diff --git a/azurerm/internal/services/network/client/client.go b/azurerm/internal/services/network/client/client.go
index 7b18cadda36a..2cae99a7c50c 100644
--- a/azurerm/internal/services/network/client/client.go
+++ b/azurerm/internal/services/network/client/client.go
@@ -18,6 +18,7 @@ type Client struct {
 	ExpressRouteGatewaysClient           *network.ExpressRouteGatewaysClient
 	ExpressRoutePeeringsClient           *network.ExpressRouteCircuitPeeringsClient
 	FirewallPolicyClient                 *network.FirewallPoliciesClient
+	HubVirtualNetworkConnectionClient    *network.HubVirtualNetworkConnectionsClient
 	InterfacesClient                     *network.InterfacesClient
 	LoadBalancersClient                  *networkLegacy.LoadBalancersClient
 	LoadBalancerLoadBalancingRulesClient *networkLegacy.LoadBalancerLoadBalancingRulesClient
@@ -40,8 +41,8 @@ type Client struct {
 	VnetGatewayClient                    *network.VirtualNetworkGatewaysClient
 	VnetClient                           *network.VirtualNetworksClient
 	VnetPeeringsClient                   *network.VirtualNetworkPeeringsClient
-	VirtualWanClient                     *networkLegacy.VirtualWansClient
-	VirtualHubClient                     *networkLegacy.VirtualHubsClient
+	VirtualWanClient                     *network.VirtualWansClient
+	VirtualHubClient                     *network.VirtualHubsClient
 	VpnGatewaysClient                    *network.VpnGatewaysClient
 	VpnServerConfigurationsClient        *network.VpnServerConfigurationsClient
 	WatcherClient                        *network.WatchersClient
@@ -86,6 +87,9 @@ func NewClient(o *common.ClientOptions) *Client {
 	FirewallPolicyClient := network.NewFirewallPoliciesClientWithBaseURI(o.ResourceManagerEndpoint, o.SubscriptionId)
 	o.ConfigureClient(&FirewallPolicyClient.Client, o.ResourceManagerAuthorizer)
 
+	HubVirtualNetworkConnectionClient := network.NewHubVirtualNetworkConnectionsClientWithBaseURI(o.ResourceManagerEndpoint, o.SubscriptionId)
+	o.ConfigureClient(&HubVirtualNetworkConnectionClient.Client, o.ResourceManagerAuthorizer)
+
 	InterfacesClient := network.NewInterfacesClientWithBaseURI(o.ResourceManagerEndpoint, o.SubscriptionId)
 	o.ConfigureClient(&InterfacesClient.Client, o.ResourceManagerAuthorizer)
 
@@ -161,10 +165,10 @@ func NewClient(o *common.ClientOptions) *Client {
 	VnetGatewayConnectionsClient := network.NewVirtualNetworkGatewayConnectionsClientWithBaseURI(o.ResourceManagerEndpoint, o.SubscriptionId)
 	o.ConfigureClient(&VnetGatewayConnectionsClient.Client, o.ResourceManagerAuthorizer)
 
-	VirtualWanClient := networkLegacy.NewVirtualWansClientWithBaseURI(o.ResourceManagerEndpoint, o.SubscriptionId)
+	VirtualWanClient := network.NewVirtualWansClientWithBaseURI(o.ResourceManagerEndpoint, o.SubscriptionId)
 	o.ConfigureClient(&VirtualWanClient.Client, o.ResourceManagerAuthorizer)
 
-	VirtualHubClient := networkLegacy.NewVirtualHubsClientWithBaseURI(o.ResourceManagerEndpoint, o.SubscriptionId)
+	VirtualHubClient := network.NewVirtualHubsClientWithBaseURI(o.ResourceManagerEndpoint, o.SubscriptionId)
 	o.ConfigureClient(&VirtualHubClient.Client, o.ResourceManagerAuthorizer)
 
 	vpnGatewaysClient := network.NewVpnGatewaysClientWithBaseURI(o.ResourceManagerEndpoint, o.SubscriptionId)
@@ -194,6 +198,7 @@ func NewClient(o *common.ClientOptions) *Client {
 		ExpressRouteGatewaysClient:           &ExpressRouteGatewaysClient,
 		ExpressRoutePeeringsClient:           &ExpressRoutePeeringsClient,
 		FirewallPolicyClient:                 &FirewallPolicyClient,
+		HubVirtualNetworkConnectionClient:    &HubVirtualNetworkConnectionClient,
 		InterfacesClient:                     &InterfacesClient,
 		LoadBalancersClient:                  &LoadBalancersClient,
 		LoadBalancerLoadBalancingRulesClient: &LoadBalancerLoadBalancingRulesClient,
diff --git a/azurerm/internal/services/network/virtual_hub.go b/azurerm/internal/services/network/parse/virtual_hub.go
similarity index 53%
rename from azurerm/internal/services/network/virtual_hub.go
rename to azurerm/internal/services/network/parse/virtual_hub.go
index a71880e4e04c..bfc7dc392742 100644
--- a/azurerm/internal/services/network/virtual_hub.go
+++ b/azurerm/internal/services/network/parse/virtual_hub.go
@@ -1,4 +1,4 @@
-package network
+package parse
 
 import (
 	"fmt"
@@ -6,18 +6,28 @@ import (
 	"github.com/terraform-providers/terraform-provider-azurerm/azurerm/helpers/azure"
 )
 
-type VirtualHubResourceID struct {
+type VirtualHubId struct {
 	ResourceGroup string
 	Name          string
 }
 
-func ParseVirtualHubID(input string) (*VirtualHubResourceID, error) {
+func NewVirtualHubID(resourceGroup, name string) VirtualHubId {
+	return VirtualHubId{
+		ResourceGroup: resourceGroup,
+		Name:          name,
+	}
+}
+func (id VirtualHubId) ID(subscriptionId string) string {
+	return fmt.Sprintf("/subscriptions/%s/resourceGroups/%s/providers/Microsoft.Network/virtualHubs/%s", subscriptionId, id.ResourceGroup, id.Name)
+}
+
+func VirtualHubID(input string) (*VirtualHubId, error) {
 	id, err := azure.ParseAzureResourceID(input)
 	if err != nil {
 		return nil, fmt.Errorf("[ERROR] Unable to parse Virtual Hub ID %q: %+v", input, err)
 	}
 
-	virtualHub := VirtualHubResourceID{
+	virtualHub := VirtualHubId{
 		ResourceGroup: id.ResourceGroup,
 	}
 
@@ -31,16 +41,3 @@ func ParseVirtualHubID(input string) (*VirtualHubResourceID, error) {
 
 	return &virtualHub, nil
 }
-
-func ValidateVirtualHubID(i interface{}, k string) (warnings []string, errors []error) {
-	v, ok := i.(string)
-	if !ok {
-		return nil, []error{fmt.Errorf("expected type of %q to be string", k)}
-	}
-
-	if _, err := ParseVirtualHubID(v); err != nil {
-		return nil, []error{err}
-	}
-
-	return nil, nil
-}
diff --git a/azurerm/internal/services/network/parse/virtual_hub_connection.go b/azurerm/internal/services/network/parse/virtual_hub_connection.go
index d6467dbb3c83..eef518b30347 100644
--- a/azurerm/internal/services/network/parse/virtual_hub_connection.go
+++ b/azurerm/internal/services/network/parse/virtual_hub_connection.go
@@ -6,20 +6,33 @@ import (
 	"github.com/terraform-providers/terraform-provider-azurerm/azurerm/helpers/azure"
 )
 
