Global Network Reference Architecture

Version 1.0 Date 2026-06-22 Scope 3 subsidiaries (US, Japan, UK) · AWS, GCP, Azure · on-premises offices Companion diagram global-network-hub-spoke-topology.svg Supernet 10.0.0.0/8 (RFC 1918) 1. Purpose and scope This document describes the target-state global network connecting three subsidiary offices and their respective public-cloud and on-premises environments.

Use Case — OpenVPN Client VPN to the UDM Pro Max with RADIUS Authentication

Gateway UniFi UDM Pro Max (US HQ office) VPN client pool 10.12.70.0/24 (the VPN VLAN) Auth backend UDM built-in RADIUS server Tunnel OpenVPN (UDP 1194), TLS + username/password via RADIUS 1. Choosing the approach (read first) UniFi's VPN options don't include a

Use Case — Site-to-Site VPN: US Office ↔ AWS VPC

On-prem side US HQ office, UniFi UDM Pro Max — 10.12.0.0/16 AWS side US AWS prod VPC, us-west-2 — 10.1.0.0/20 Tunnel IPsec site-to-site (IKEv2), static routing DNS UDM built-in DNS → conditional forward → Route 53 Resolver inbound endpoint 1. Architecture Office (UDM Pro Max) AWS

Use Case — US Office Network on a UniFi UDM Pro Max

Subsidiary US (10.0.0.0/12) Location US HQ office (on-premises) Gateway UniFi Dream Machine Pro Max (UDM-Pro-Max) On-prem block 10.12.0.0/14 (US on-prem) Office block 10.12.0.0/16 (US HQ) Segments 8 VLANs (Corporate WiFi, Guest WiFi, Data, Application, Management, Printers/IoT, VPN,

Use Case — US prod VNet in Azure

Subsidiary US (10.0.0.0/12) Provider / region Azure · West US 2 (westus2) Environment prod VNet Regional (vnet-us-prod-westus2), address space 10.8.0.0/19 Subnets 4 regional tier subnets (pub, app, data, mgmt) + platform subnets Each subnet is regional and automatically spans West US 2 zones 1, 2,

Use Case — Create the US prod VPC in GCP Oregon (us-west1)

Subsidiary US (10.0.0.0/12) Provider / region GCP · us-west1 (Oregon) Environment prod VPC Global, custom-mode (us-gcp-prod-vpc) Region block 10.4.0.0/16 (us-west1) Subnets 4 regional subnets — one per tier, each spanning all 3 zones 1. How GCP differs from AWS The same four-tier design maps onto

Use Case — Create the US prod VPC in AWS Oregon (us-west-2)

Subsidiary US (10.0.0.0/12) Provider / region AWS · us-west-2 (Oregon) Environment prod VPC CIDR 10.1.0.0/20 (4,096 addresses) Subnets 12 — 4 tiers × 3 availability zones 1. Where this VPC sits in the plan The VPC inherits its range top-down from the enterprise IPAM hierarchy:

Enterprise IP Address Management (IPAM) — Reference Architecture

Version 1.0 Date 2026-06-22 Status Reference design Scope 3 subsidiaries (US, Japan, UK) · AWS, GCP, Azure · on-premises datacenters Supernet 10.0.0.0/8 (RFC 1918) 1. Purpose and scope This document defines a single, hierarchical IPv4 addressing scheme and the governance model that keeps it accurate across multiple