Gateway — choose the Azure traffic boundary
“Gateway” describes several Azure services. Start with the traffic boundary and protocol, then select the service.
| Requirement | Choose | What it does |
|---|---|---|
| Route HTTP/HTTPS requests by host or path; optionally apply WAF | [[application-gateway | Application Gateway]] |
| Connect a VNet to a site, remote user, or another VNet over encrypted tunnels | [[vpn-gateway | VPN Gateway]] |
| Connect on-premises networks over a private provider circuit | [[expressroute | ExpressRoute]] and its VNet gateway |
| Give subnet workloads predictable outbound internet translation | [[nat-gateway | NAT Gateway]] |
Why it exists
Each gateway solves a different boundary problem: HTTP request routing, hybrid network transit, private-circuit transit, or outbound source translation. A correct name does not make it a substitute for the others.
Operational failure mode
A team selects Application Gateway to connect an on-premises network, or NAT Gateway to publish an application. Neither design supplies the required traffic behavior. State the direction, protocol, and whether the service must inspect web requests before choosing a gateway.
Related
application-gateway · vpn-gateway · expressroute · nat-gateway · load-balancer · azure-front-door · traffic-manager
📘 Sources: Microsoft Learn — Application Gateway, VPN Gateway, and NAT Gateway design, checked 2026-08-22. Re-audit when gateway product capabilities or networking guidance changes.