-type VirtualHubConnectionResourceID struct {
+type VirtualHubConnectionId struct {
 	ResourceGroup  string
 	VirtualHubName string
 	Name           string
 }
 
-func ParseVirtualHubConnectionID(input string) (*VirtualHubConnectionResourceID, error) {
+func NewVirtualHubConnectionID(id VirtualHubId, name string) VirtualHubConnectionId {
+	return VirtualHubConnectionId{
+		ResourceGroup:  id.ResourceGroup,
+		VirtualHubName: id.Name,
+		Name:           name,
+	}
+}
+
+func (id VirtualHubConnectionId) ID(subscriptionId string) string {
+	base := NewVirtualHubID(id.ResourceGroup, id.VirtualHubName).ID(subscriptionId)
+	return fmt.Sprintf("%s/hubVirtualNetworkConnections/%s", base, id.Name)
+}
+
+func VirtualHubConnectionID(input string) (*VirtualHubConnectionId, error) {
 	id, err := azure.ParseAzureResourceID(input)
 	if err != nil {
 		return nil, fmt.Errorf("[ERROR] Unable to parse Virtual Hub Connection ID %q: %+v", input, err)
 	}
 
 	// /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/tom-dev99/providers/Microsoft.Network/virtualHubs/tom-devvh/hubVirtualNetworkConnections/first
-	connection := VirtualHubConnectionResourceID{
+	connection := VirtualHubConnectionId{
 		ResourceGroup:  id.ResourceGroup,
 		VirtualHubName: id.Path["virtualHubs"],
 		Name:           id.Path["hubVirtualNetworkConnections"],
diff --git a/azurerm/internal/services/network/parse/virtual_hub_connection_test.go b/azurerm/internal/services/network/parse/virtual_hub_connection_test.go
index 3bf547ee9fc2..fb0da33d13df 100644
--- a/azurerm/internal/services/network/parse/virtual_hub_connection_test.go
+++ b/azurerm/internal/services/network/parse/virtual_hub_connection_test.go
@@ -2,13 +2,27 @@ package parse
 
 import (
 	"testing"
+
+	"github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/resourceid"
 )
 
-func TestParseVirtualHubConnection(t *testing.T) {
+var _ resourceid.Formatter = VirtualHubConnectionId{}
+
+func TestVirtualHubConnectionIDFormatter(t *testing.T) {
+	subscriptionId := "12345678-1234-5678-1234-123456789012"
+	vhubid := NewVirtualHubID("group1", "vhub1")
+	actual := NewVirtualHubConnectionID(vhubid, "conn1").ID(subscriptionId)
+	expected := "/subscriptions/12345678-1234-5678-1234-123456789012/resourceGroups/group1/providers/Microsoft.Network/virtualHubs/vhub1/hubVirtualNetworkConnections/conn1"
+	if actual != expected {
+		t.Fatalf("Expected %q but got %q", expected, actual)
+	}
+}
+
+func TestVirtualHubConnectionID(t *testing.T) {
 	testData := []struct {
 		Name     string
 		Input    string
-		Expected *VirtualHubConnectionResourceID
+		Expected *VirtualHubConnectionId
 	}{
 		{
 			Name:     "Empty",
@@ -38,7 +52,7 @@ func TestParseVirtualHubConnection(t *testing.T) {
 		{
 			Name:  "Completed",
 			Input: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/foo/virtualHubs/example/hubVirtualNetworkConnections/connection1",
-			Expected: &VirtualHubConnectionResourceID{
+			Expected: &VirtualHubConnectionId{
 				Name:           "connection1",
 				VirtualHubName: "example",
 				ResourceGroup:  "foo",
@@ -49,7 +63,7 @@ func TestParseVirtualHubConnection(t *testing.T) {
 	for _, v := range testData {
 		t.Logf("[DEBUG] Testing %q", v.Name)
 
-		actual, err := ParseVirtualHubConnectionID(v.Input)
+		actual, err := VirtualHubConnectionID(v.Input)
 		if err != nil {
 			if v.Expected == nil {
 				continue
diff --git a/azurerm/internal/services/network/virtual_hub_test.go b/azurerm/internal/services/network/parse/virtual_hub_test.go
similarity index 52%
rename from azurerm/internal/services/network/virtual_hub_test.go
rename to azurerm/internal/services/network/parse/virtual_hub_test.go
index c6433526a23e..2fb097c3183c 100644
--- a/azurerm/internal/services/network/virtual_hub_test.go
+++ b/azurerm/internal/services/network/parse/virtual_hub_test.go
@@ -1,14 +1,28 @@
-package network
+package parse
 
 import (
 	"testing"
+
+	"github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/resourceid"
 )
 
-func TestParseVirtualHub(t *testing.T) {
+var _ resourceid.Formatter = VirtualHubId{}
+
+func TestVirtualHubIDFormatter(t *testing.T) {
+	subscriptionId := "12345678-1234-5678-1234-123456789012"
+	id := NewVirtualHubID("group1", "vhub1")
+	actual := id.ID(subscriptionId)
+	expected := "/subscriptions/12345678-1234-5678-1234-123456789012/resourceGroups/group1/providers/Microsoft.Network/virtualHubs/vhub1"
+	if actual != expected {
+		t.Fatalf("Expected %q but got %q", expected, actual)
+	}
+}
+
+func TestVirtualHubID(t *testing.T) {
 	testData := []struct {
 		Name     string
 		Input    string
-		Expected *VirtualHubResourceID
+		Expected *VirtualHubId
 	}{
 		{
 			Name:     "Empty",
@@ -28,7 +42,7 @@ func TestParseVirtualHub(t *testing.T) {
 		{
 			Name:  "Completed",
 			Input: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/foo/virtualHubs/example",
-			Expected: &VirtualHubResourceID{
+			Expected: &VirtualHubId{
 				Name:          "example",
 				ResourceGroup: "foo",
 			},
@@ -38,7 +52,7 @@ func TestParseVirtualHub(t *testing.T) {
 	for _, v := range testData {
 		t.Logf("[DEBUG] Testing %q", v.Name)
 
