Azure VPN Gateway Cheat Sheet

• A secured hybrid cloud architecture.
• It is composed of gateway subnet, tunnel, and on-premises gateway.
• Protocols: Internet Protocol Security (IPsec) and Internet Key Exchange (IKE)
• VPN gateway connections: VNet-to-VNet, Site-to-Site, and Point-to-Site
  • Create a secure connection from your on-premises network to an Azure virtual network with a site-to-site VPN.
  • VNet-to-VNet connection automatically routes to the updated address space, if you updated the address space on the other VNet.
  • If you need to establish a connection to your virtual network from a remote location, you can use a point-to-site (P2S) VPN.
• You can also have one VPN gateway with more than one on-premises network using a Multi-Site connection.

Routing

• Policy-based gateway

• • Implements a policy-based VPN.
  • Policy-based VPNs are used to encrypt and direct packets to IPsec tunnels. 
  • The policy or traffic selector is defined as an access list in the VPN configuration.
  • You cannot change a policy-based VPN to a route-based VPN, and vice versa. 
• Route-based gateway

• • Implements a route-based VPN.
  • Route-based VPNs use routes in the routing table to direct packets to tunnel interfaces.
  • Tunnel interfaces can encrypt and decrypt packets.
  • The policy or traffic selector are configured as wild cards (any-to-any).

Connection Resiliency

• In an active-active configuration, each Azure VPN gateway instance will establish S2S VPN tunnels and the traffic will be routed to multiple tunnels.
• For active-passive configuration, the standby instance would only take over if a disruption happens on the active instance.

Azure VPN Gateway Pricing

• You are billed hourly for the compute costs of the VNet gateway.
• You are charged for the egress data transfer from the virtual network gateway.
• You are only charged by the VPN Gateway when you transfer data between two different regions, except with Point-to-Site VPN.

Want to learn more about Azure? Watch the official Microsoft Azure YouTube channel’s video series called Azure Tips and Tricks.

Validate Your Knowledge

Question 1

Question Type: Single-choice

Your company is planning to migrate some of its servers to Azure. You need to recommend a solution wherein users can work remotely by having a secure connection to your Azure virtual machines.

What should you include in the recommendation?

1. ExpressRoute
2. Point-to-Site VPN Connection
3. Site-to-Site VPN Connection
4. Traffic Manager

Question 2

Question Type: Multiple-choice

Your company is currently hosting a mission-critical application in an Azure virtual machine that resides in a virtual network named TDVnet1. You plan to use Azure ExpressRoute to allow the web applications to connect to the on-premises network.

Due to compliance requirements, you need to ensure that in the event your ExpressRoute fails, the connectivity between TDVnet1 and your on-premises network will remain available.

The solution must utilize a site-to-site VPN between TDVnet1 and the on-premises network. The solution should also be cost-effective.

Which three actions should you implement? Each correct answer presents part of the solution.

1. Configure a gateway subnet.
2. Configure a VPN gateway with VpnGw1 as its SKU.
3. Configure a VPN gateway with Basic as its SKU.
4. Configure a local network gateway.
5. Configure a connection.

Show me the answer!

Correct Answer: 2, 4, 5

A VPN gateway is a specific type of virtual network gateway that is used to send encrypted traffic between an Azure virtual network and an on-premises location over the public Internet. You can also use a VPN gateway to send encrypted traffic between Azure virtual networks over the Microsoft network. Each virtual network can have only one VPN gateway. However, you can create multiple connections to the same VPN gateway. When you create multiple connections to the same VPN gateway, all VPN tunnels share the available gateway bandwidth.

A site-to-site VPN gateway connection is used to connect your on-premises network to an Azure virtual network over an IPsec/IKE (IKEv1 or IKEv2) VPN tunnel. This type of connection requires a VPN device located on-premises that has an externally facing public IP address assigned to it.

Configuring Site-to-Site VPN and ExpressRoute coexisting connections has several advantages:

– You can configure a Site-to-Site VPN as a secure failover path for ExpressRoute.

– Alternatively, you can use Site-to-Site VPNs to connect to sites that are not connected through ExpressRoute.

To create a site-to-site connection, you need to do the following:

– Provision a virtual network

– Provision a VPN gateway

– Provision a local network gateway

– Provision a VPN connection

– Verify the connection

– Connect to a virtual machine

Take note that since you have already deployed an ExpressRoute, you do not need to create a virtual network and gateway subnet as these are prerequisites in creating an ExpressRoute.

Hence, the correct answers are:

– Configure a VPN gateway with a VpnGw1 SKU.

– Configure a local network gateway.

– Configure a connection.

The option that says: Configure a gateway subnet is incorrect. As you already have an ExpressRoute connecting to your on-premises network, this means that a gateway subnet is already provisioned.

The option that says: Configure a VPN gateway with Basic as its SKU is incorrect. Although one of the requirements is to minimize costs, the coexisting connection for ExpressRoute and site-to-site VPN connection does not support a Basic SKU. The bare minimum for a coexisting connection is VpnGw1.

References:
https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-site-to-site-resource-manager-portal
https://docs.microsoft.com/en-us/azure/expressroute/expressroute-howto-coexist-resource-manager
https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateways#gwsku

Note: This question was extracted from our AZ-104 Microsoft Azure Administrator Practice Exams.

For more Azure practice exam questions with detailed explanations, check out the Tutorials Dojo Portal:

Azure VPN Gateway Cheat Sheet References:

https://azure.microsoft.com/en-us/services/vpn-gateway/
https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateways