5.1.3.2. Configure VPN Gateway
💡 First Principle: An Azure VPN Gateway provides secure, encrypted connectivity between an on-premises network and an Azure VNet over the public internet, fundamentally enabling hybrid cloud architectures.
Scenario: Your organization needs to securely connect its on-premises data center to its Azure Virtual Network to enable hybrid applications to access resources in both environments. This connection needs to be encrypted but can traverse the public internet.
What It Is: An Azure VPN Gateway is a type of virtual network gateway that sends encrypted traffic between an Azure VNet and an on-premises location over the public internet.
Types of VPN Gateway:
- Site-to-Site (S2S): Connects your on-premises network to an Azure VNet.
- Point-to-Site (P2S): Allows individual client devices to securely connect to an Azure VNet.
Key Components:
- VPN Gateway: The Azure resource that handles encrypted traffic.
- Local Network Gateway: Represents your on-premises network’s public IP and address space.
- Connection: The logical link that joins the VPN Gateway and Local Network Gateway.
High-Level Configuration Steps (Site-to-Site):
- Create a VNet.
- Deploy a VPN Gateway in the gateway subnet.
- Define a Local Network Gateway.
- Establish a Connection.
Visual: Site-to-Site VPN Gateway Connectivity
Loading diagram...
⚠️ Common Pitfall: Mismatching the pre-shared key or other IPsec/IKE parameters between the Azure VPN Gateway and the on-premises VPN device, which is the most common cause of connection failures.
Key Trade-Offs:
- Cost/Flexibility (VPN) vs. Performance/Reliability (ExpressRoute): VPN is cheaper and more flexible but has variable performance over the internet. ExpressRoute is more expensive but offers dedicated, reliable performance.
Reflection Question: How does configuring an Azure VPN Gateway (using Site-to-Site or Point-to-Site configurations) fundamentally enable secure, encrypted communication between your on-premises network and Azure VNets over the public internet, supporting hybrid cloud architectures?