Azure VPN Gateway
What it is
Azure VPN Gateway is a managed service (a pair of active VM instances behind a public Virtual Network gateway) that sends encrypted traffic between an Azure VNet and on-premises locations (and/or other VNets) over the public internet or over an IPsec tunnel.
Why it exists
You need secure hybrid connectivity without a dedicated private line. A VPN gateway terminates IPsec/IKE tunnels (site-to-site) and OpenVPN/IKE/SSL (point-to-site) so on-prem and remote users can reach Azure resources securely over the internet.
Key ideas
- Connection types: Site-to-Site (S2S) — IPsec tunnel to an on-prem VPN device; Point-to-Site (P2S) — individual clients; VNet-to-VNet — between Azure VNets (or via vnet-peering without gateway).
- Deployed on a dedicated gateway subnet named
GatewaySubnet(must be exactly this name). - SKUs (VpnGw1/2/3, VpnGw5, etc.) define throughput/tunnels; availability depends on generation.
- Active-active configuration (two instances) for redundancy.
- Can run bgp for dynamic routing and failover.
- VPN vs ExpressRoute: VPN = internet-based, cheaper, variable latency/throughput; ExpressRoute = private dedicated link, higher/SLA-backed throughput.
- Gateways incur hourly cost + data transfer; only one active/active gateway can exist per region.
How it fits
[on-prem VPN device/router] <—IPsec S2S—> [Azure VPN Gateway]
│ │ (GatewaySubnet)
corp LAN [VNet subnets]
Exam notes
- Gateway subnet must be named
GatewaySubnet; it can’t host other resources. - Point-to-Site connects individual users; Site-to-Site connects sites; VNet-to-VNet connects VNets.
- To reach on-premises from a peered spoke, enable ”Use remote gateways” on the spoke and ”Allow gateway transit” on the hub.
- Compare consistently with expressroute and virtual-wan for hybrid questions.
Related
Home · bgp · expressroute · vnet · virtual-wan · route-table
📘 Source: Microsoft Learn — Vpn Gateway