-		actual, err := ParseVirtualHubID(v.Input)
+		actual, err := VirtualHubID(v.Input)
 		if err != nil {
 			if v.Expected == nil {
 				continue
@@ -56,42 +70,3 @@ func TestParseVirtualHub(t *testing.T) {
 		}
 	}
 }
-
-func TestValidateVirtualHub(t *testing.T) {
-	testData := []struct {
-		Name  string
-		Input string
-		Valid bool
-	}{
-		{
-			Name:  "Empty",
-			Input: "",
-			Valid: false,
-		},
-		{
-			Name:  "No Virtual Hubs Segment",
-			Input: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/foo",
-			Valid: false,
-		},
-		{
-			Name:  "No Virtual Hubs Value",
-			Input: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/foo/virtualHubs/",
-			Valid: false,
-		},
-		{
-			Name:  "Completed",
-			Input: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/foo/virtualHubs/example",
-			Valid: true,
-		},
-	}
-
-	for _, v := range testData {
-		t.Logf("[DEBUG] Testing %q", v.Input)
-
-		_, errors := ValidateVirtualHubID(v.Input, "virtual_hub_id")
-		isValid := len(errors) == 0
-		if v.Valid != isValid {
-			t.Fatalf("Expected %t but got %t", v.Valid, isValid)
-		}
-	}
-}
diff --git a/azurerm/internal/services/network/point_to_site_vpn_gateway_resource.go b/azurerm/internal/services/network/point_to_site_vpn_gateway_resource.go
index 16de67d4aba1..58a8120a84c7 100644
--- a/azurerm/internal/services/network/point_to_site_vpn_gateway_resource.go
+++ b/azurerm/internal/services/network/point_to_site_vpn_gateway_resource.go
@@ -5,6 +5,8 @@ import (
 	"log"
 	"time"
 
+	validate2 "github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/services/network/validate"
+
 	"github.com/Azure/azure-sdk-for-go/services/network/mgmt/2020-05-01/network"
 	"github.com/hashicorp/terraform-plugin-sdk/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/helper/validation"
@@ -50,7 +52,7 @@ func resourceArmPointToSiteVPNGateway() *schema.Resource {
 				Type:         schema.TypeString,
 				Required:     true,
 				ForceNew:     true,
-				ValidateFunc: ValidateVirtualHubID,
+				ValidateFunc: validate2.ValidateVirtualHubID,
 			},
 
 			"vpn_server_configuration_id": {
diff --git a/azurerm/internal/services/network/tests/virtual_hub_connection_resource_test.go b/azurerm/internal/services/network/tests/virtual_hub_connection_resource_test.go
index 265af4cbfa3c..d2d9f8dfc3ed 100644
--- a/azurerm/internal/services/network/tests/virtual_hub_connection_resource_test.go
+++ b/azurerm/internal/services/network/tests/virtual_hub_connection_resource_test.go
@@ -105,9 +105,35 @@ func TestAccAzureRMVirtualHubConnection_update(t *testing.T) {
 	})
 }
 
+func TestAccAzureRMVirtualHubConnection_recreateWithSameConnectionName(t *testing.T) {
+	data := acceptance.BuildTestData(t, "azurerm_virtual_hub_connection", "test")
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:     func() { acceptance.PreCheck(t) },
+		Providers:    acceptance.SupportedProviders,
+		CheckDestroy: testCheckAzureRMVirtualHubConnectionDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAzureRMVirtualHubConnection_basic(data),
+				Check: resource.ComposeTestCheckFunc(
+					testCheckAzureRMVirtualHubConnectionExists(data.ResourceName),
+				),
+			},
+			data.ImportStep(),
+			{
+				Config: testAccAzureRMVirtualHubConnection_enableInternetSecurity(data),
+				Check: resource.ComposeTestCheckFunc(
+					testCheckAzureRMVirtualHubConnectionExists(data.ResourceName),
+				),
+			},
+			data.ImportStep(),
+		},
+	})
+}
+
 func testCheckAzureRMVirtualHubConnectionExists(resourceName string) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
-		client := acceptance.AzureProvider.Meta().(*clients.Client).Network.VirtualHubClient
+		client := acceptance.AzureProvider.Meta().(*clients.Client).Network.HubVirtualNetworkConnectionClient
 		ctx := acceptance.AzureProvider.Meta().(*clients.Client).StopContext
 
 		rs, ok := s.RootModule().Resources[resourceName]
@@ -115,37 +141,16 @@ func testCheckAzureRMVirtualHubConnectionExists(resourceName string) resource.Te
 			return fmt.Errorf("Virtual Hub Connection not found: %s", resourceName)
 		}
 
-		id, err := parse.ParseVirtualHubConnectionID(rs.Primary.ID)
+		id, err := parse.VirtualHubConnectionID(rs.Primary.ID)
 		if err != nil {
 			return err
 		}
 
-		resp, err := client.Get(ctx, id.ResourceGroup, id.VirtualHubName)
-		if err != nil {
-			return fmt.Errorf("Bad: Get on network.VirtualHubClient: %+v", err)
-		}
-
-		if resp.VirtualHubProperties == nil {
-			return fmt.Errorf("VirtualHubProperties was nil!")
-		}
-
-		props := *resp.VirtualHubProperties
-		if props.VirtualNetworkConnections == nil {
-			return fmt.Errorf("props.VirtualNetworkConnections was nil")
-		}
-
-		conns := *props.VirtualNetworkConnections
-
-		found := false
-		for _, conn := range conns {
-			if conn.Name != nil && *conn.Name == id.Name {
-				found = true
-				break
+		if resp, err := client.Get(ctx, id.ResourceGroup, id.VirtualHubName, id.Name); err != nil {
+			if utils.ResponseWasNotFound(resp.Response) {
+				return fmt.Errorf("Bad: Virtual Hub Connection %q (Resource Group %q) does not exist", id.Name, id.ResourceGroup)
 			}
-		}
-
-		if !found {
-			return fmt.Errorf("Connection %q was not found", id.Name)
+			return fmt.Errorf("Bad: Get on network.HubVirtualNetworkConnectionClient: %+v", err)
 		}
 
 		return nil
@@ -153,39 +158,22 @@ func testCheckAzureRMVirtualHubConnectionExists(resourceName string) resource.Te
 }
 
 func testCheckAzureRMVirtualHubConnectionDestroy(s *terraform.State) error {
-	for _, rs := range s.RootModule().Resources {
-		client := acceptance.AzureProvider.Meta().(*clients.Client).Network.VirtualHubClient
-		ctx := acceptance.AzureProvider.Meta().(*clients.Client).StopContext
+	client := acceptance.AzureProvider.Meta().(*clients.Client).Network.HubVirtualNetworkConnectionClient
+	ctx := acceptance.AzureProvider.Meta().(*clients.Client).StopContext
 
+	for _, rs := range s.RootModule().Resources {
 		if rs.Type != "azurerm_virtual_hub_connection" {
 			continue
 		}
 
-		id, err := parse.ParseVirtualHubConnectionID(rs.Primary.ID)
+		id, err := parse.VirtualHubConnectionID(rs.Primary.ID)
 		if err != nil {
 			return err
 		}
 
-		resp, err := client.Get(ctx, id.ResourceGroup, id.VirtualHubName)
-		if err != nil {
+		if resp, err := client.Get(ctx, id.ResourceGroup, id.VirtualHubName, id.Name); err != nil {
 			if !utils.ResponseWasNotFound(resp.Response) {
-				return fmt.Errorf("Bad: Get on network.VirtualHubClient: %+v", err)
-			}
-		}
-
-		// since it's been deleted, that's fine
-		if resp.VirtualHubProperties == nil {
-			return nil
-		}
-		props := *resp.VirtualHubProperties
-		if props.VirtualNetworkConnections == nil {
-			return nil
-		}
-
-		conns := *props.VirtualNetworkConnections
-		for _, conn := range conns {
-			if conn.Name != nil && *conn.Name == id.Name {
-				return fmt.Errorf("Connection %q still exists", id.Name)
+				return fmt.Errorf("Bad: Get on network.HubVirtualNetworkConnectionClient: %+v", err)
 			}
 		}
 
