AZ-104

Deep Dive

D4 · Networking

VPN Gateway and ExpressRoute

Hybrid connectivity between Azure and on-premises or remote environments. The AZ-104 evaluates when to use VPN Gateway vs ExpressRoute, VPN connection types, and basic configuration of each.

Contents

VPN Gateway — concepts
VPN types and SKUs
Site-to-Site (S2S)
Point-to-Site (P2S)
VNet-to-VNet
ExpressRoute
VPN Gateway vs ExpressRoute

VPN Gateway — concepts

A VPN Gateway is a type of Virtual Network Gateway that sends encrypted traffic between an Azure VNet and an on-premises location (or between VNets) over the internet using IPsec/IKE.

It is deployed in the VNet's GatewaySubnet. Only one VPN Gateway is allowed per VNet. Creation takes 25-45 minutes.

Required components

•GatewaySubnet in the VNet (minimum /27, /26 preferred)
•Virtual Network Gateway (the gateway resource in Azure)
•Public IP address assigned to the gateway
•Local Network Gateway (represents the on-premises side)
•Connection (links the VPN GW to the Local Network GW)

Local Network Gateway

•Azure resource that represents your on-premises network
•Contains: the public IP of the on-premises VPN device
•Contains: on-premises network IP ranges (CIDR)
•If using BGP: contains the ASN and the BGP peer IP
•Can be updated if the on-premises IP changes

VPN types

•Route-based (recommended): dynamic IKEv2 routes. Supports S2S, P2S, VNet-to-VNet, and coexistence with ExpressRoute.
•Policy-based (legacy): static IKEv1 routes. Supports S2S only. A single connection. For older VPN devices.

VPN Gateway SKUs

SKU	Throughput	S2S tunnels	P2S connections	BGP	Notes
Basic	100 Mbps	10	128	—	Dev/test only. No zone-redundancy support. Not recommended for prod.
VpnGw1	650 Mbps	30	250	✓	Small/medium production. Supports IKEv1/v2.
VpnGw2	1 Gbps	30	500	✓	Medium production.
VpnGw3	1.25 Gbps	30	1000	✓	High availability with many P2S connections.
VpnGw1AZ	650 Mbps	30	250	✓	Zone-redundant. 99.99% SLA. Recommended for critical production.
VpnGw2AZ / GW3AZ	1-1.25 Gbps	30	500-1000	✓	Zone-redundant + high capacity.

Site-to-Site (S2S)

S2S characteristics

• Connects the entire on-premises network to Azure via IPsec/IKE
• Requires an on-premises VPN device with a static public IP
• Encrypted traffic — travels over the public internet
• Bandwidth: up to 1.25 Gbps (limited by the gateway)
• Variable latency — depends on the internet connection
• Multiple S2S tunnels: up to 30 per gateway (depending on SKU)
• Supports Active-Active for high availability

High availability in VPN Gateway

Active-Standby (default)

Azure keeps two instances but only one is active. Failover in 10-15 sec (planned) or 60-90 sec (unplanned). No additional cost.

Active-Active

Both instances active simultaneously. Requires two public IPs and BGP. Higher throughput and faster failover. Requires two tunnels on the VPN device.

Point-to-Site (P2S)

Point-to-Site lets individual users (laptops, remote machines) connect to the Azure VNet via VPN from anywhere.

OpenVPN (TCP 443)

Compatible with clients on multiple platforms (Windows, macOS, Linux, Android, iOS). Uses port 443 — passes through most corporate firewalls.

SSTP (TCP 443)

Secure Socket Tunneling Protocol. Windows only. Uses TLS over TCP 443. Native on Windows — no extra client required.

IKEv2 (UDP 500/4500)

IKE version 2 standard. Fast reconnection (mobike). Natively supported on macOS/iOS. May be blocked by some firewalls (UDP).

P2S authentication

Certificates

Root certificates in Azure + client certificates. The most common option on the exam.

Azure AD / Entra ID

MFA included. Requires OpenVPN. Useful for users with Azure AD accounts.

RADIUS

Integration with an on-premises RADIUS server (Active Directory, NPS).

ExpressRoute

ExpressRoute provides dedicated private connectivity between Azure and your on-premises network through a connectivity provider (carrier). Traffic does NOT go through the internet — it travels over a private, reliable connection.

Characteristics

• Speeds from 50 Mbps up to 100 Gbps
• Predictable, consistent latency (not variable like the internet)
• No exposure to the internet — ideal for sensitive data
• 99.95% SLA (with redundancy) or 99.9%
• Access to all Azure services (not just VNets)
• ExpressRoute Global Reach: connect on-premises networks to each other via Azure

Peering models

Azure Private Peering

Connects your on-premises network to Azure VNets. For IaaS and PaaS in VNets.

Microsoft Peering

Connects to public Microsoft services (M365, Azure PaaS public endpoints) without going through the internet.

VPN Gateway vs ExpressRoute

Characteristic	VPN Gateway	ExpressRoute
Transport medium	Public internet (encrypted)	Dedicated private connection
Max speed	1.25 Gbps (per gateway)	Up to 100 Gbps
Latency	Variable — depends on the internet	Predictable and low — guaranteed SLA
Encryption	IPsec/IKE — always encrypted	Not encrypted by default (private, not internet). MACsec available.
SLA	99.9% (Active-Standby) / 99.99% (Zone-redundant)	99.95% (dual-circuit) / 99.9% (single)
Cost	Lower — pay per gateway + egress	Higher — dedicated circuit + provider
Provisioning time	25-45 min	Weeks (requires a connectivity provider)
Use case	Basic connectivity, dev/test, ER backup, home office	Massive data migration, critical workloads, regulatory compliance

VPN + ExpressRoute coexistence

It is possible to have both simultaneously: ExpressRoute as the primary channel and VPN as failover. This requires a Route-based VPN Gateway and an ExpressRoute Gateway in the same GatewaySubnet. If the ER circuit fails, traffic automatically fails over to the VPN.

Did you get this topic?

Test what you just learned

A company needs to connect its on-premises datacenter to Azure with 5 Gbps of guaranteed bandwidth, predictable low latency, and without the traffic going through the internet due to compliance requirements. Which solution is appropriate?

Ready to test "VPN Gateway and ExpressRoute"?

Put what you learned to the test with original AZ-104 exam questions.

Start AZ-104 mock exam

Unlimited mock exams with the Pro plan

PreviousLoad BalancingNetworking NextDNS and Name ResolutionNetworking