see VPN scenario for template)
  • Enable diagnostic settings on the firewall + VPN gateway pointing at the Log Analytics workspace already deployed