@@ -243,7 +231,7 @@ resource "azurerm_subnet" "test2" {
   name                 = "acctestsubnet2%d"
   resource_group_name  = azurerm_resource_group.test.name
   virtual_network_name = azurerm_virtual_network.test2.name
-  address_prefix       = "10.6.1.0/24"
+  address_prefixes     = ["10.6.1.0/24"]
 }
 
 resource "azurerm_subnet_network_security_group_association" "test2" {
@@ -252,25 +240,35 @@ resource "azurerm_subnet_network_security_group_association" "test2" {
 }
 
 resource "azurerm_virtual_hub_connection" "test" {
-  name                                           = "acctestvhubconn-%d"
-  virtual_hub_id                                 = azurerm_virtual_hub.test.id
-  remote_virtual_network_id                      = azurerm_virtual_network.test.id
-  hub_to_vitual_network_traffic_allowed          = true
-  vitual_network_to_hub_gateways_traffic_allowed = false
-  internet_security_enabled                      = false
+  name                      = "acctestvhubconn-%d"
+  virtual_hub_id            = azurerm_virtual_hub.test.id
+  remote_virtual_network_id = azurerm_virtual_network.test.id
+  internet_security_enabled = false
 }
 
 resource "azurerm_virtual_hub_connection" "test2" {
-  name                                           = "acctestvhubconn2-%d"
-  virtual_hub_id                                 = azurerm_virtual_hub.test.id
-  remote_virtual_network_id                      = azurerm_virtual_network.test2.id
-  hub_to_vitual_network_traffic_allowed          = false
-  vitual_network_to_hub_gateways_traffic_allowed = false
-  internet_security_enabled                      = true
+  name                      = "acctestvhubconn2-%d"
+  virtual_hub_id            = azurerm_virtual_hub.test.id
+  remote_virtual_network_id = azurerm_virtual_network.test2.id
+  internet_security_enabled = true
 }
 `, template, data.RandomInteger, data.RandomInteger, data.RandomInteger, data.RandomInteger, data.RandomInteger)
 }
 
+func testAccAzureRMVirtualHubConnection_enableInternetSecurity(data acceptance.TestData) string {
+	template := testAccAzureRMVirtualHubConnection_template(data)
+	return fmt.Sprintf(`
+%s
+
+resource "azurerm_virtual_hub_connection" "test" {
+  name                      = "acctestbasicvhubconn-%d"
+  virtual_hub_id            = azurerm_virtual_hub.test.id
+  remote_virtual_network_id = azurerm_virtual_network.test.id
+  internet_security_enabled = true
+}
+`, template, data.RandomInteger)
+}
+
 func testAccAzureRMVirtualHubConnection_template(data acceptance.TestData) string {
 	return fmt.Sprintf(`
 provider "azurerm" {
@@ -299,7 +297,7 @@ resource "azurerm_subnet" "test" {
   name                 = "acctestsubnet%d"
   resource_group_name  = azurerm_resource_group.test.name
   virtual_network_name = azurerm_virtual_network.test.name
-  address_prefix       = "10.5.1.0/24"
+  address_prefixes     = ["10.5.1.0/24"]
 }
 
 resource "azurerm_subnet_network_security_group_association" "test" {
diff --git a/azurerm/internal/services/network/tests/virtual_wan_resource_test.go b/azurerm/internal/services/network/tests/virtual_wan_resource_test.go
index f7f30bf02a8b..f2ba972cced6 100644
--- a/azurerm/internal/services/network/tests/virtual_wan_resource_test.go
+++ b/azurerm/internal/services/network/tests/virtual_wan_resource_test.go
@@ -180,7 +180,6 @@ resource "azurerm_virtual_wan" "test" {
 
   disable_vpn_encryption            = false
   allow_branch_to_branch_traffic    = true
-  allow_vnet_to_vnet_traffic        = true
   office365_local_breakout_category = "All"
   type                              = "Standard"
 
diff --git a/azurerm/internal/services/network/validate/virtual_hub.go b/azurerm/internal/services/network/validate/virtual_hub.go
new file mode 100644
index 000000000000..288ccc51a50e
--- /dev/null
+++ b/azurerm/internal/services/network/validate/virtual_hub.go
@@ -0,0 +1,20 @@
+package validate
+
+import (
+	"fmt"
+
+	"github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/services/network/parse"
+)
+
+func ValidateVirtualHubID(i interface{}, k string) (warnings []string, errors []error) {
+	v, ok := i.(string)
+	if !ok {
+		return nil, []error{fmt.Errorf("expected type of %q to be string", k)}
+	}
+
+	if _, err := parse.VirtualHubID(v); err != nil {
+		return nil, []error{err}
+	}
+
+	return nil, nil
+}
diff --git a/azurerm/internal/services/network/validate/virtual_hub_test.go b/azurerm/internal/services/network/validate/virtual_hub_test.go
new file mode 100644
index 000000000000..7ae3bda547ef
--- /dev/null
+++ b/azurerm/internal/services/network/validate/virtual_hub_test.go
@@ -0,0 +1,42 @@
+package validate
+
+import "testing"
+
+func TestValidateVirtualHub(t *testing.T) {
+	testData := []struct {
+		Name  string
+		Input string
+		Valid bool
+	}{
+		{
+			Name:  "Empty",
+			Input: "",
+			Valid: false,
+		},
+		{
+			Name:  "No Virtual Hubs Segment",
+			Input: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/foo",
+			Valid: false,
+		},
+		{
+			Name:  "No Virtual Hubs Value",
+			Input: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/foo/virtualHubs/",
+			Valid: false,
+		},
+		{
+			Name:  "Completed",
+			Input: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/foo/virtualHubs/example",
+			Valid: true,
+		},
+	}
+
+	for _, v := range testData {
+		t.Logf("[DEBUG] Testing %q", v.Input)
+
+		_, errors := ValidateVirtualHubID(v.Input, "virtual_hub_id")
+		isValid := len(errors) == 0
+		if v.Valid != isValid {
+			t.Fatalf("Expected %t but got %t", v.Valid, isValid)
+		}
+	}
+}
diff --git a/azurerm/internal/services/network/virtual_hub_connection_resource.go b/azurerm/internal/services/network/virtual_hub_connection_resource.go
index 6c60571c51d3..36f34d721174 100644
--- a/azurerm/internal/services/network/virtual_hub_connection_resource.go
+++ b/azurerm/internal/services/network/virtual_hub_connection_resource.go
@@ -5,7 +5,7 @@ import (
 	"log"
 	"time"
 
-	"github.com/Azure/azure-sdk-for-go/services/network/mgmt/2020-03-01/network"
+	"github.com/Azure/azure-sdk-for-go/services/network/mgmt/2020-05-01/network"
 	"github.com/hashicorp/terraform-plugin-sdk/helper/schema"
 	"github.com/terraform-providers/terraform-provider-azurerm/azurerm/helpers/azure"
 	"github.com/terraform-providers/terraform-provider-azurerm/azurerm/helpers/tf"
@@ -18,8 +18,9 @@ import (
 
 func resourceArmVirtualHubConnection() *schema.Resource {
 	return &schema.Resource{
-		Create: resourceArmVirtualHubConnectionCreate,
+		Create: resourceArmVirtualHubConnectionCreateOrUpdate,
 		Read:   resourceArmVirtualHubConnectionRead,
+		Update: resourceArmVirtualHubConnectionCreateOrUpdate,
 		Delete: resourceArmVirtualHubConnectionDelete,
 
