Site-to-Site VPN: Connecting On-Premises

A Site-to-Site (S2S) VPN creates an encrypted tunnel between your Azure VNet and on-premises network over the public internet. It’s the most common hybrid connectivity starting point.

🎬 Video coming soon

Site-to-Site VPN Deep Dive

Site-to-Site VPN Deep Dive

~14:00

Three Components of S2S VPN

🏪 Sam’s scenario: Harbour Retail’s head office in Auckland needs to connect to Azure for accessing VMs and databases. He needs three things:

On-Premises       ←── IPsec Tunnel ──→         Azure
[VPN Device]                               [VPN Gateway]
                                           in GatewaySubnet
        ↑                                       ↑
  Local Network                          Virtual Network
  Gateway (LNG)                            Gateway (VNG)
  (tells Azure your                     (deployed by Azure
   on-prem IP + ranges)                  in your VNet)

1. Virtual Network Gateway (VNG): Azure-managed gateway deployed in the GatewaySubnet. Takes 30-45 minutes to provision.
2. Local Network Gateway (LNG): A logical resource representing your on-premises VPN device — contains its public IP and the on-prem address ranges.
3. Connection: Links the VNG to the LNG with a shared key (pre-shared key for IKEv2) or certificates.

VPN Gateway SKUs

VPN Gateway SKU Comparison

SKU	Throughput	S2S Tunnels	P2S Connections	BGP	Zone-Redundant
VpnGw1	650 Mbps	30	250	Yes	No
VpnGw1AZ	650 Mbps	30	250	Yes	Yes
VpnGw2	1.25 Gbps	30	500	Yes	No
VpnGw2AZ	1.25 Gbps	30	500	Yes	Yes
VpnGw3	2.5 Gbps	30	1000	Yes	No
VpnGw3AZ	2.5 Gbps	30	1000	Yes	Yes
VpnGw4	5 Gbps	100	5000	Yes	No
VpnGw4AZ	5 Gbps	100	5000	Yes	Yes
VpnGw5	10 Gbps	100	10000	Yes	No
VpnGw5AZ	10 Gbps	100	10000	Yes	Yes

Exam Tip — Choosing the SKU: The exam often presents a throughput requirement and asks which SKU to choose. Remember: VpnGw1/2/3 support 30 S2S tunnels, while VpnGw4/5 support 100. AZ variants are zone-redundant and required for production SLA. The Basic SKU (legacy) is not shown above — it doesn’t support BGP, active-active, or custom IPsec/IKE policies, and should never be used for new deployments.

Policy-Based vs Route-Based

Policy-Based vs Route-Based VPN

Feature	Policy-Based	Route-Based
IKE version	IKEv1 only	IKEv2 (and IKEv1 for legacy)
Tunnel count	1 tunnel only	Up to 100 (SKU dependent)
P2S support	No	Yes
BGP support	No	Yes
Active-active	No	Yes
Coexistence with ExpressRoute	No	Yes
Traffic selectors	Defined by policy (ACLs)	Any-to-any (virtual tunnel interface)
Use case	Legacy devices that require it	Everything else — this is the default

Exam Tip: Route-based VPN is the correct choice for 99% of deployments. The only reason to use policy-based is if your on-premises device doesn’t support route-based (very rare with modern equipment). If the exam doesn’t specifically mention a legacy device requirement, choose route-based.

Custom IPsec/IKE Policies

🔒 Aisha’s scenario: Sentinel Banking’s compliance team requires specific encryption algorithms that exceed Azure defaults. She configures custom IPsec/IKE policies:

Phase 1 (IKE SA) parameters:

Parameter	Options
Encryption	AES256, AES192, AES128, DES3
Integrity	SHA384, SHA256, SHA1, MD5
DH Group	DHGroup24, ECP384, ECP256, DHGroup14, DHGroup2
SA Lifetime	300 - 86,400 seconds (default 28,800 = 8 hours)

Phase 2 (IPsec SA) parameters:

Parameter	Options
Encryption	GCMAES256, GCMAES192, GCMAES128, AES256, AES192, AES128
Integrity	GCMAES256, GCMAES192, GCMAES128, SHA256, SHA1
PFS Group	PFS24, ECP384, ECP256, PFS2048, PFS14, PFS2, None
SA Lifetime	300 - 27,000 seconds (default 3,600 = 1 hour)

Aisha configures AES256 encryption, SHA256 integrity, DHGroup14, and PFS2048 to meet her banking compliance requirements. Both sides (Azure and on-prem VPN device) must use identical parameters.

