3.1 Azure VPN Gateway Architecture & SKUs
Key Takeaways
- The GatewaySubnet must be named exactly 'GatewaySubnet' and sized at /27 minimum (/26 strongly recommended for ExpressRoute co-existence and future IP growth).
- Route-based VPN gateways use IKEv2 and Virtual Tunnel Interfaces (VTIs), supporting BGP, Point-to-Site, multi-site, and active-active topologies, whereas Policy-based gateways use IKEv1 static packet selectors limited to 1 tunnel.
- Basic SKU is strictly legacy (100 Mbps, 10 S2S tunnels, no BGP, no zone redundancy, Gen1 only), while modern VpnGw1-5 (and VpnGw1AZ-5AZ) scale from 650 Mbps to 10 Gbps.
- Active-Active gateway deployments require two dedicated Standard Public IP addresses and two active gateway instances, providing sub-second BGP failover and a 99.99% SLA when zone-redundant.
- Never associate a Network Security Group (NSG) or User-Defined Route (UDR) with a 0.0.0.0/0 next-hop Internet blackhole to the GatewaySubnet, as doing so breaks Azure control plane health probes (ports 65503-65534).
Azure VPN Gateway is a specialized type of virtual network gateway that transmits encrypted cross-premises traffic across the public internet between an Azure Virtual Network (VNet) and on-premises physical locations, remote workers, or other VNets. For the AZ-700 exam, network engineers must master the underlying infrastructure prerequisites, sizing rules, SKU performance boundaries, and resiliency topologies.
1. GatewaySubnet Architecture & Operational Constraints
Every Azure VPN Gateway requires a dedicated subnet within the host Virtual Network named exactly GatewaySubnet. This subnet hosts the virtual machine instances running Azure's internal gateway routing software.
Subnet Sizing Guidelines
| Subnet Prefix | Usable Azure IPs | Recommendation Status | Architecture Context |
|---|---|---|---|
| /29 | 3 usable IPs (8 total - 5 reserved) | Do Not Use | Bare minimum for single Basic gateway. Cannot support upgrades, maintenance instances, or co-existing ExpressRoute gateways. |
| /28 | 11 usable IPs (16 total - 5 reserved) | Not Recommended | Minimal operational headroom. Insufficient for future multi-gateway architectures or dual-stack IPv4/IPv6 gateways. |
| /27 | 27 usable IPs (32 total - 5 reserved) | Minimum Recommended | Baseline Microsoft requirement for production deployments. Accommodates maintenance VM scaling and transient IP allocation. |
| /26 | 59 usable IPs (64 total - 5 reserved) | Best Practice | Strongly recommended. Provides full operational capacity for co-existing VPN and ExpressRoute gateways, Active-Active dual-IP configurations, and future platform feature expansions. |
+-----------------------------------------------------------------------------------------+
| Virtual Network (10.100.0.0/16) |
| |
| +-----------------------------------------------------------------------------------+ |
| | GatewaySubnet (10.100.255.0/26 - 64 IPs) | |
| | | |
| | +----------------------------------+ +-------------------------------------+ | |
| | | VPN Gateway Instance 0 | | VPN Gateway Instance 1 | | |
| | | Private IP: 10.100.255.4 | | Private IP: 10.100.255.5 | | |
| | | Public IP: PIP-1 (20.50.10.1) | | Public IP: PIP-2 (20.50.10.2) | | |
| | +----------------------------------+ +-------------------------------------+ | |
| | | |
| | +-----------------------------------------------------------------------------+ | |
| | | Maintenance Spare / ExpressRoute Co-existence Allocation Pool (50+ Free IPs)| | |
| | +-----------------------------------------------------------------------------+ | |
| +-----------------------------------------------------------------------------------+ |
| |
| +-------------------------------------+ +----------------------------------------+ |
| | Workload Subnet A (10.100.1.0/24) | | Workload Subnet B (10.100.2.0/24) | |
| +-------------------------------------+ +----------------------------------------+ |
+-----------------------------------------------------------------------------------------+
Mandatory GatewaySubnet Constraints
- Subnet Name: Must be verbatim
GatewaySubnet. Any variation (e.g.,gatewaysubnetin some legacy APIs orGateway-Subnet) will prevent gateway deployment. - No User Workloads: You cannot deploy standard virtual machines, container instances, or application load balancers inside
GatewaySubnet. - Network Security Groups (NSGs): Never associate an NSG with the GatewaySubnet. Blocking inbound traffic on control plane ports (TCP 65503-65534) or blocking
AzureLoadBalancerhealth probes breaks internal platform management and causes gateway state to transition toDegradedorFailed. - User-Defined Routes (UDRs): Do not attach a UDR to
GatewaySubnetwith a default route (0.0.0.0/0) pointing to a Network Virtual Appliance (NVA) unless you explicitly configure targeted UDRs that preserve Azure management plane endpoints. Otherwise, the gateway loses connectivity to Azure infrastructure controllers.
2. Gateway Types: Route-Based vs. Policy-Based
Azure supports two fundamental gateway routing paradigms. Choosing the correct type is critical because changing gateway types requires deleting and recreating the gateway resource.
Comparison of Routing Paradigms
| Capability | Route-Based VPN Gateway | Policy-Based VPN Gateway | | :--- | :--- | :--- | | | Routing Protocol / Method | Dynamic IPsec Virtual Tunnel Interface (VTI) / Any-to-Any | Static Access Control Lists (ACLs) / Packet Selectors | | IKE Version Support | IKEv2 (IKEv1 supported for legacy connections) | IKEv1 only | | S2S Connection Scale | Up to 30 or 128 tunnels (depending on SKU) | Exactly 1 Site-to-Site tunnel | | Point-to-Site (P2S) Support | Yes (OpenVPN, IKEv2, SSTP up to 10,000 clients) | No (Not supported) | | Dynamic BGP Routing | Yes (eBGP via ASN and BGP peering IPs) | No (Static prefixes only) | | VNet-to-VNet Connectivity | Yes (Multi-VNet mesh and transit routing) | Only 1 static VNet-to-VNet connection | | Active-Active Deployment | Yes | No | | Supported SKUs | VpnGw1-5, VpnGw1AZ-5AZ, Basic | Basic SKU only |
Traffic Selectors and Interoperability
Many legacy on-premises firewalls (such as older Cisco ASA models or policy-based Check Point appliances) define IPsec tunnels based on specific source/destination subnet pairs (e.g., 192.168.1.0/24 <-> 10.100.1.0/24).
By default, Azure Route-Based gateways negotiate wildcard traffic selectors (0.0.0.0/0 <-> 0.0.0.0/0). When connecting a Route-Based Azure VPN Gateway to a policy-based on-premises firewall, you must enable UsePolicyBasedTrafficSelectors (-UsePolicyBasedTrafficSelectors $True in PowerShell) on the Azure Connection resource. This causes Azure to dynamically generate and negotiate individual policy-based traffic selectors matching the prefix combinations defined in the Local Network Gateway and VNet address spaces.
3. Azure VPN Gateway SKUs & Generation Architectures
Microsoft categorizes VPN Gateways across Generation 1 and Generation 2 virtual hardware architectures, delivering distinct throughput, tunnel capacity, and zone-redundancy capabilities.
SKU Matrix & Performance Specifications
| SKU Name | Hardware Generation | Max Aggregate Throughput | Max S2S Tunnels | Max P2S Tunnels | BGP Support | Zone Redundancy |
|---|---|---|---|---|---|---|
| Basic | Gen 1 | 100 Mbps | 10 | 128 (SSTP only) | No | No (Regional only) |
| VpnGw1 | Gen 1 / Gen 2 | 650 Mbps | 30 | 250 | Yes | No |
| VpnGw1AZ | Gen 1 / Gen 2 | 650 Mbps | 30 | 250 | Yes | Yes (Zone-Redundant) |
| VpnGw2 | Gen 1 (1 Gbps) / Gen 2 (1.25 Gbps) | 1.0 - 1.25 Gbps | 30 | 500 | Yes | No |
| VpnGw2AZ | Gen 1 (1 Gbps) / Gen 2 (1.25 Gbps) | 1.0 - 1.25 Gbps | 30 | 500 | Yes | Yes (Zone-Redundant) |
| VpnGw3 | Gen 1 (1.25 Gbps) / Gen 2 (2.5 Gbps) | 1.25 - 2.5 Gbps | 30 | 1,000 | Yes | No |
| VpnGw3AZ | Gen 1 (1.25 Gbps) / Gen 2 (2.5 Gbps) | 1.25 - 2.5 Gbps | 30 | 1,000 | Yes | Yes (Zone-Redundant) |
| VpnGw4 | Gen 2 Only | 5.0 Gbps | 30 (128 with vWAN) | 5,000 | Yes | No |
| VpnGw4AZ | Gen 2 Only | 5.0 Gbps | 30 (128 with vWAN) | 5,000 | Yes | Yes (Zone-Redundant) |
| VpnGw5 | Gen 2 Only | 10.0 Gbps | 30 (128 with vWAN) | 10,000 | Yes | No |
| VpnGw5AZ | Gen 2 Only | 10.0 Gbps | 30 (128 with vWAN) | 10,000 | Yes | Yes (Zone-Redundant) |
Generation 1 vs. Generation 2 Differences
- Generation 1 SKUs: Built on legacy hypervisor sizes. Support Basic, VpnGw1, VpnGw2, and VpnGw3. Throughput caps out at 1.25 Gbps.
- Generation 2 SKUs: Deployed on modern Azure compute platforms with accelerated cryptographic offloading. Gen 2 unlocks higher throughput for VpnGw2 (1.25 Gbps) and VpnGw3 (2.5 Gbps), and introduces high-capacity tiers VpnGw4 (5 Gbps) and VpnGw5 (10 Gbps).
[!IMPORTANT] Resizing vs. Redeploying: You can resize within the same generation (e.g.,
VpnGw1toVpnGw3within Gen 1) with minimal transient downtime. However, you cannot resize across generations (e.g., fromVpnGw1 Gen 1toVpnGw4 Gen 2) or from theBasicSKU to anyVpnGwSKU. Crossing generation boundaries or upgrading from Basic requires deleting the gateway and creating a new one.