 		Importer: &schema.ResourceImporter{
@@ -29,6 +30,7 @@ func resourceArmVirtualHubConnection() *schema.Resource {
 		Timeouts: &schema.ResourceTimeout{
 			Create: schema.DefaultTimeout(60 * time.Minute),
 			Read:   schema.DefaultTimeout(5 * time.Minute),
+			Update: schema.DefaultTimeout(60 * time.Minute),
 			Delete: schema.DefaultTimeout(60 * time.Minute),
 		},
 
@@ -54,33 +56,36 @@ func resourceArmVirtualHubConnection() *schema.Resource {
 				ValidateFunc: azure.ValidateResourceID,
 			},
 
+			// TODO 3.0: remove this property
 			"hub_to_vitual_network_traffic_allowed": {
-				Type:     schema.TypeBool,
-				Optional: true,
-				ForceNew: true,
+				Type:       schema.TypeBool,
+				Optional:   true,
+				Deprecated: "Due to a breaking behavioural change in the Azure API this property is no longer functional and will be removed in version 3.0 of the provider",
 			},
 
+			// TODO 3.0: remove this property
 			"vitual_network_to_hub_gateways_traffic_allowed": {
-				Type:     schema.TypeBool,
-				Optional: true,
-				ForceNew: true,
+				Type:       schema.TypeBool,
+				Optional:   true,
+				Deprecated: "Due to a breaking behavioural change in the Azure API this property is no longer functional and will be removed in version 3.0 of the provider",
 			},
 
 			"internet_security_enabled": {
 				Type:     schema.TypeBool,
 				Optional: true,
 				ForceNew: true,
+				Default:  false,
 			},
 		},
 	}
 }
 
-func resourceArmVirtualHubConnectionCreate(d *schema.ResourceData, meta interface{}) error {
-	client := meta.(*clients.Client).Network.VirtualHubClient
+func resourceArmVirtualHubConnectionCreateOrUpdate(d *schema.ResourceData, meta interface{}) error {
+	client := meta.(*clients.Client).Network.HubVirtualNetworkConnectionClient
 	ctx, cancel := timeouts.ForCreate(meta.(*clients.Client).StopContext, d)
 	defer cancel()
 
-	id, err := ParseVirtualHubID(d.Get("virtual_hub_id").(string))
+	id, err := parse.VirtualHubID(d.Get("virtual_hub_id").(string))
 	if err != nil {
 		return err
 	}
@@ -88,30 +93,18 @@ func resourceArmVirtualHubConnectionCreate(d *schema.ResourceData, meta interfac
 	locks.ByName(id.Name, virtualHubResourceName)
 	defer locks.UnlockByName(id.Name, virtualHubResourceName)
 
-	virtualHub, err := client.Get(ctx, id.ResourceGroup, id.Name)
-	if err != nil {
-		if utils.ResponseWasNotFound(virtualHub.Response) {
-			return fmt.Errorf("Virtual Hub %q was not found in Resource Group %q", id.Name, id.ResourceGroup)
-		}
-
-		return fmt.Errorf("Error retrieving Virtual Hub %q (Resource Group %q): %+v", id.Name, id.ResourceGroup, err)
-	}
-
-	if virtualHub.VirtualHubProperties == nil {
-		return fmt.Errorf("Error retrieving Virtual Hub %q (Resource Group %q): `properties` was nil", id.Name, id.ResourceGroup)
-	}
-
 	name := d.Get("name").(string)
 
-	if connection, _ := findVirtualHubConnection(name, virtualHub); connection != nil {
-		return tf.ImportAsExistsError("azurerm_virtual_hub_connection", *connection.ID)
-	}
-
-	props := *virtualHub.VirtualHubProperties
-
-	var connections []network.HubVirtualNetworkConnection
-	if props.VirtualNetworkConnections != nil {
-		connections = *props.VirtualNetworkConnections
+	if d.IsNewResource() {
+		existing, err := client.Get(ctx, id.ResourceGroup, id.Name, name)
+		if err != nil {
+			if !utils.ResponseWasNotFound(existing.Response) {
+				return fmt.Errorf("checking for presence of existing Connection %q (Virtual Hub %q / Resource Group %q): %+v", name, id.Name, id.ResourceGroup, err)
+			}
+		}
+		if existing.ID != nil && *existing.ID != "" {
+			return tf.ImportAsExistsError("azurerm_virtual_hub_connection", *existing.ID)
+		}
 	}
 
 	connection := network.HubVirtualNetworkConnection{
@@ -120,83 +113,62 @@ func resourceArmVirtualHubConnectionCreate(d *schema.ResourceData, meta interfac
 			RemoteVirtualNetwork: &network.SubResource{
 				ID: utils.String(d.Get("remote_virtual_network_id").(string)),
 			},
-			AllowHubToRemoteVnetTransit:         utils.Bool(d.Get("hub_to_vitual_network_traffic_allowed").(bool)),
-			AllowRemoteVnetToUseHubVnetGateways: utils.Bool(d.Get("vitual_network_to_hub_gateways_traffic_allowed").(bool)),
-			EnableInternetSecurity:              utils.Bool(d.Get("internet_security_enabled").(bool)),
+			EnableInternetSecurity: utils.Bool(d.Get("internet_security_enabled").(bool)),
 		},
 	}
-	connections = append(connections, connection)
-	virtualHub.VirtualHubProperties.VirtualNetworkConnections = &connections
 
-	future, err := client.CreateOrUpdate(ctx, id.ResourceGroup, id.Name, virtualHub)
+	future, err := client.CreateOrUpdate(ctx, id.ResourceGroup, id.Name, name, connection)
 	if err != nil {
-		return fmt.Errorf("Error adding Connection %q to Virtual Hub %q (Resource Group %q): %+v", name, id.Name, id.ResourceGroup, err)
+		return fmt.Errorf("creating Connection %q (Virtual Hub %q / Resource Group %q): %+v", name, id.Name, id.ResourceGroup, err)
 	}
 
 	if err := future.WaitForCompletionRef(ctx, client.Client); err != nil {
-		return fmt.Errorf("Error waiting for addition of Connection %q to Virtual Hub %q (Resource Group %q): %+v", name, id.Name, id.ResourceGroup, err)
-	}
-
-	virtualHub, err = client.Get(ctx, id.ResourceGroup, id.Name)
-	if err != nil {
-		return fmt.Errorf("Error retrieving Virtual Hub %q (Resource Group %q): %+v", id.Name, id.ResourceGroup, err)
+		return fmt.Errorf("waiting for creation of Connection %q (Virtual Hub %q / Resource Group %q): %+v", name, id.Name, id.ResourceGroup, err)
 	}
 
