Azure AI Engineer

Azure Administrator

Azure Solutions Architect Expert

Azure Fundamentals

Azure Security Engineer

Azure Network Engineer Associate

<p>Start writing your course overview...</p>

Learn the fundamentals of what you need to know for the AZ-104 networking questions during your exam.

AZ-104 Networking Crash Course

IP Addresses

Network Address Space & Subnets

Route Tables and User Defined Routes (UDRs)

Network Security Groups (NSGs)

Application Security Groups (ASGs)

Peering

Azure VPN Gateway

Azure ExpressRoute

Azure Load Balancer

Azure Application Gateway

<h2>What is Azure VPN Gateway?</h2><img class="tiptap-image" src="https://zta-storage.s3.eu-north-1.amazonaws.com/courses/azure-virtual-networking/lesson-7/001-vpn-gateway-connection.png" alt="VPN Gateway Connection"><p>Azure VPN Gateway is a managed service that lets you create secure, encrypted connections between Azure and other networks over the public internet. It’s one of the main tools used to build a <strong>hybrid cloud</strong> system and <strong>remote access</strong> to Azure environments.</p><p>You can think of Azure VPN Gateway as a secure bridge between your Azure Virtual Network and another network, such as your on-premises data center or an employee’s laptop.</p><p>It uses IPsec and IKE protocols to <strong>encrypt</strong> network traffic through the internet, so that the data is protected from being intercepted or altered.</p><div data-callout-type="exam-insight" data-content="&lt;p&gt;If you’re asked about what Azure VPN Gateway uses to encrypt the network traffic, do not choose HTTPS or SSL, as those are common traps. The current option is &lt;strong&gt;IPsec/IKE&lt;/strong&gt;.&lt;/p&gt;" data-type="callout" data-title="" class="callout-component" style="margin: 1rem 0px; padding: 1rem; border-radius: 0.5rem; border-left: 4px solid;"><div class="callout-header" style="font-weight: 600; margin-bottom: 0.5rem;">💡 Exam Insight</div><div class="callout-content">&lt;p&gt;If you’re asked about what Azure VPN Gateway uses to encrypt the network traffic, do not choose HTTPS or SSL, as those are common traps. The current option is &lt;strong&gt;IPsec/IKE&lt;/strong&gt;.&lt;/p&gt;</div></div><h2>Connection Types</h2><img class="tiptap-image" src="https://zta-storage.s3.eu-north-1.amazonaws.com/courses/azure-virtual-networking/lesson-7/002-connection-types.png" alt="Connection Types"><p>There are three connection types you need to know for the AZ-104 exam.</p><p><strong>Site-to-Site (S2S)</strong> connects your on-premises network to an Azure Virtual Network. This is used when you want to set up a permanent or semi-permanent connection between your corporate network and Azure.</p><p><strong>Point-to-Site (P2S)</strong> connects individual devices, like employee laptops, directly to Azure. It’s a common set up for remote employees that need secure access to an Azure Virtual Network.</p><p><strong>VNet-to-VNet</strong> connects two Azure Virtual Networks over the public internet, while encrypting the communication between them.</p><div data-callout-type="exam-insight" data-content="&lt;p&gt;If you see a question worded as “You need allow developers to connect from their personal laptops to resources in Azure”, then Azure VPN Gateway &lt;strong&gt;Point-to-Site&lt;/strong&gt; is the answer.&lt;/p&gt;" data-type="callout" data-title="" class="callout-component" style="margin: 1rem 0px; padding: 1rem; border-radius: 0.5rem; border-left: 4px solid;"><div class="callout-header" style="font-weight: 600; margin-bottom: 0.5rem;">💡 Exam Insight</div><div class="callout-content">&lt;p&gt;If you see a question worded as “You need allow developers to connect from their personal laptops to resources in Azure”, then Azure VPN Gateway &lt;strong&gt;Point-to-Site&lt;/strong&gt; is the answer.&lt;/p&gt;</div></div><h2>How do you deploy a VPN Gateway?</h2><img class="tiptap-image" src="https://zta-storage.s3.eu-north-1.amazonaws.com/courses/azure-virtual-networking/lesson-7/003-gateway-subnet.png" alt="Gateway Subnet"><p>To deploy a VPN Gateway, first you need to create a subnet named <strong>GatewaySubnet</strong> inside your Virtual Network. This subnet is reserved for gateway resources only (VPN Gateway, ExpressRoute Gateway), and should not contain any Virtual Machines or other services.</p><p>After the VPN Gateway is deployed, you need to configure a connection to another VPN endpoint. This can be an on-premises router, another VPN Gateway, or a VPN Client on an employee’s device.</p><p>When the connection is active, Azure will route network traffic through the encrypted network for any destination network you defined in the VPN Gateway configuration.</p><p>For example, if your corporate network uses <code>192.168.0.0/24</code> and your Azure Virtual Network uses <code>10.0.0.0/16</code>, you can set up a Site-to-Site (S2S) tunnel so that both environments can communicate. The employees from the on-premises office will be able to access the VMs in Azure through an encrypted tunnel over the public internet.</p><div data-callout-type="exam-insight" data-content="&lt;p&gt;If you encounter a question asking how to configure VPN Gateway, make sure to include the option that mentions “Create a subnet named &lt;strong&gt;GatewaySubnet &lt;/strong&gt;within the Virtual Network”.