Guidelines for Virtual WAN Connections to Azure vHub

Updated: July 8, 2026

Want to summarize with AI?

Review the prerequisites and limitations for connecting a Cisco Multicloud Defense service VNet to an Azure Virtual WAN vHub.

Prerequisites

An Azure subscription with VWAN and vHub must be configured.
Service VNet and spoke VNets must be set up in Azure.
Multicloud Defense gateway must be deployed in the service VNet.
Permissions must be available to create and manage virtual network connections and route tables in Azure.
Permissions must be available to enable and disable vHub connections.

Limitations

Multicloud Defense is not supported as an NVA within a vHub.
Classless Inter Domain Routing (CIDR) selection is only available during the edit phase, not during VNet creation.
Route propagation is dependent on the configuration of the egress or ingress gateway.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.