4. High Availability: Active-Standby vs. Active-Active Topologies
To ensure enterprise-grade continuity, Azure VPN Gateway supports two primary deployment topologies:
+-------------------------------------------------------------------------------------------------+
| ACTIVE-STANDBY TOPOLOGY (Single PIP) |
| |
| +------------------------------------+ |
| | Azure Gateway Instance 0 (ACTIVE) | <======== Active S2S IPsec Tunnel ========> +--------+ |
| +------------------------------------+ | On-Prem| |
| | (Standby) | Device | |
| +------------------------------------+ | | |
| | Azure Gateway Instance 1 (STANDBY) | . . . . . Standby Path (No Traffic) . . . . +--------+ |
| +------------------------------------+ |
| * Convergence Time: 30-90 seconds during failover. Single Public IP. |
+-------------------------------------------------------------------------------------------------+
+-------------------------------------------------------------------------------------------------+
| ACTIVE-ACTIVE TOPOLOGY (Dual PIPs) |
| |
| +------------------------------------+ <======== Active Tunnel 1 (BGP/ECMP) ======> +--------+ |
| | Azure Gateway Instance 0 (PIP-1) | <======== Active Tunnel 2 (BGP/ECMP) ======> | On-Prem| |
| +------------------------------------+ | Router1| |
| +--------+ |
| +------------------------------------+ <======== Active Tunnel 3 (BGP/ECMP) ======> +--------+ |
| | Azure Gateway Instance 1 (PIP-2) | <======== Active Tunnel 4 (BGP/ECMP) ======> | On-Prem| |
| +------------------------------------+ | Router2| |
| * Convergence Time: Sub-second with BGP keepalive/hold timers. Dual Public IPs. +--------+ |
+-------------------------------------------------------------------------------------------------+
1. Active-Standby Mode
- Mechanics: Azure provisions two gateway instances behind a single Public IP address. Instance 0 serves all active traffic. Instance 1 remains idle in hot standby.
- Failover Behavior: If Instance 0 experiences planned maintenance or unplanned hardware failure, Instance 1 assumes the active role and Public IP.
- Downtime / Convergence: Tunnel reconnection typically takes 30 to 90 seconds. BGP sessions drop and re-establish.
- SLA: 99.9% for regional SKUs; 99.95% for Zone-Redundant (
AZ) SKUs.
2. Active-Active Mode
- Mechanics: Both gateway instances are active simultaneously. Each instance is assigned a unique, dedicated Standard Public IP address (
PIP-1andPIP-2). - Connectivity: On-premises routers establish independent IPsec tunnels to both Azure Public IPs. When combined with dynamic BGP routing, both tunnels actively forward packets simultaneously using Equal-Cost Multi-Path (ECMP).
- High Availability: If one Azure gateway instance or on-premises tunnel fails, traffic immediately redirects through the remaining active tunnel with sub-second convergence driven by BGP neighbor timers.
- SLA: Reaches 99.99% availability when configured with dual on-premises customer edge devices across diverse ISP circuits and deployed using Zone-Redundant (
VpnGw#AZ) SKUs.
5. Architectural Comparison Matrix
| Feature | Active-Standby (Single PIP) | Active-Active (Dual PIPs) |
|---|---|---|
| Public IP Addresses | 1 Standard Public IP | 2 Standard Public IPs |
| Gateway Subnet IPs | 2 private IPs allocated | 2 private IPs allocated |
| Tunnel Throughput | Limited to single instance bandwidth | Aggregated across both instances with ECMP |
| BGP Support | Optional (Static or BGP) | Highly Recommended (Mandatory for multi-path failover) |
| Failover Convergence | 30 - 90 seconds | Sub-second (via BGP dampening/hold-down timers) |
| Supported On-Prem Topologies | Single Device / Single Link | Dual Devices / Dual ISP Links (Full Mesh 4-Tunnel) |
| Azure SLA | 99.9% (99.95% AZ) | 99.99% (with dual on-prem edge + AZ SKU) |
An enterprise is designing hybrid connectivity to connect an on-premises datacenter to an Azure Virtual Network. The solution requires an aggregate encrypted throughput of 3.8 Gbps, support for 3,500 concurrent Point-to-Site mobile clients, and resilience against datacenter-level outages within the Azure region. Which VPN Gateway SKU and subnet configuration must the network engineer select?
A network engineer deploys an Azure Route-Based VPN Gateway to connect to a legacy on-premises Cisco ASA firewall. The on-premises firewall uses static cryptographic access lists to define IPsec traffic between local subnet 192.168.10.0/24 and Azure subnet 10.200.0.0/16. Phase 1 IKE negotiation succeeds, but Phase 2 IPsec tunnel negotiation fails immediately with a traffic selector mismatch error. What configuration change resolves this issue?
An architect is evaluating failover convergence between Active-Standby and Active-Active Azure VPN Gateway topologies. The corporate network requires near-instantaneous, sub-second failover for mission-critical ERP traffic during an Azure platform host update. Which architecture fulfills this requirement?