&lt;/p&gt;" data-type="callout" data-title="" class="callout-component" style="margin: 1rem 0px; padding: 1rem; border-radius: 0.5rem; border-left: 4px solid;"><div class="callout-header" style="font-weight: 600; margin-bottom: 0.5rem;">💡 Exam Insight</div><div class="callout-content">&lt;p&gt;If you encounter a question asking how to configure VPN Gateway, make sure to include the option that mentions “Create a subnet named &lt;strong&gt;GatewaySubnet &lt;/strong&gt;within the Virtual Network”.&lt;/p&gt;</div></div><h2>VPN Gateway vs Peering</h2><img class="tiptap-image" src="https://zta-storage.s3.eu-north-1.amazonaws.com/courses/azure-virtual-networking/lesson-7/004-vpn-gateway-vs-peering.png" alt="VPN Gateway vs Peering"><p>A common point of confusion in Azure Networking is the difference between a VPN Gateway and peering.</p><p>In a way, both allow different networks to communicate, but the way in which they do it is fundamentally different.</p><p>Below you can find a table describing the main differences between them. It primarily comes down to which type of networks they connect (on-premises or Azure), and if traffic goes through the public internet.</p><table class="tiptap-table" style="min-width: 300px;"><colgroup><col style="min-width: 100px;"><col style="min-width: 100px;"><col style="min-width: 100px;"></colgroup><tbody><tr class="tiptap-table-row"><th class="tiptap-table-header" colspan="1" rowspan="1"><p>Feature</p></th><th class="tiptap-table-header" colspan="1" rowspan="1"><p>VPN Gateway</p></th><th class="tiptap-table-header" colspan="1" rowspan="1"><p>Peering</p></th></tr><tr class="tiptap-table-row"><td class="tiptap-table-cell" colspan="1" rowspan="1"><p>Main use case</p></td><td class="tiptap-table-cell" colspan="1" rowspan="1"><p>Connect Azure networks to external networks (like on-premises ones, or remote users)</p></td><td class="tiptap-table-cell" colspan="1" rowspan="1"><p>Connect two Azure networks together</p></td></tr><tr class="tiptap-table-row"><td class="tiptap-table-cell" colspan="1" rowspan="1"><p>Networking Route</p></td><td class="tiptap-table-cell" colspan="1" rowspan="1"><p>Network traffic goes through the public internet, but it’s <strong>encrypted</strong></p></td><td class="tiptap-table-cell" colspan="1" rowspan="1"><p>Network traffic goes through Microsoft’s backbone network</p></td></tr><tr class="tiptap-table-row"><td class="tiptap-table-cell" colspan="1" rowspan="1"><p>Performance</p></td><td class="tiptap-table-cell" colspan="1" rowspan="1"><p>Network speed depends on internet quality</p></td><td class="tiptap-table-cell" colspan="1" rowspan="1"><p>Independent of internet quality, it’s a high bandwidth, low latency connection</p></td></tr></tbody></table><p>As a rule of thumb, use peering to connect two networks that are both inside Azure, under the same tenant. If one of them is on-premises, use VPN Gateway.</p><div data-callout-type="exam-insight" data-content="&lt;p&gt;If the exam question contains key words such as “&lt;strong&gt;on-premises&lt;/strong&gt;”, “&lt;strong&gt;branch office&lt;/strong&gt;”, “&lt;strong&gt;remote user&lt;/strong&gt;” or “&lt;strong&gt;public internet&lt;/strong&gt;”, then it’s most likely a VPN Gateway question.&lt;/p&gt;" data-type="callout" data-title="" class="callout-component" style="margin: 1rem 0px; padding: 1rem; border-radius: 0.5rem; border-left: 4px solid;"><div class="callout-header" style="font-weight: 600; margin-bottom: 0.5rem;">💡 Exam Insight</div><div class="callout-content">&lt;p&gt;If the exam question contains key words such as “&lt;strong&gt;on-premises&lt;/strong&gt;”, “&lt;strong&gt;branch office&lt;/strong&gt;”, “&lt;strong&gt;remote user&lt;/strong&gt;” or “&lt;strong&gt;public internet&lt;/strong&gt;”, then it’s most likely a VPN Gateway question.&lt;/p&gt;</div></div><h2>What to remember for your exam</h2><ul><li><p>Azure VPN Gateway is used to connect external networks through encrypted tunnels over the public internet.</p></li><li><p>It’s one of the primary tools to build a hybrid cloud with secure remote access.</p></li><li><p>It uses IPsec/IKE protocols for security.</p></li><li><p>VPN Gateway is always deployed inside a subnet named GatewaySubnet.</p></li><li><p>It supports Site-to-Site (S2S), Point-to-Site (P2S), and VNet-to-VNet connection types.</p></li><li><p>It’s different from peering, as network traffic that goes through a peering connection travels through the Microsoft backbone network rather than the public internet, and it’s not encrypted.</p></li></ul><h2>What’s next?</h2><p>To lock in what you’ve learned, take the short <strong>8-question quiz</strong> for this lesson. It will help you test your understanding of <strong>Azure VPN Gateway</strong> before you move on.</p><p>In the next lesson, you will learn how to create a <strong>private, dedicated</strong> connection between your on-premises network and an Azure Virtual Network using <strong>Azure ExpressRoute</strong>.</p><p></p>

Azure VPN Gateway

Alexandru Tepes

Practice Quiz

Want to pass your next certification?

Azure AI Engineer

Azure Administrator

Azure Solutions Architect

Azure Fundamentals

Azure Security Engineer

Azure Network Engineer

Want to connect with others?

Join Our Discord Community

Active Discussions

Study Groups

Celebrate Wins