High-Availability Designs

Active-Standby (default): Every VPN Gateway deploys as two instances. One is active, one is standby. Failover happens automatically in 10-15 seconds (planned) or 60-90 seconds (unplanned). This is the default configuration.

Active-Active: Both gateway instances are active simultaneously, each with its own public IP. You create tunnels from your on-premises device to both IPs. Benefits:

• Load balancing across both tunnels
• Faster failover (seconds instead of a minute)
• Better throughput (both tunnels carry traffic)

Dual-Redundancy (4 tunnels): For maximum availability, combine active-active Azure gateway with two on-premises VPN devices:

On-Prem Device 1 ──→ Azure GW Instance 1
On-Prem Device 1 ──→ Azure GW Instance 2
On-Prem Device 2 ──→ Azure GW Instance 1
On-Prem Device 2 ──→ Azure GW Instance 2

This gives you 4 IPsec tunnels with no single point of failure on either side.

ℹ️ Azure Extended Network

Azure Extended Network is a niche feature that lets you stretch a Layer 2 subnet from on-premises into Azure. VMs keep their on-premises IP addresses after migration.

When it’s used: During migration, when you can’t change VM IPs (applications with hardcoded IPs, licensing tied to IPs, complex interdependencies).

Requirements:

• VPN or ExpressRoute connection
• Windows Server 2019 as the host OS
• Azure Extended Network Windows Admin Center extension

Limitations: Not for permanent use — it’s a migration bridge. Performance overhead from L2 encapsulation. Rarely tested on the exam but good to know exists.

Key Takeaways

• S2S VPN needs three components: VNG, LNG, and Connection
• Route-based VPN is the default — supports BGP, P2S, active-active, multiple tunnels
• Choose SKU based on throughput needs; AZ variants for zone redundancy
• Custom IPsec/IKE policies must match on both sides
• Active-active with dual on-prem devices gives maximum availability (4 tunnels)

---

Test Your Knowledge

Question

What are the three components needed for a Site-to-Site VPN?

Click or press Enter to reveal answer

Answer

1. Virtual Network Gateway (VNG) — Azure-side gateway in GatewaySubnet. 2. Local Network Gateway (LNG) — represents on-premises (public IP + address ranges). 3. Connection — links VNG to LNG with shared key.

Click to flip back

Question

When should you use policy-based instead of route-based VPN?

Click or press Enter to reveal answer

Answer

Only when your on-premises VPN device requires it (very rare with modern equipment). Route-based is the default and supports BGP, P2S, active-active, multiple tunnels, and ExpressRoute coexistence.

Click to flip back

Question

How many S2S tunnels do VpnGw1-3 SKUs support vs VpnGw4-5?

Click or press Enter to reveal answer

Answer

VpnGw1, 2, 3: up to 30 S2S tunnels. VpnGw4, 5: up to 100 S2S tunnels. AZ variants add zone redundancy but have the same tunnel limits.

Click to flip back

Question

What is dual-redundancy in VPN design?

Click or press Enter to reveal answer

Answer

Combining an active-active Azure VPN Gateway (2 instances) with 2 on-premises VPN devices, creating 4 tunnels total. No single point of failure on either side.

Click to flip back

---

Knowledge Check

Sam needs a VPN Gateway that supports BGP, zone redundancy, and at least 1.25 Gbps throughput. Which SKU should he choose?

AVpnGw1AZ (650 Mbps)BVpnGw2AZ (1.25 Gbps)CVpnGw2 (1.25 Gbps)DBasic (100 Mbps)

Check Answer

Knowledge Check

Aisha configures custom IPsec/IKE policies on her Azure VPN connection. What must be true about the on-premises VPN device?

AIt automatically detects and matches Azure's parametersBIt must be configured with identical IPsec/IKE parametersCIt only needs to match Phase 1 parameters — Phase 2 negotiates automaticallyDCustom policies only apply to the Azure side

Check Answer

---

Next up: Point-to-Site VPN: Remote Access — Connect individual devices to Azure with P2S VPN using certificates, RADIUS, or Entra ID authentication.