Azure VPN Gateway: Site-to-Site and Point-to-Site VPN

How VPN Gateway works

A VPN Gateway is a managed pair of redundant VMs deployed by Azure into the GatewaySubnet in your hub VNet. You never manage these VMs directly. Each VM runs routing and IPsec/IKE software. The gateway is assigned one or two public IP addresses that remote devices connect to.

For Site-to-Site: your on-premises VPN device initiates an IKEv2 or IKEv1 negotiation to the gateway’s public IP. Both devices agree on encryption parameters, exchange keys, and establish an IPsec tunnel. Traffic between the on-premises network and your Azure VNet then flows through this encrypted tunnel.

For Point-to-Site: a user’s device runs the Azure VPN Client or a compatible OpenVPN client. The client connects to the gateway’s public IP and authenticates via certificate, Azure AD, or RADIUS. Once authenticated, the client receives a private IP from the P2S address pool and can reach resources in the VNet.

VPN Gateway SKUs

Choose the SKU based on required throughput, S2S tunnel count, and zone redundancy needs:

For production, always use the AZ variant (VpnGw1AZ, VpnGw2AZ, etc.). Zone-redundant SKUs deploy gateway VMs across multiple availability zones, so a zone failure does not take down your VPN. Never use the Basic SKU — it lacks BGP support, zone redundancy, active-active mode, and coexistence with ExpressRoute Gateway. The Basic SKU is being deprecated.

Step 1 — Create the VPN Gateway

Before creating the gateway, the hub VNet must have a GatewaySubnet. The gateway also needs a public IP address:

# Create a zone-redundant public IP for the gateway
az network public-ip create \
  --name pip-vpngw-hub \
  --resource-group rg-hub-networking \
  --location eastus \
  --sku Standard \
  --allocation-method Static \
  --zone 1 2 3

# Create the VPN Gateway — takes 25-45 minutes
az network vnet-gateway create \
  --name vpngw-hub-eastus \
  --resource-group rg-hub-networking \
  --location eastus \
  --vnet vnet-hub-eastus \
  --gateway-type Vpn \
  --vpn-type RouteBased \
  --sku VpnGw1AZ \
  --public-ip-address pip-vpngw-hub \
  --enable-bgp true \
  --asn 65515 \
  --no-wait

The ASN 65515 is Azure’s default ASN for VPN Gateway. Your on-premises device must use a different ASN (any private ASN in 64512–65535 except those reserved by Azure). Check deployment status:

az network vnet-gateway show \
  --name vpngw-hub-eastus \
  --resource-group rg-hub-networking \
  --query "{state:provisioningState, ip:bgpSettings.bgpPeeringAddress}" \
  --output table

Step 2 — Configure Site-to-Site VPN

A Site-to-Site connection requires two resources: a Local Network Gateway (which represents your on-premises VPN device and network) and a Connection resource (which ties the Azure VPN Gateway to the Local Network Gateway):

# Create Local Network Gateway
# --gateway-ip-address: your on-premises VPN device's public IP
# --local-address-prefixes: on-premises subnets reachable through this device
# --asn + --bgp-peering-address: for BGP (use on-premises router's ASN and BGP IP)
az network local-gateway create \
  --name lng-onprem-dc01 \
  --resource-group rg-hub-networking \
  --location eastus \
  --gateway-ip-address 203.0.113.10 \
  --local-address-prefixes 192.168.1.0/24 192.168.2.0/24 \
  --asn 65001 \
  --bgp-peering-address 192.168.1.1

# Create the VPN Connection
az network vpn-connection create \
  --name conn-to-onprem-dc01 \
  --resource-group rg-hub-networking \
  --location eastus \
  --vnet-gateway1 vpngw-hub-eastus \
  --local-gateway2 lng-onprem-dc01 \
  --shared-key "R@nd0mStr0ngK3y-ChangeThis" \
  --enable-bgp true \
  --connection-protocol IKEv2

Configure your on-premises VPN device with the Azure gateway’s public IP, the same pre-shared key, and matching IKEv2 parameters. When both sides are configured, check the tunnel state:

az network vpn-connection show \
  --name conn-to-onprem-dc01 \
  --resource-group rg-hub-networking \
  --query "{status:connectionStatus,ingress:ingressBytesTransferred,egress:egressBytesTransferred}" \
  --output table

A Connected status with non-zero byte counts confirms the tunnel is up and passing traffic.

BGP for dynamic routing

Without BGP, you must list every on-premises subnet in the Local Network Gateway’s address prefixes, and update that list every time the on-premises network changes. With BGP, both sides advertise routes dynamically.

Azure VPN Gateway’s BGP peering IP is visible in the gateway properties. Your on-premises router establishes a BGP session with this IP over the IPsec tunnel. Both sides exchange route advertisements. Add a new Azure subnet and it is automatically advertised to on-premises. Add a new on-premises VLAN and it is automatically advertised to Azure — no manual route table changes required.

BGP is especially valuable when you have multiple S2S connections (multiple branch offices or a backup ExpressRoute path) because the gateway can make routing decisions dynamically rather than requiring static overrides.

Active-active vs active-passive configuration

By default, VPN Gateway deploys in active-passive mode: one VM actively handles tunnels, one is on standby. If the active VM fails, Azure fails over to the standby in 10–30 seconds. During failover, existing TCP connections drop.

Active-active mode deploys two active VMs, each with its own public IP. Both form independent IPsec tunnels to your on-premises device. Your device must support multiple active tunnels (ECMP or BGP-based load balancing). If one Azure VM fails, the other tunnel stays up — zero interruption.

# Create second public IP for active-active mode
az network public-ip create \
  --name pip-vpngw-hub-2 \
  --resource-group rg-hub-networking \
  --location eastus \
  --sku Standard \
  --allocation-method Static \
  --zone 1 2 3

# Enable active-active on existing gateway
az network vnet-gateway update \
  --name vpngw-hub-eastus \
  --resource-group rg-hub-networking \
  --active-active true \
  --public-ip-address pip-vpngw-hub pip-vpngw-hub-2

Point-to-Site VPN configuration

Point-to-Site requires configuring an address pool (IP range assigned to VPN clients), selecting a protocol, and choosing an authentication method. The address pool must not overlap the VNet address space or on-premises ranges:

# Configure P2S with OpenVPN and Azure AD authentication
az network vnet-gateway update \
  --name vpngw-hub-eastus \
  --resource-group rg-hub-networking \
  --address-prefixes 172.16.50.0/24 \
  --client-protocol OpenVPN \
  --vpn-auth-type AAD \
  --aad-tenant "https://login.microsoftonline.com/your-tenant-id/" \
  --aad-audience "41b23e61-6c1e-4545-b367-cd054e0ed4b4" \
  --aad-issuer "https://sts.windows.net/your-tenant-id/"

The audience ID 41b23e61-6c1e-4545-b367-cd054e0ed4b4 is the fixed application ID for Azure VPN in the public cloud. After configuration, download the VPN client configuration package from the portal. Distribute this to users along with the Azure VPN Client application.