3.1 Azure VPN Gateway Architecture & SKUs
Key Takeaways
The GatewaySubnet must be named exactly 'GatewaySubnet' and sized at /27 minimum (/26 strongly recommended for ExpressRoute co-existence and future IP growth).
Route-based VPN gateways use IKEv2 and Virtual Tunnel Interfaces (VTIs), supporting BGP, Point-to-Site, multi-site, and active-active topologies, whereas Policy-based gateways use IKEv1 static packet selectors limited to 1 tunnel.
Basic SKU is strictly legacy (100 Mbps, 10 S2S tunnels, no BGP, no zone redundancy, Gen1 only), while modern VpnGw1-5 (and VpnGw1AZ-5AZ) scale from 650 Mbps to 10 Gbps.
Active-Active gateway deployments require two dedicated Standard Public IP addresses and two active gateway instances, providing sub-second BGP failover and a 99.99% SLA when zone-redundant.
Never associate a Network Security Group (NSG) or User-Defined Route (UDR) with a 0.0.0.0/0 next-hop Internet blackhole to the GatewaySubnet, as doing so breaks Azure control plane health probes (ports 65503-65534).
Azure VPN Gateway is a specialized type of virtual network gateway that transmits encrypted cross-premises traffic across the public internet between an Azure Virtual Network (VNet) and on-premises physical locations, remote workers, or other VNets. For the AZ-700 exam, network engineers must master the underlying infrastructure prerequisites, sizing rules, SKU performance boundaries, and resiliency topologies.
1. GatewaySubnet Architecture & Operational Constraints
Every Azure VPN Gateway requires a dedicated subnet within the host Virtual Network named exactly GatewaySubnet. This subnet hosts the virtual machine instances running Azure's internal gateway routing software.
Subnet Sizing Guidelines
| Subnet Prefix | Usable Azure IPs | Recommendation Status | Architecture Context |
|---|---|---|---|
| /29 | 3 usable IPs (8 total - 5 reserved) | Do Not Use | Bare minimum for single Basic gateway. Cannot support upgrades, maintenance instances, or co-existing ExpressRoute gateways. |
| /28 | 11 usable IPs (16 total - 5 reserved) | Not Recommended | Minimal operational headroom. Insufficient for future multi-gateway architectures or dual-stack IPv4/IPv6 gateways. |
| /27 | 27 usable IPs (32 total - 5 reserved) | Minimum Recommended | Baseline Microsoft requirement for production deployments. Accommodates maintenance VM scaling and transient IP allocation. |
| /26 | 59 usable IPs (64 total - 5 reserved) | Best Practice | Strongly recommended. Provides full operational capacity for co-existing VPN and ExpressRoute gateways, Active-Active dual-IP configurations, and future platform feature expansions. |
+-----------------------------------------------------------------------------------------+
| Virtual Network (10.100.0.0/16) |
| |
| +-----------------------------------------------------------------------------------+ |
| | GatewaySubnet (10.100.255.0/26 - 64 IPs) | |
| | | |
| | +----------------------------------+ +-------------------------------------+ | |
| | | VPN Gateway Instance 0 | | VPN Gateway Instance 1 | | |
| | | Private IP: 10.100.255.4 | | Private IP: 10.100.255.5 | | |
| | | Public IP: PIP-1 (20.50.10.1) | | Public IP: PIP-2 (20.50.10.2) | | |
| | +----------------------------------+ +-------------------------------------+ | |
| | | |
| | +-----------------------------------------------------------------------------+ | |
| | | Maintenance Spare / ExpressRoute Co-existence Allocation Pool (50+ Free IPs)| | |
| | +-----------------------------------------------------------------------------+ | |
| +-----------------------------------------------------------------------------------+ |
| |
| +-------------------------------------+ +----------------------------------------+ |
| | Workload Subnet A (10.100.1.0/24) | | Workload Subnet B (10.100.2.0/24) | |
| +-------------------------------------+ +----------------------------------------+ |
+-----------------------------------------------------------------------------------------+
Mandatory GatewaySubnet Constraints
- Subnet Name: Must be verbatim
GatewaySubnet. Any variation (e.g.,gatewaysubnetin some legacy APIs orGateway-Subnet) will prevent gateway deployment. - No User Workloads: You cannot deploy standard virtual machines, container instances, or application load balancers inside
GatewaySubnet. - Network Security Groups (NSGs): Never associate an NSG with the GatewaySubnet. Blocking inbound traffic on control plane ports (TCP 65503-65534) or blocking
AzureLoadBalancerhealth probes breaks internal platform management and causes gateway state to transition toDegradedorFailed. - User-Defined Routes (UDRs): Do not attach a UDR to
GatewaySubnetwith a default route (0.0.0.0/0) pointing to a Network Virtual Appliance (NVA) unless you explicitly configure targeted UDRs that preserve Azure management plane endpoints. Otherwise, the gateway loses connectivity to Azure infrastructure controllers.