-	newConnection, err := findVirtualHubConnection(name, virtualHub)
+	resp, err := client.Get(ctx, id.ResourceGroup, id.Name, name)
 	if err != nil {
-		return fmt.Errorf("Error retrieving Virtual Hub %q (Resource Group %q): %+v", id.Name, id.ResourceGroup, err)
+		return fmt.Errorf("retrieving Connection %q (Virtual Hub %q / Resource Group %q): %+v", name, id.Name, id.ResourceGroup, err)
 	}
-	if newConnection == nil {
-		return fmt.Errorf("Connection %q was not found in Virtual Hub %q / Resource Group %q", name, id.Name, id.ResourceGroup)
-	}
-	if newConnection.ID == nil && *newConnection.ID == "" {
-		return fmt.Errorf("Error retrieving Connection %q (Virtual Hub %q / Resource Group %q): `id` was nil or empty", name, id.Name, id.ResourceGroup)
+	if resp.ID == nil || *resp.ID == "" {
+		return fmt.Errorf("cannot read Connection %q (Virtual Hub %q / Resource Group %q) ID", name, id.Name, id.ResourceGroup)
 	}
+	d.SetId(*resp.ID)
 
-	d.SetId(*newConnection.ID)
 	return resourceArmVirtualHubConnectionRead(d, meta)
 }
 
 func resourceArmVirtualHubConnectionRead(d *schema.ResourceData, meta interface{}) error {
-	client := meta.(*clients.Client).Network.VirtualHubClient
+	subscriptionId := meta.(*clients.Client).Account.SubscriptionId
+	client := meta.(*clients.Client).Network.HubVirtualNetworkConnectionClient
 	ctx, cancel := timeouts.ForRead(meta.(*clients.Client).StopContext, d)
 	defer cancel()
 
-	id, err := parse.ParseVirtualHubConnectionID(d.Id())
+	id, err := parse.VirtualHubConnectionID(d.Id())
 	if err != nil {
 		return err
 	}
 
-	virtualHub, err := client.Get(ctx, id.ResourceGroup, id.VirtualHubName)
+	resp, err := client.Get(ctx, id.ResourceGroup, id.VirtualHubName, id.Name)
 	if err != nil {
-		if utils.ResponseWasNotFound(virtualHub.Response) {
-			log.Printf("[DEBUG] Virtual Hub %q was not found in Resource Group %q - so Connection %q can't exist - removing from state", id.Name, id.VirtualHubName, id.ResourceGroup)
+		if utils.ResponseWasNotFound(resp.Response) {
+			log.Printf("[INFO] Connection %q (Virtual Hub %q / Resource Group %q) does not exist - removing from state", id.Name, id.VirtualHubName, id.ResourceGroup)
 			d.SetId("")
 			return nil
 		}
-
-		return fmt.Errorf("Error retrieving Virtual Hub %q (Resource Group %q): %+v", id.VirtualHubName, id.ResourceGroup, err)
-	}
-
-	connection, err := findVirtualHubConnection(id.Name, virtualHub)
-	if err != nil {
-		return fmt.Errorf("Error retrieving Connection %q (Virtual Hub %q / Resource Group %q): %+v`", id.Name, id.VirtualHubName, id.ResourceGroup, err)
-	}
-	if connection == nil {
-		log.Printf("[DEBUG] Connection %q was not found within Virtual Hub %q (Resource Group %q) - removing from state", id.Name, id.VirtualHubName, id.ResourceGroup)
-		d.SetId("")
-		return nil
-	}
-	if connection.HubVirtualNetworkConnectionProperties == nil {
-		return fmt.Errorf("Error retrieving Connection %q (Virtual Hub %q / Resource Group %q): `properties` was nil`", id.Name, id.VirtualHubName, id.ResourceGroup)
+		return fmt.Errorf("reading Connection %q (Virtual Hub %q / Resource Group %q): %+v", id.Name, id.Name, id.ResourceGroup, err)
 	}
 
 	d.Set("name", id.Name)
-	d.Set("virtual_hub_id", virtualHub.ID)
+	d.Set("virtual_hub_id", parse.NewVirtualHubID(id.ResourceGroup, id.VirtualHubName).ID(subscriptionId))
+
+	if props := resp.HubVirtualNetworkConnectionProperties; props != nil {
+		// The following two attributes are deprecated by API (which will always return `true`).
+		// Hence, we explicitly set them to `false` (as false is the default value when users omit that property).
+		// TODO: 3.0: Remove below lines.
+		d.Set("hub_to_vitual_network_traffic_allowed", false)
+		d.Set("vitual_network_to_hub_gateways_traffic_allowed", false)
 
-	if props := connection.HubVirtualNetworkConnectionProperties; props != nil {
-		d.Set("hub_to_vitual_network_traffic_allowed", props.AllowHubToRemoteVnetTransit)
-		d.Set("vitual_network_to_hub_gateways_traffic_allowed", props.AllowRemoteVnetToUseHubVnetGateways)
 		d.Set("internet_security_enabled", props.EnableInternetSecurity)
 		remoteVirtualNetworkId := ""
 		if props.RemoteVirtualNetwork != nil && props.RemoteVirtualNetwork.ID != nil {
@@ -209,11 +181,11 @@ func resourceArmVirtualHubConnectionRead(d *schema.ResourceData, meta interface{
 }
 
 func resourceArmVirtualHubConnectionDelete(d *schema.ResourceData, meta interface{}) error {
-	client := meta.(*clients.Client).Network.VirtualHubClient
+	client := meta.(*clients.Client).Network.HubVirtualNetworkConnectionClient
 	ctx, cancel := timeouts.ForDelete(meta.(*clients.Client).StopContext, d)
 	defer cancel()
 
-	id, err := parse.ParseVirtualHubConnectionID(d.Id())
+	id, err := parse.VirtualHubConnectionID(d.Id())
 	if err != nil {
 		return err
 	}
@@ -221,68 +193,14 @@ func resourceArmVirtualHubConnectionDelete(d *schema.ResourceData, meta interfac
 	locks.ByName(id.VirtualHubName, virtualHubResourceName)
 	defer locks.UnlockByName(id.VirtualHubName, virtualHubResourceName)
 
-	virtualHub, err := client.Get(ctx, id.ResourceGroup, id.VirtualHubName)
-	if err != nil {
-		if utils.ResponseWasNotFound(virtualHub.Response) {
-			return fmt.Errorf("Virtual Hub %q was not found in Resource Group %q", id.VirtualHubName, id.ResourceGroup)
-		}
-
-		return fmt.Errorf("Error retrieving Virtual Hub %q (Resource Group %q): %+v", id.VirtualHubName, id.ResourceGroup, err)
-	}
-
-	if virtualHub.VirtualHubProperties == nil {
-		return fmt.Errorf("Error retrieving Virtual Hub %q (Resource Group %q): `properties` was nil", id.VirtualHubName, id.ResourceGroup)
-	}
-
-	if virtualHub.VirtualHubProperties.VirtualNetworkConnections == nil {
-		return fmt.Errorf("Error retrieving Virtual Hub %q (Resource Group %q): `properties.VirtualNetworkConnections` was nil", id.VirtualHubName, id.ResourceGroup)
-	}
-
-	var newConnections []network.HubVirtualNetworkConnection
-	for _, connection := range *virtualHub.VirtualHubProperties.VirtualNetworkConnections {
-		if connection.Name == nil {
-			continue
-		}
-
-		if *connection.Name == id.Name {
-			continue
-		}
-
-		newConnections = append(newConnections, connection)
-	}
-	virtualHub.VirtualHubProperties.VirtualNetworkConnections = &newConnections
-
-	future, err := client.CreateOrUpdate(ctx, id.ResourceGroup, id.VirtualHubName, virtualHub)
+	future, err := client.Delete(ctx, id.ResourceGroup, id.VirtualHubName, id.Name)
 	if err != nil {
-		return fmt.Errorf("Error removing Connection %q to Virtual Hub %q (Resource Group %q): %+v", id.Name, id.VirtualHubName, id.ResourceGroup, err)
+		return fmt.Errorf("deleting Connection %q (Virtual Hub %q / Resource Group %q): %+v", id.Name, id.VirtualHubName, id.ResourceGroup, err)
 	}
 
