Skip to content

Hybrid Networking & Azure Virtual WAN Backbone

Global Transit Backbone HITRUST Control 09.0

1. Global Virtual WAN Secured Hub Topology

Mosaic Healthcare operates an active-active dual-region hybrid backbone anchored by Azure Virtual WAN (vWAN). The topology interconnects 140+ ambulatory clinics, regional hospitals, remote physician networks, and multi-cloud landing zones with strict cryptographic isolation and micro-segmentation.

graph TB subgraph "On-Premises Healthcare Edge" HospitalEdge["Regional Medical Centers (x12)
Dual 10Gbps ExpressRoute Direct with MACsec"] ClinicEdge["Ambulatory Care Clinics (x140)
Dual Cisco Meraki / Fortinet SD-WAN IPsec"] MCOpsEdge["Multi-Cloud Ingress (AWS / GCP)
Megaport Cloud Router / Site-to-Site IPsec"] end subgraph "Azure Primary Region: East US 2 (Hub-01)" vWANHub1["Azure Virtual WAN Secured Hub
vwan-hub-eastus2 (10.200.0.0/20)"] AzFW1["Azure Firewall Premium
(IDPS, TLS Inspection, FQDN Filtering)"] ERGW1["ExpressRoute Gateway (Scale Unit 4)
ASN: 65010"] VPNGW1["VPN Gateway (Scale Unit 2)
ASN: 65011"] DNSResolver1["Azure Private DNS Resolver
Inbound & Outbound Endpoints"] vWANHub1 --> AzFW1 vWANHub1 --> ERGW1 vWANHub1 --> VPNGW1 vWANHub1 --> DNSResolver1 end subgraph "Azure Secondary Region: Central US (Hub-02 DR)" vWANHub2["Azure Virtual WAN Hub DR
vwan-hub-centralus (10.201.0.0/20)"] AzFW2["Azure Firewall Premium DR"] ERGW2["ExpressRoute Gateway DR"] VPNGW2["VPN Gateway DR"] vWANHub2 --> AzFW2 vWANHub2 --> ERGW2 vWANHub2 --> VPNGW2 end subgraph "Spoke Virtual Networks" ClinicalSpoke["Spoke: Clinical Workloads (10.240.0.0/18)
Epic, Cerner, FHIR Ingestion"] AnalyticsSpoke["Spoke: Databricks Lakehouse (10.240.64.0/18)
Delta Lake, AI TimesFM Models"] ManagementSpoke["Spoke: Platform & SIEM (10.240.128.0/20)
Sentinel, Bastion, AD DS"] end HospitalEdge -->|Primary 10G ER Circuit| ERGW1 HospitalEdge -.->|Secondary 10G ER Circuit| ERGW2 ClinicEdge -->|Active S2S IPsec| VPNGW1 ClinicEdge -.->|Failover S2S IPsec| VPNGW2 MCOpsEdge -->|Multi-Cloud Transit| VPNGW1 vWANHub1 ---|Global vWAN Inter-Hub Peering| vWANHub2 AzFW1 -->|Secured Routing Intent: RFC1918| ClinicalSpoke AzFW1 -->|Secured Routing Intent: RFC1918| AnalyticsSpoke AzFW1 -->|Secured Routing Intent: RFC1918| ManagementSpoke

2. Enterprise IP Addressing Architecture (Non-Overlapping CIDR)

To eliminate routing collisions during rapid healthcare mergers and acquisitions (M&A), Mosaic enforces a strict global IPv4 allocation schema:

Network Tier / Scope CIDR Allocation Description & Purpose
Enterprise Virtual WAN Hub (East US 2) 10.200.0.0/20 Core gateway infrastructure, Azure Firewall, GatewaySubnets
Enterprise Virtual WAN Hub (Central US DR) 10.201.0.0/20 Secondary failover gateway infrastructure
Platform Management & Identity Spokes 10.240.128.0/20 Entra ID Domain Services, Log Analytics, Sentinel Gateways
Clinical Tier-1 EHR Spokes (Prod) 10.240.0.0/18 Epic EHR web/app tiers, InterSystems HealthShare, FHIR APIs
Lakehouse & Data Analytics Spokes 10.240.64.0/18 Databricks control/data planes, TimesFM GPU inference nodes
M&A Acquisition Transit Subnet (Quarantine) 10.245.0.0/20 Isolated staging VPC for incoming acquired networks
On-Premises Hospital Campuses (x12) 10.100.0.0/14 High-acuity campus LANs, ICU telemetry, medical modalities
Ambulatory & Regional Clinics (x140) 10.160.0.0/12 Clinic LANs (allocated as /24 per clinic site)

3. Azure Firewall Premium Security Policies

The centralized Azure Firewall Premium in the Secured Virtual Hub inspects all East-West (Spoke-to-Spoke) and North-South (EHR-to-OnPrem / Internet) traffic:

flowchart LR Ingress[Inbound Traffic from Clinic / Spoke] --> SNI[TLS 1.3 SNI Header Inspection] SNI --> IDPS[Signature-based IDPS Engine
(67,000+ Healthcare Threat Rules)] IDPS --> FQDN[Application Rule Engine
(FQDN & Web Category Filtering)] FQDN -->|Allowed| Dest[Destination Private Endpoint / Spoke] FQDN -->|Blocked / Malicious| Drop[Automated Drop & Sentinel Alert Incident]

Key Firewall Rule Collections

  1. Clinical Ingestion (HL7 / FHIR):
  2. Source: Clinic Edge CIDRs (10.160.0.0/12)
  3. Destination: Clinical Ingestion Private Endpoints (10.240.10.50, 10.240.10.51)
  4. Protocols/Ports: TCP/443 (HTTPS FHIR R4), TCP/2575 (MLLP over TLS 1.3 for HL7 v2)

  5. Action: Allow with IDPS Alert & Deny mode.

  6. Outbound Internet Lockdown (Zero Trust):

  7. Source: All Production Spokes (10.240.0.0/16)
  8. Destination: *.epic.com, *.cerner.com, *.microsoft.com, login.microsoftonline.com
  9. Protocols: HTTPS on port 443 only. All other outbound destinations denied by default.

4. Split-Horizon Private DNS Architecture

Private Endpoints allow microservices, Lakehouses, and clinical APIs to communicate over private IPs without traversing the public internet.

sequenceDiagram autonumber participant App as Clinical Microservice (Spoke VNet) participant Resolver as Azure Private DNS Resolver (Hub) participant PrivZone as Azure Private DNS Zone (*.privatelink.vaultcore.azure.net) participant KV as Gunslinger Key Vault (Private Endpoint IP: 10.240.12.10) App->>Resolver: DNS Query: `kv-mosaic-prod.vaultcore.azure.net` Resolver->>PrivZone: Lookup CNAME to `kv-mosaic-prod.privatelink.vaultcore.azure.net` PrivZone-->>Resolver: Return A Record: `10.240.12.10` Resolver-->>App: Return Private IP `10.240.12.10` App->>KV: TLS 1.3 Session over Private Link (No Internet Traversal)