Azure VPN Gateway is a network service operated by Microsoft within Microsoft Azure. It provides the Azure side of a VPN connection. Companies can use it, for example, to connect a branch office to servers in Azure or to give employees protected remote access.
Which connections are possible?
- Site-to-site: A VPN device at the company site connects the on-premises network to Azure through an IPsec/IKE tunnel.
- Point-to-site: Individual devices connect using a suitable VPN client. Supported protocols and authentication methods must match each other and the operating system.
- VNet-to-VNet: VPN gateways connect Azure virtual networks through encrypted tunnels.
The basic idea is the same as a VPN: the tunnel protects data in transit. Which systems are then reachable is also determined by routing, network rules and permissions.
What is needed for the setup?
The Azure configuration includes a virtual network, a dedicated GatewaySubnet, a suitable gateway SKU and the connection resources. Only the gateway components are deployed in the GatewaySubnet. For site-to-site connections, a so-called local network gateway describes the remote side and its address ranges. This Azure resource does not replace the on-premises VPN device. It describes the device for the connection and the routing.
Plan IP address ranges in advance so that they do not overlap. DNS resolution, return routes, IPsec parameters and the compatibility of the local firewall must also fit together. A successful tunnel connection alone does not prove that an application is reachable end to end.
Availability and operations
The gateway SKU affects capacity and available features, among other things. Active-active configurations and zone-redundant deployment can increase resilience, provided the chosen configuration supports them. A robust overall solution must also take on-premises VPN devices, internet connections and routing into account.
In operations, connection status, logs and utilization belong in monitoring. Document changes and limit access to the address ranges that are actually needed.
Distinction from ExpressRoute
VPN Gateway uses the public internet for site connectivity. ExpressRoute, by contrast, provides private connections to Microsoft. A VPN can also serve as an additional fallback path. Which setup fits depends on availability, traffic and operational requirements.