-	if err := future.WaitForCompletionRef(ctx, client.Client); err != nil {
-		return fmt.Errorf("Error waiting for removal of Connection %q to Virtual Hub %q (Resource Group %q): %+v", id.Name, id.VirtualHubName, id.ResourceGroup, err)
+	if err = future.WaitForCompletionRef(ctx, client.Client); err != nil {
+		return fmt.Errorf("waiting for deleting Connection %q (Virtual Hub %q / Resource Group %q): %+v", id.Name, id.VirtualHubName, id.ResourceGroup, err)
 	}
 
 	return nil
 }
-
-func findVirtualHubConnection(name string, virtualHub network.VirtualHub) (*network.HubVirtualNetworkConnection, error) {
-	if virtualHub.VirtualHubProperties == nil {
-		return nil, fmt.Errorf("`properties` was nil")
-	}
-	if virtualHub.VirtualHubProperties.VirtualNetworkConnections == nil {
-		return nil, fmt.Errorf("`properties.VirtualNetworkConnections` was nil")
-	}
-
-	connections := *virtualHub.VirtualHubProperties.VirtualNetworkConnections
-
-	for _, connection := range connections {
-		if connection.Name == nil || connection.ID == nil {
-			continue
-		}
-
-		if *connection.Name == name {
-			return &connection, nil
-		}
-	}
-
-	return nil, nil
-}
diff --git a/azurerm/internal/services/network/virtual_hub_resource.go b/azurerm/internal/services/network/virtual_hub_resource.go
index 4df56121fa98..8831fd931ee0 100644
--- a/azurerm/internal/services/network/virtual_hub_resource.go
+++ b/azurerm/internal/services/network/virtual_hub_resource.go
@@ -1,12 +1,16 @@
 package network
 
 import (
+	"context"
 	"fmt"
 	"log"
 	"time"
 
-	"github.com/Azure/azure-sdk-for-go/services/network/mgmt/2020-03-01/network"
+	"github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/services/network/parse"
+
+	"github.com/Azure/azure-sdk-for-go/services/network/mgmt/2020-05-01/network"
 	"github.com/hashicorp/go-azure-helpers/response"
+	"github.com/hashicorp/terraform-plugin-sdk/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/helper/schema"
 	"github.com/terraform-providers/terraform-provider-azurerm/azurerm/helpers/azure"
 	"github.com/terraform-providers/terraform-provider-azurerm/azurerm/helpers/tf"
@@ -96,6 +100,10 @@ func resourceArmVirtualHubCreateUpdate(d *schema.ResourceData, meta interface{})
 	ctx, cancel := timeouts.ForCreateUpdate(meta.(*clients.Client).StopContext, d)
 	defer cancel()
 
+	if _, ok := ctx.Deadline(); !ok {
+		return fmt.Errorf("deadline is not properly set for Virtual Hub")
+	}
+
 	name := d.Get("name").(string)
 	resourceGroup := d.Get("resource_group_name").(string)
 
@@ -141,10 +149,26 @@ func resourceArmVirtualHubCreateUpdate(d *schema.ResourceData, meta interface{})
 		return fmt.Errorf("Error waiting for creation of Virtual Hub %q (Resource Group %q): %+v", name, resourceGroup, err)
 	}
 
-	resp, err := client.Get(ctx, resourceGroup, name)
+	// Hub returns provisioned while the routing state is still "provisining". This might cause issues with following hubvnet connection operations.
+	// https://github.com/Azure/azure-rest-api-specs/issues/10391
+	// As a workaround, we will poll the routing state and ensure it is "Provisioned".
+
+	// deadline is checked at the entry point of this function
+	timeout, _ := ctx.Deadline()
+	stateConf := &resource.StateChangeConf{
+		Pending:                   []string{"Provisioning"},
+		Target:                    []string{"Provisioned", "Failed"},
+		Refresh:                   virtualHubCreateRefreshFunc(ctx, client, resourceGroup, name),
+		PollInterval:              15 * time.Second,
+		ContinuousTargetOccurence: 3,
+		Timeout:                   time.Until(timeout),
+	}
+	respRaw, err := stateConf.WaitForState()
 	if err != nil {
-		return fmt.Errorf("Error retrieving Virtual Hub %q (Resource Group %q): %+v", name, resourceGroup, err)
+		return fmt.Errorf("waiting for Virtual Hub %q (Host Group Name %q) provisioning route: %+v", name, resourceGroup, err)
 	}
+
+	resp := respRaw.(network.VirtualHub)
 	if resp.ID == nil {
 		return fmt.Errorf("Cannot read Virtual Hub %q (Resource Group %q) ID", name, resourceGroup)
 	}
@@ -158,7 +182,7 @@ func resourceArmVirtualHubRead(d *schema.ResourceData, meta interface{}) error {
 	ctx, cancel := timeouts.ForRead(meta.(*clients.Client).StopContext, d)
 	defer cancel()
 
-	id, err := ParseVirtualHubID(d.Id())
+	id, err := parse.VirtualHubID(d.Id())
 	if err != nil {
 		return err
 	}
@@ -200,7 +224,7 @@ func resourceArmVirtualHubDelete(d *schema.ResourceData, meta interface{}) error
 	ctx, cancel := timeouts.ForDelete(meta.(*clients.Client).StopContext, d)
 	defer cancel()
 
-	id, err := ParseVirtualHubID(d.Id())
+	id, err := parse.VirtualHubID(d.Id())
 	if err != nil {
 		return err
 	}
@@ -272,3 +296,25 @@ func flattenArmVirtualHubRoute(input *network.VirtualHubRouteTable) []interface{
 
 	return results
 }
+
+func virtualHubCreateRefreshFunc(ctx context.Context, client *network.VirtualHubsClient, resourceGroup, name string) resource.StateRefreshFunc {
+	return func() (interface{}, string, error) {
+		res, err := client.Get(ctx, resourceGroup, name)
+		if err != nil {
+			if utils.ResponseWasNotFound(res.Response) {
+				return nil, "", fmt.Errorf("Virtual Hub %q (Resource Group %q) doesn't exist", resourceGroup, name)
+			}
+
+			return nil, "", fmt.Errorf("retrieving Virtual Hub %q (Resource Group %q): %+v", resourceGroup, name, err)
+		}
+		if res.VirtualHubProperties == nil {
+			return nil, "", fmt.Errorf("unexpected nil properties of Virtual Hub %q (Resource Group %q)", resourceGroup, name)
+		}
+
+		state := res.VirtualHubProperties.RoutingState
+		if state == "Failed" {
+			return nil, "", fmt.Errorf("failed to provision routing on Virtual Hub %q (Resource Group %q)", resourceGroup, name)
+		}
+		return res, string(res.VirtualHubProperties.RoutingState), nil
+	}
+}
diff --git a/azurerm/internal/services/network/virtual_wan_resource.go b/azurerm/internal/services/network/virtual_wan_resource.go
index 2da1fa811c8d..ae30445fc867 100644
--- a/azurerm/internal/services/network/virtual_wan_resource.go
+++ b/azurerm/internal/services/network/virtual_wan_resource.go
@@ -5,7 +5,7 @@ import (
 	"log"
 	"time"
 