2. Gateway Types: Route-Based vs. Policy-Based
Azure supports two fundamental gateway routing paradigms. Choosing the correct type is critical because changing gateway types requires deleting and recreating the gateway resource.
Comparison of Routing Paradigms
| Capability | Route-Based VPN Gateway | Policy-Based VPN Gateway | | :--- | :--- | :--- | | | Routing Protocol / Method | Dynamic IPsec Virtual Tunnel Interface (VTI) / Any-to-Any | Static Access Control Lists (ACLs) / Packet Selectors | | IKE Version Support | IKEv2 (IKEv1 supported for legacy connections) | IKEv1 only | | S2S Connection Scale | Up to 30 or 128 tunnels (depending on SKU) | Exactly 1 Site-to-Site tunnel | | Point-to-Site (P2S) Support | Yes (OpenVPN, IKEv2, SSTP up to 10,000 clients) | No (Not supported) | | Dynamic BGP Routing | Yes (eBGP via ASN and BGP peering IPs) | No (Static prefixes only) | | VNet-to-VNet Connectivity | Yes (Multi-VNet mesh and transit routing) | Only 1 static VNet-to-VNet connection | | Active-Active Deployment | Yes | No | | Supported SKUs | VpnGw1-5, VpnGw1AZ-5AZ, Basic | Basic SKU only |
Traffic Selectors and Interoperability
Many legacy on-premises firewalls (such as older Cisco ASA models or policy-based Check Point appliances) define IPsec tunnels based on specific source/destination subnet pairs (e.g., 192.168.1.0/24 <-> 10.100.1.0/24).
By default, Azure Route-Based gateways negotiate wildcard traffic selectors (0.0.0.0/0 <-> 0.0.0.0/0). When connecting a Route-Based Azure VPN Gateway to a policy-based on-premises firewall, you must enable UsePolicyBasedTrafficSelectors (-UsePolicyBasedTrafficSelectors $True in PowerShell) on the Azure Connection resource. This causes Azure to dynamically generate and negotiate individual policy-based traffic selectors matching the prefix combinations defined in the Local Network Gateway and VNet address spaces.
3. Azure VPN Gateway SKUs & Generation Architectures
Microsoft categorizes VPN Gateways across Generation 1 and Generation 2 virtual hardware architectures, delivering distinct throughput, tunnel capacity, and zone-redundancy capabilities.
