On-premises edge device
Cloud / Knowledge library
Azure VPN Gateway
Connects Azure virtual networks to on-premises or other networks using IPsec VPN
Why learn Azure VPN Gateway?
Teams use Azure VPN Gateway to adopt site-to-site cloud VPN without building the complete underlying platform themselves.
The problem it solves
Connects private networks to cloud virtual networks through encrypted tunnels
Where it came from
Azure VPN Gateway is Microsoft Azure's offering for site-to-site cloud VPN. Its closest catalog counterparts are AWS Site-to-Site VPN and Google Cloud VPN; they address the same broad need but are not feature-for-feature identical.
Build your understanding
Work through these exercises in order. Try the task before opening a reference.
- Explain the main responsibility of Azure VPN Gateway.
- Choose a workload that fits Azure VPN Gateway.
- Identify one operational tradeoff of Azure VPN Gateway.
- Compare Azure VPN Gateway with AWS Site-to-Site VPN.
- Compare Azure VPN Gateway with Google Cloud VPN.
Documentation and sources
- Microsoft Azure product catalog (azure.microsoft.com)
Connect the ideas
Alternatives
Real World Example
Secure Hybrid Connectivity for Branch Offices
Retail organizations requiring secure, encrypted communication between remote branch office local networks and centralized Azure Virtual Networks.
The business problem
Unencrypted traffic over the public internet exposes sensitive inventory and point-of-sale data to interception during transit between the branch and the cloud.
How this topic solves it
Azure VPN Gateway establishes a secure, encrypted IPsec/IKE tunnel over the public internet, ensuring that data traversing between the on-premises branch router and the Azure Virtual Network is encapsulated and authenticated.
- Create a Virtual Network Gateway in the Azure portal with the required VPN type and SKU.
- Configure a Local Network Gateway to represent the branch office's public IP address and address space.
- Define a Connection resource that links the Virtual Network Gateway to the Local Network Gateway using a shared key.
- Configure the on-premises VPN device to match the IPsec/IKE parameters defined in the Azure connection.
Shows the path of encrypted data between the branch office and Azure.
Unsecured transport layer
Azure entry point
Azure Virtual Network
- Branch Router → Encrypted IPsec Tunnel → Public Internet
- Public Internet → Encrypted IPsec Tunnel → VPN Gateway
- VPN Gateway → Internal Routing → VNet
Expected business outcome
The branch office gains a persistent, encrypted tunnel to the Azure environment, allowing internal applications to communicate as if they were on the same private network.
Limitations and checks
The VPN tunnel relies on the public internet, meaning throughput and latency are subject to variable internet congestion; verify performance using standard network diagnostic tools like ping or traceroute to monitor packet loss.