Azure hybrid hub-spoke topology with Couchbase XDCR replication bridges on-premises data centers to Azure Capella clusters via ExpressRoute/VPN and centralized firewall inspection. Traffic flows from on-premises through the hub's gateway and Azure Central Firewall to spoke application services and the Couchbase Capella data subnet, enabling secure cross-datacenter replication. This architecture enforces zero-trust inspection, network segmentation, and compliance monitoring across hybrid boundaries. Fork this diagram on Diagrams.so to customize subnets, add additional spokes, or adjust firewall rules for your environment. The hub-spoke pattern with remote gateways minimizes latency while maintaining centralized security controls for XDCR replication workloads.