SKU Matrix & Performance Specifications
| SKU Name | Hardware Generation | Max Aggregate Throughput | Max S2S Tunnels | Max P2S Tunnels | BGP Support | Zone Redundancy |
|---|---|---|---|---|---|---|
| Basic | Gen 1 | 100 Mbps | 10 | 128 (SSTP only) | No | No (Regional only) |
| VpnGw1 | Gen 1 / Gen 2 | 650 Mbps | 30 | 250 | Yes | No |
| VpnGw1AZ | Gen 1 / Gen 2 | 650 Mbps | 30 | 250 | Yes | Yes (Zone-Redundant) |
| VpnGw2 | Gen 1 (1 Gbps) / Gen 2 (1.25 Gbps) | 1.0 - 1.25 Gbps | 30 | 500 | Yes | No |
| VpnGw2AZ | Gen 1 (1 Gbps) / Gen 2 (1.25 Gbps) | 1.0 - 1.25 Gbps | 30 | 500 | Yes | Yes (Zone-Redundant) |
| VpnGw3 | Gen 1 (1.25 Gbps) / Gen 2 (2.5 Gbps) | 1.25 - 2.5 Gbps | 30 | 1,000 | Yes | No |
| VpnGw3AZ | Gen 1 (1.25 Gbps) / Gen 2 (2.5 Gbps) | 1.25 - 2.5 Gbps | 30 | 1,000 | Yes | Yes (Zone-Redundant) |
| VpnGw4 | Gen 2 Only | 5.0 Gbps | 30 (128 with vWAN) | 5,000 | Yes | No |
| VpnGw4AZ | Gen 2 Only | 5.0 Gbps | 30 (128 with vWAN) | 5,000 | Yes | Yes (Zone-Redundant) |
| VpnGw5 | Gen 2 Only | 10.0 Gbps | 30 (128 with vWAN) | 10,000 | Yes | No |
| VpnGw5AZ | Gen 2 Only | 10.0 Gbps | 30 (128 with vWAN) | 10,000 | Yes | Yes (Zone-Redundant) |
Generation 1 vs. Generation 2 Differences
- Generation 1 SKUs: Built on legacy hypervisor sizes. Support Basic, VpnGw1, VpnGw2, and VpnGw3. Throughput caps out at 1.25 Gbps.
- Generation 2 SKUs: Deployed on modern Azure compute platforms with accelerated cryptographic offloading. Gen 2 unlocks higher throughput for VpnGw2 (1.25 Gbps) and VpnGw3 (2.5 Gbps), and introduces high-capacity tiers VpnGw4 (5 Gbps) and VpnGw5 (10 Gbps).
Important
Resizing vs. Redeploying: You can resize within the same generation (e.g., VpnGw1 to VpnGw3 within Gen 1) with minimal transient downtime. However, you cannot resize across generations (e.g., from VpnGw1 Gen 1 to VpnGw4 Gen 2) or from the Basic SKU to any VpnGw SKU. Crossing generation boundaries or upgrading from Basic requires deleting the gateway and creating a new one.
4. High Availability: Active-Standby vs. Active-Active Topologies
To ensure enterprise-grade continuity, Azure VPN Gateway supports two primary deployment topologies:
+-------------------------------------------------------------------------------------------------+
| ACTIVE-STANDBY TOPOLOGY (Single PIP) |
| |
| +------------------------------------+ |
| | Azure Gateway Instance 0 (ACTIVE) | <======== Active S2S IPsec Tunnel ========> +--------+ |
| +------------------------------------+ | On-Prem| |
| | (Standby) | Device | |
| +------------------------------------+ | | |
| | Azure Gateway Instance 1 (STANDBY) | . . . . . Standby Path (No Traffic) . . . . +--------+ |
| +------------------------------------+ |
| * Convergence Time: 30-90 seconds during failover. Single Public IP. |
+-------------------------------------------------------------------------------------------------+
+-------------------------------------------------------------------------------------------------+
| ACTIVE-ACTIVE TOPOLOGY (Dual PIPs) |
| |
| +------------------------------------+ <======== Active Tunnel 1 (BGP/ECMP) ======> +--------+ |
| | Azure Gateway Instance 0 (PIP-1) | <======== Active Tunnel 2 (BGP/ECMP) ======> | On-Prem| |
| +------------------------------------+ | Router1| |
| +--------+ |
| +------------------------------------+ <======== Active Tunnel 3 (BGP/ECMP) ======> +--------+ |
| | Azure Gateway Instance 1 (PIP-2) | <======== Active Tunnel 4 (BGP/ECMP) ======> | On-Prem| |
| +------------------------------------+ | Router2| |
| * Convergence Time: Sub-second with BGP keepalive/hold timers. Dual Public IPs. +--------+ |
+-------------------------------------------------------------------------------------------------+
1. Active-Standby Mode
- Mechanics: Azure provisions two gateway instances behind a single Public IP address. Instance 0 serves all active traffic. Instance 1 remains idle in hot standby.
- Failover Behavior: If Instance 0 experiences planned maintenance or unplanned hardware failure, Instance 1 assumes the active role and Public IP.
