Site-to-Site VPN: Connecting On-Premises
Build secure IPsec tunnels between Azure and on-premises with VPN Gateway — SKU selection, policy vs route-based, custom IKE policies, and high-availability designs.
Site-to-Site VPN: Connecting On-Premises
A Site-to-Site (S2S) VPN creates an encrypted tunnel between your Azure VNet and on-premises network over the public internet. It’s the most common hybrid connectivity starting point.
A site-to-site VPN is a secure tunnel between your office and Azure — like an underground passage connecting two buildings. Your on-premises network has a VPN device. Azure has a VPN Gateway. They negotiate encryption, share a secret key, and create an encrypted tunnel over the public internet.
Three Components of S2S VPN
🏪 Sam’s scenario: Harbour Retail’s head office in Auckland needs to connect to Azure for accessing VMs and databases. He needs three things:
On-Premises ←── IPsec Tunnel ──→ Azure
[VPN Device] [VPN Gateway]
in GatewaySubnet
↑ ↑
Local Network Virtual Network
Gateway (LNG) Gateway (VNG)
(tells Azure your (deployed by Azure
on-prem IP + ranges) in your VNet)- Virtual Network Gateway (VNG): Azure-managed gateway deployed in the GatewaySubnet. Takes 30-45 minutes to provision.
- Local Network Gateway (LNG): A logical resource representing your on-premises VPN device — contains its public IP and the on-prem address ranges.
- Connection: Links the VNG to the LNG with a shared key (pre-shared key for IKEv2) or certificates.
VPN Gateway SKUs
| SKU | Throughput | S2S Tunnels | P2S Connections | BGP | Zone-Redundant |
|---|---|---|---|---|---|
| VpnGw1 | 650 Mbps | 30 | 250 | Yes | No |
| VpnGw1AZ | 650 Mbps | 30 | 250 | Yes | Yes |
| VpnGw2 | 1.25 Gbps | 30 | 500 | Yes | No |
| VpnGw2AZ | 1.25 Gbps | 30 | 500 | Yes | Yes |
| VpnGw3 | 2.5 Gbps | 30 | 1000 | Yes | No |
| VpnGw3AZ | 2.5 Gbps | 30 | 1000 | Yes | Yes |
| VpnGw4 | 5 Gbps | 100 | 5000 | Yes | No |
| VpnGw4AZ | 5 Gbps | 100 | 5000 | Yes | Yes |
| VpnGw5 | 10 Gbps | 100 | 10000 | Yes | No |
| VpnGw5AZ | 10 Gbps | 100 | 10000 | Yes | Yes |
Exam Tip — Choosing the SKU: The exam often presents a throughput requirement and asks which SKU to choose. Remember: VpnGw1/2/3 support 30 S2S tunnels, while VpnGw4/5 support 100. AZ variants are zone-redundant and required for production SLA. The Basic SKU (legacy) is not shown above — it doesn’t support BGP, active-active, or custom IPsec/IKE policies, and should never be used for new deployments.
Policy-Based vs Route-Based
| Feature | Policy-Based | Route-Based |
|---|---|---|
| IKE version | IKEv1 only | IKEv2 (and IKEv1 for legacy) |
| Tunnel count | 1 tunnel only | Up to 100 (SKU dependent) |
| P2S support | No | Yes |
| BGP support | No | Yes |
| Active-active | No | Yes |
| Coexistence with ExpressRoute | No | Yes |
| Traffic selectors | Defined by policy (ACLs) | Any-to-any (virtual tunnel interface) |
| Use case | Legacy devices that require it | Everything else — this is the default |
Exam Tip: Route-based VPN is the correct choice for 99% of deployments. The only reason to use policy-based is if your on-premises device doesn’t support route-based (very rare with modern equipment). If the exam doesn’t specifically mention a legacy device requirement, choose route-based.
Custom IPsec/IKE Policies
🔒 Aisha’s scenario: Sentinel Banking’s compliance team requires specific encryption algorithms that exceed Azure defaults. She configures custom IPsec/IKE policies:
Phase 1 (IKE SA) parameters:
| Parameter | Options |
|---|---|
| Encryption | AES256, AES192, AES128, DES3 |
| Integrity | SHA384, SHA256, SHA1, MD5 |
| DH Group | DHGroup24, ECP384, ECP256, DHGroup14, DHGroup2 |
| SA Lifetime | 300 - 86,400 seconds (default 28,800 = 8 hours) |
Phase 2 (IPsec SA) parameters:
| Parameter | Options |
|---|---|
| Encryption | GCMAES256, GCMAES192, GCMAES128, AES256, AES192, AES128 |
| Integrity | GCMAES256, GCMAES192, GCMAES128, SHA256, SHA1 |
| PFS Group | PFS24, ECP384, ECP256, PFS2048, PFS14, PFS2, None |
| SA Lifetime | 300 - 27,000 seconds (default 3,600 = 1 hour) |
Aisha configures AES256 encryption, SHA256 integrity, DHGroup14, and PFS2048 to meet her banking compliance requirements. Both sides (Azure and on-prem VPN device) must use identical parameters.
High-Availability Designs
Active-Standby (default): Every VPN Gateway deploys as two instances. One is active, one is standby. Failover happens automatically in 10-15 seconds (planned) or 60-90 seconds (unplanned). This is the default configuration.
Active-Active: Both gateway instances are active simultaneously, each with its own public IP. You create tunnels from your on-premises device to both IPs. Benefits:
- Load balancing across both tunnels
- Faster failover (seconds instead of a minute)
- Better throughput (both tunnels carry traffic)
Dual-Redundancy (4 tunnels): For maximum availability, combine active-active Azure gateway with two on-premises VPN devices:
On-Prem Device 1 ──→ Azure GW Instance 1
On-Prem Device 1 ──→ Azure GW Instance 2
On-Prem Device 2 ──→ Azure GW Instance 1
On-Prem Device 2 ──→ Azure GW Instance 2This gives you 4 IPsec tunnels with no single point of failure on either side.
Azure Extended Network
Azure Extended Network is a niche feature that lets you stretch a Layer 2 subnet from on-premises into Azure. VMs keep their on-premises IP addresses after migration.
When it’s used: During migration, when you can’t change VM IPs (applications with hardcoded IPs, licensing tied to IPs, complex interdependencies).
Requirements:
- VPN or ExpressRoute connection
- Windows Server 2019 as the host OS
- Azure Extended Network Windows Admin Center extension
Limitations: Not for permanent use — it’s a migration bridge. Performance overhead from L2 encapsulation. Rarely tested on the exam but good to know exists.
Key Takeaways
- S2S VPN needs three components: VNG, LNG, and Connection
- Route-based VPN is the default — supports BGP, P2S, active-active, multiple tunnels
- Choose SKU based on throughput needs; AZ variants for zone redundancy
- Custom IPsec/IKE policies must match on both sides
- Active-active with dual on-prem devices gives maximum availability (4 tunnels)
Test Your Knowledge
Sam needs a VPN Gateway that supports BGP, zone redundancy, and at least 1.25 Gbps throughput. Which SKU should he choose?
Aisha configures custom IPsec/IKE policies on her Azure VPN connection. What must be true about the on-premises VPN device?
Next up: Point-to-Site VPN: Remote Access — Connect individual devices to Azure with P2S VPN using certificates, RADIUS, or Entra ID authentication.