Question about the "rt-<region>-hub-ingress" route table in the HUB diagrams

[NoeliaToledano]

Hello,

While reviewing the Landing Zone diagrams related to HUB routing, I noticed that the route table rt-region-hub-ingress contains two entries pointing to the nfw-region-hub-int IP address, listed right after the 0.0.0.0/0 route.
I’ve also seen the same pattern in HUB A, HUB B, and HUB C.

My question is:

Wouldn’t those additional routes be redundant?
From a routing perspective, the 0.0.0.0/0 entry should already forward all traffic to the nfw-region-hub-int, so it’s unclear why the more specific routes are needed when they use the same next hop.

If those two routes were removed, would the routing still operate correctly, since all traffic would still be captured by the 0.0.0.0/0 entry?

Is there any specific design requirement or use case that justifies keeping them, or could they simply be included for illustrative purposes in the diagram?

Thanks in advance for any clarification.

[vavardan]

Hello @NoeliaToledano,

Thank you for the great question.

The short answer is: Yes - the routes shown in the diagram are primarily for illustrative purposes, and the design would also work with a single 0.0.0.0/0 route rule.

However, there are several reasons why we still include these routes in a Hub and Spoke architecture design:

1. Operational flexibility:
   It provides a ready-to-use configuration for scenarios where only East–West communication is required, and/or when outbound traffic must be restricted immediately as a security measure, while still ensuring uninterrupted internal connectivity.

2. Improved troubleshooting:
   Having explicit routes makes network packet tracing and troubleshooting more straightforward.

3. Mandatory for Hub B:
   In the case of Hub B, there is an additional route rule for the Public Load Balancer subnet: 10.0.0.0/24 → NFW (the one highlighted in the screenshot). This entry is required to ensure it takes precedence over the VCN’s implicit local route; without it, asymmetric routing would occur (Overview of Routing for a VCN: longest prefix match).

I hope this clarifies the design rationale and answers your question.

Kind regards.

[NoeliaToledano]

Hello @vavardan,

Thank you very much for the detailed explanation, it was really helpful.

Your clarification about the illustrative purpose of the additional routes, as well as the operational and troubleshooting benefits, makes complete sense.

This fully answers my question.

Thanks again for the thorough breakdown and for taking the time to provide such a clear explanation.

Kind regards.