Quartz 5

vpn-gateway

Properties2
tagsnetworking, hybrid, vpngateway, connectivity
aliasesVPN Gateway, site-to-site, S2S, point-to-site, P2S, VNet-to-VNet

2 min read

Azure VPN Gateway

What it is

Azure VPN Gateway is a managed Azure service that sends encrypted traffic between a virtual network and an on-premises location over the public internet. It can also connect Azure VNets to each other. Azure operates the gateway service; you configure its connections, routing, and SKU.

Why it exists

Use it when people, sites, or networks need private-style encrypted connectivity to Azure without a dedicated private circuit. It terminates secure tunnels so the remote network or user can reach allowed private Azure addresses.

Key ideas

  • Site-to-site (S2S) connects a VNet to an on-premises VPN device through an IPsec/IKE tunnel.
  • Point-to-site (P2S) connects an individual remote computer. VPN Gateway supports OpenVPN, IKEv2, or SSTP for this scenario.
  • VNet-to-VNet connects two Azure VNets through VPN gateways. VNet peering is a separate option when its direct private connection model fits.
  • GatewaySubnet is dedicated. The VPN gateway is deployed into a subnet named exactly GatewaySubnet; do not place ordinary workloads there.
  • SKU and architecture shape capacity and resilience. Gateway SKU affects bandwidth and connection limits. You can design active-active connectivity, use BGP for dynamic routes, and use availability-zone-capable gateway deployments where the region supports them.
  • VPN is not ExpressRoute. VPN Gateway uses encrypted tunnels over the public internet; ExpressRoute uses a private provider connection. They can coexist, including a VPN failover path for an ExpressRoute design.

Northwind example

Northwind’s warehouse has a VPN device. Maya creates a site-to-site VPN connection from that device to the GatewaySubnet in Northwind’s Azure VNet, then advertises only the warehouse and application address ranges it needs. Warehouse scanners can reach the private order service, but the VPN does not make every Azure resource public or bypass the service’s own identity and network rules. Staff working from home use point-to-site VPN instead of sharing the warehouse device’s credentials.

How it fits

[on-prem VPN device/router]   <—IPsec S2S—>   [Azure VPN Gateway]
       │                                           │  (GatewaySubnet)
   corp LAN                                    [VNet subnets]

Exam notes

  • GatewaySubnet is reserved for the virtual network gateway.
  • Point-to-site connects individual clients; site-to-site connects networks; VNet-to-VNet connects Azure VNets.
  • For a hub-and-spoke transit design, verify gateway-transit settings and routing on both sides rather than assuming peering automatically exposes the gateway.
  • Compare VPN Gateway with ExpressRoute and Virtual WAN by connection model, capacity, and operational need.

Home · bgp · expressroute · vnet · virtual-wan · route-table

📘 Source: Microsoft Learn — What is Azure VPN Gateway?

Graph View

Backlinks