Azure Network Topology

Rebased from azure-infra Terraform on 2026-06-10 (review issue #138). This is the Azure hub-spoke narrative; the authoritative address plan (all CIDRs, subnets, hosts) lives in Network Topology and the route-table detail in UDR Routing Design. One source per fact — don't duplicate tables here.

Topology Overview — Two-Firewall Hub-Spoke

The earlier single-firewall hub design was replaced by the VPNLYR two-firewall architecture (rationale: Two-Firewall Architecture):

                         Internet
                            │
                            ▼
              ┌──────────────────────────┐
              │  PublicFW  (10.99/16)    │  CIRIUS-SVCS-FW
              │  untrust 10.99.1.4       │  trust 10.99.2.4
              └──────────┬───────────────┘
        spokes: DMZ (10.6/16) · RODC (10.11/16)
                Logging PEs (10.40/16) · Twingate
                            │
              ┌──────────────────────────┐
              │  PrivateFW (10.98/16)    │  CIRIUS-PVT-FW
              │  untrust 10.98.1.4       │  trust 10.98.2.4
              └──────────┬───────────────┘
        spokes: Prod (10.20/16) · Identity (10.10/16)
                Dev (10.30/16) · Legacy Svcs (10.4/16, decom)

• PublicFW owns the internet edge and the edge-adjacent spokes (DMZ, RODC, logging private endpoints, Twingate connectors).
• PrivateFW owns the internal workload spokes (prod, identity, dev, decommission-bound legacy).
• The two firewall VNets peer with each other; internal-spoke traffic to the internet flows spoke → PrivateFW (10.98.2.4) → PublicFW (10.99.2.4) → out.
• There is no Management VNet — administration is via Twingate (primary) and GlobalProtect (CEO/CTO only, pvt.ciriusgroup.com:7000).

Spoke Isolation

All direct spoke↔spoke peerings (including the old identity↔prod and identity↔legacy pairs) were removed — peering system routes (/16) bypassed firewall inspection. Every spoke-to-spoke flow now traverses a Palo Alto:

• prod ↔ identity, prod ↔ dev, identity ↔ legacy: via PrivateFW (default route → 10.98.2.4)
• DMZ → identity/prod, anything ↔ RODC: via PublicFW (10.99.2.4)
• The RODC VNet deliberately peers only with PublicFW — it is the sole DC reachable from the DMZ zone, keeping writable DCs off the edge path.

Sources: peering blocks and removal comments in firewall/net_vnet.tf, firewall/net_privatefw.tf, identity/net_vnet.tf, prod/net_vnet.tf, identity/net_rodc.tf.

Traffic Flows

Flow	Path
Internal spoke → Internet	spoke UDR 0.0.0.0/0 → 10.98.2.4 (PrivateFW) → 10.99.2.4 (PublicFW) → Internet
DMZ/RODC → Internet	spoke UDR 0.0.0.0/0 → 10.99.2.4 (PublicFW) → Internet
Inbound from Internet	PublicFW untrust (10.99.1.4) → policy → destination spoke
Return paths to internal spokes	PublicFW private-subnet routes 10.10/16, 10.20/16, 10.30/16, 10.4/16 → 10.98.1.4 (PrivateFW untrust)
Remote access	Twingate connectors (PublicFW spoke) and GlobalProtect (pvt.ciriusgroup.com:7000)

Exact route tables, the 10.98.2.4-vs-10.99.2.4 rule, and the asymmetric-routing failure mode: UDR Routing Design.

DDE Tenant

The customer-facing DDE environment (ciriusdde.com) is a separate Azure tenant with its own two-VNet topology — see DDE Network Topology. No VNet peering exists between tenants.

Legacy & Decommission

• CiriusSvcsVNET (10.4.0.0/16) — pre-VPNLYR stack, decommission-bound; blocked on Palo Alto LDAP/RADIUS bindings to the legacy DCs (10.4.4.4/.5) and legacy API servers. Tracker: CiriusSvcs VNet Dependencies.
• vnet-dashboard (10.5.0.0/16) — decommissioned; gone from code. (A leftover prod route to it is tracked as an infra issue — see the inconsistencies list in Network Topology.)

Known Drift

Live Terraform inconsistencies found during this rebase (prod's to-dev-spoke via 10.99.2.4, the leftover 10.5.0.0/16 route, GP pool conflict) are catalogued in Network Topology § Known Infrastructure Inconsistencies and tracked as azure-infra issues — they are bugs to fix in code, not facts to document around.