-	"github.com/Azure/azure-sdk-for-go/services/network/mgmt/2020-03-01/network"
+	"github.com/Azure/azure-sdk-for-go/services/network/mgmt/2020-05-01/network"
 	"github.com/hashicorp/go-azure-helpers/response"
 	"github.com/hashicorp/terraform-plugin-sdk/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/helper/validation"
@@ -58,10 +58,12 @@ func resourceArmVirtualWan() *schema.Resource {
 				Default:  true,
 			},
 
+			// TODO 3.0: remove this property
 			"allow_vnet_to_vnet_traffic": {
-				Type:     schema.TypeBool,
-				Optional: true,
-				Default:  false,
+				Type:       schema.TypeBool,
+				Optional:   true,
+				Default:    false,
+				Deprecated: "this property has been removed from the API and will be removed in version 3.0 of the provider",
 			},
 
 			"office365_local_breakout_category": {
@@ -99,7 +101,6 @@ func resourceArmVirtualWanCreateUpdate(d *schema.ResourceData, meta interface{})
 	location := azure.NormalizeLocation(d.Get("location").(string))
 	disableVpnEncryption := d.Get("disable_vpn_encryption").(bool)
 	allowBranchToBranchTraffic := d.Get("allow_branch_to_branch_traffic").(bool)
-	allowVnetToVnetTraffic := d.Get("allow_vnet_to_vnet_traffic").(bool)
 	office365LocalBreakoutCategory := d.Get("office365_local_breakout_category").(string)
 	virtualWanType := d.Get("type").(string)
 	t := d.Get("tags").(map[string]interface{})
@@ -123,7 +124,6 @@ func resourceArmVirtualWanCreateUpdate(d *schema.ResourceData, meta interface{})
 		VirtualWanProperties: &network.VirtualWanProperties{
 			DisableVpnEncryption:           utils.Bool(disableVpnEncryption),
 			AllowBranchToBranchTraffic:     utils.Bool(allowBranchToBranchTraffic),
-			AllowVnetToVnetTraffic:         utils.Bool(allowVnetToVnetTraffic),
 			Office365LocalBreakoutCategory: network.OfficeTrafficCategory(office365LocalBreakoutCategory),
 			Type:                           utils.String(virtualWanType),
 		},
@@ -182,8 +182,8 @@ func resourceArmVirtualWanRead(d *schema.ResourceData, meta interface{}) error {
 	if props := resp.VirtualWanProperties; props != nil {
 		d.Set("disable_vpn_encryption", props.DisableVpnEncryption)
 		d.Set("allow_branch_to_branch_traffic", props.AllowBranchToBranchTraffic)
-		d.Set("allow_vnet_to_vnet_traffic", props.AllowVnetToVnetTraffic)
 		d.Set("office365_local_breakout_category", props.Office365LocalBreakoutCategory)
+		d.Set("allow_vnet_to_vnet_traffic", false)
 		d.Set("type", props.Type)
 	}
 
diff --git a/azurerm/internal/services/network/vpn_gateway_resource.go b/azurerm/internal/services/network/vpn_gateway_resource.go
index d672dccada36..4ef33115ebfa 100644
--- a/azurerm/internal/services/network/vpn_gateway_resource.go
+++ b/azurerm/internal/services/network/vpn_gateway_resource.go
@@ -6,6 +6,8 @@ import (
 	"log"
 	"time"
 
+	"github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/services/network/validate"
+
 	"github.com/Azure/azure-sdk-for-go/services/network/mgmt/2020-05-01/network"
 	"github.com/hashicorp/go-azure-helpers/response"
 	"github.com/hashicorp/terraform-plugin-sdk/helper/resource"
@@ -51,7 +53,7 @@ func resourceArmVPNGateway() *schema.Resource {
 				Type:         schema.TypeString,
 				Required:     true,
 				ForceNew:     true,
-				ValidateFunc: ValidateVirtualHubID,
+				ValidateFunc: validate.ValidateVirtualHubID,
 			},
 
 			"bgp_settings": {
diff --git a/website/docs/r/virtual_hub_connection.html.markdown b/website/docs/r/virtual_hub_connection.html.markdown
index a2f1da1f8631..1947d54e1c39 100644
--- a/website/docs/r/virtual_hub_connection.html.markdown
+++ b/website/docs/r/virtual_hub_connection.html.markdown
@@ -58,13 +58,7 @@ The following arguments are supported:
 
 ---
 
-* `hub_to_vitual_network_traffic_allowed` - (Optional) Is the Virtual Hub traffic allowed to transit via the Remote Virtual Network? Changing this forces a new resource to be created.
-
-* `vitual_network_to_hub_gateways_traffic_allowed` - (Optional) Is Remote Virtual Network traffic allowed to transit the Hub's Virtual Network Gateway's? Changing this forces a new resource to be created.
-
--> **NOTE** Please ensure that you deploy either a [Site-to-Site](https://www.terraform.io/docs/providers/azurerm/r/vpn_gateway.html)/[Point-to-Site](https://www.terraform.io/docs/providers/azurerm/r/point_to_site_vpn_gateway.html) VPN gateway or an [ExpressRoute gateway](https://www.terraform.io/docs/providers/azurerm/r/express_route_gateway.html) in the Virtual Hub before enabling this field.
-
-* `internet_security_enabled` - (Optional) Should Internet Security be enabled to secure internet traffic? Changing this forces a new resource to be created.
+* `internet_security_enabled` - (Optional) Should Internet Security be enabled to secure internet traffic? Changing this forces a new resource to be created. Defaults to `false`.
 
 ## Attributes Reference
 
diff --git a/website/docs/r/virtual_wan.html.markdown b/website/docs/r/virtual_wan.html.markdown
index e8ef87506d9c..cecca2508d97 100644
--- a/website/docs/r/virtual_wan.html.markdown
+++ b/website/docs/r/virtual_wan.html.markdown
@@ -40,8 +40,6 @@ The following arguments are supported:
 
 * `allow_branch_to_branch_traffic` - (Optional) Boolean flag to specify whether branch to branch traffic is allowed. Defaults to `true`.
 
-* `allow_vnet_to_vnet_traffic` - (Optional) Boolean flag to specify whether VNet to VNet traffic is allowed. Defaults to `false`.
-
 * `office365_local_breakout_category` - (Optional) Specifies the Office365 local breakout category. Possible values include: `Optimize`, `OptimizeAndAllow`, `All`, `None`. Defaults to `None`.
 
 * `type` - (Optional) Specifies the Virtual WAN type. Possible Values include: `Basic` and `Standard`. Defaults to `Standard`.