- Downtime / Convergence: Tunnel reconnection typically takes 30 to 90 seconds. BGP sessions drop and re-establish.
- SLA: 99.9% for regional SKUs; 99.95% for Zone-Redundant (
AZ) SKUs.
2. Active-Active Mode
- Mechanics: Both gateway instances are active simultaneously. Each instance is assigned a unique, dedicated Standard Public IP address (
PIP-1andPIP-2). - Connectivity: On-premises routers establish independent IPsec tunnels to both Azure Public IPs. When combined with dynamic BGP routing, both tunnels actively forward packets simultaneously using Equal-Cost Multi-Path (ECMP).
- High Availability: If one Azure gateway instance or on-premises tunnel fails, traffic immediately redirects through the remaining active tunnel with sub-second convergence driven by BGP neighbor timers.
- SLA: Reaches 99.99% availability when configured with dual on-premises customer edge devices across diverse ISP circuits and deployed using Zone-Redundant (
VpnGw#AZ) SKUs.
5. Architectural Comparison Matrix
| Feature | Active-Standby (Single PIP) | Active-Active (Dual PIPs) |
|---|---|---|
| Public IP Addresses | 1 Standard Public IP | 2 Standard Public IPs |
| Gateway Subnet IPs | 2 private IPs allocated | 2 private IPs allocated |
| Tunnel Throughput | Limited to single instance bandwidth | Aggregated across both instances with ECMP |
| BGP Support | Optional (Static or BGP) | Highly Recommended (Mandatory for multi-path failover) |
| Failover Convergence | 30 - 90 seconds | Sub-second (via BGP dampening/hold-down timers) |
| Supported On-Prem Topologies | Single Device / Single Link | Dual Devices / Dual ISP Links (Full Mesh 4-Tunnel) |
| Azure SLA | 99.9% (99.95% AZ) | 99.99% (with dual on-prem edge + AZ SKU) |
An enterprise is designing hybrid connectivity to connect an on-premises datacenter to an Azure Virtual Network. The solution requires an aggregate encrypted throughput of 3.8 Gbps, support for 3,500 concurrent Point-to-Site mobile clients, and resilience against datacenter-level outages within the Azure region. Which VPN Gateway SKU and subnet configuration must the network engineer select?
Deploy a VpnGw4AZ SKU within a dedicated GatewaySubnet sized at /26.
Deploy a VpnGw3 SKU Generation 1 within a dedicated GatewaySubnet sized at /29.
Deploy a VpnGw2AZ SKU Generation 2 within a dedicated GatewaySubnet sized at /28.
Deploy a Basic SKU in Active-Active mode within a dedicated GatewaySubnet sized at /27.
A network engineer deploys an Azure Route-Based VPN Gateway to connect to a legacy on-premises Cisco ASA firewall. The on-premises firewall uses static cryptographic access lists to define IPsec traffic between local subnet 192.168.10.0/24 and Azure subnet 10.200.0.0/16. Phase 1 IKE negotiation succeeds, but Phase 2 IPsec tunnel negotiation fails immediately with a traffic selector mismatch error. What configuration change resolves this issue?
Recreate the Azure Virtual Network Gateway as a Policy-Based Basic SKU gateway.
Enable UsePolicyBasedTrafficSelectors on the Azure VPN Connection resource.
Associate a Network Security Group with the GatewaySubnet to permit IPsec port 500 and 4500.
Change the on-premises Cisco ASA configuration to accept wildcard 0.0.0.0/0 traffic selectors on IKEv1.
An architect is evaluating failover convergence between Active-Standby and Active-Active Azure VPN Gateway topologies. The corporate network requires near-instantaneous, sub-second failover for mission-critical ERP traffic during an Azure platform host update. Which architecture fulfills this requirement?
Active-Standby VPN Gateway with static routing and dead peer detection (DPD) aggressive timers.
Basic SKU VPN Gateway deployed across two distinct Azure availability zones.
Active-Active VPN Gateway with dual Standard Public IPs, redundant customer edge routers, and dynamic BGP peering.
Active-Standby VPN Gateway with a single Standard Public IP and a secondary passive tunnel configured in the Local Network Gateway.
Sections you finish are checked off in the contents.