Connect on-premises networks to Azure

Azure can connect to on-premises networks by various methods and one of them is using site-to-site VPN gateways. In this article, we will discuss major 5 topics to set up a site-to-site VPN gateway.

1. VPN type
2. VPN gateway sizes
3. Required Azure Resources
4. Required on-premises resources
5. High availability scenarios

VPN Gateway

A virtual private network (VPN) is a type of private interconnected network. VPNs use an encrypted tunnel within another network. They’re typically deployed to connect two or more trusted private networks to one another over an untrusted network (typically the public Internet). Traffic is encrypted while traveling over the untrusted network to prevent eavesdropping or other attacks.

VPN gateways are deployed in Azure virtual networks and enable the following connectivity:

• Connect on-premises datacentres to Azure virtual networks through a site-to-site connection.
• Connect individual devices to Azure virtual networks through a point-to-site connection.
• Connect Azure virtual networks to other Azure virtual networks through a network-to-network connection.

VPN type

When you deploy a VPN gateway, you specify the VPN type, It can be either policy-based or route-based. The main difference between these two types of VPNs is how traffic to be encrypted is specified.

1. Policy-based VPNs: 
   • Support for IKEv1 only.
   • Use of static routing, where combinations of address prefixes from both networks control how traffic is encrypted and decrypted through the VPN tunnel. The source and destination of the tunnelled networks are declared in the policy and don’t need to be declared in routing tables.
   • Policy-based VPNs must be used in specific scenarios that require them, such as for compatibility with legacy on-premises VPN devices.
2. Route-based VPNs:
   • Supports IKEv2.
   • Uses any-to-any (wildcard) traffic selectors.
   • Can use dynamic routing protocols, where routing/forwarding tables direct traffic to different IPSec tunnels. In this case, the source and destination networks are not statically defined as they are in policy-based VPNs or even in route-based VPNs with static routing. Instead, data packets are encrypted based on network routing tables that are created dynamically using routing protocols such as BGP (Border Gateway Protocol).                                                             

“Both types of VPN gateways (route-based and policy-based) in Azure use a pre-shared key as the only method of authentication. Both types also rely on Internet Key Exchange (IKE) in either version 1 or version 2 and Internet Protocol Security (IPSec). IKE is used to set up a security association (an agreement of the encryption) between two endpoints. This association is then passed to the IPSec suite, which encrypts and decrypts data packets encapsulated in the VPN tunnel.”             

VPN gateway sizes

The SKU or size that you deploy, determines the capabilities of your VPN gateway. The below table shows an example of gateway SKUs. 

“The Basic gateway SKU should only be used for Dev/Test workloads. In addition, it’s unsupported to migrate from Basic to any VpnGw#/Az sku at a later time without having to remove the gateway and redeploy.”

Deploy VPN gateways

Before you can deploy a VPN gateway, you’ll need some Azure and on-premises resources.

Required Azure resources

You’ll need these Azure resources before you can deploy an operational VPN gateway:

• Virtual network- Deploy an Azure virtual network with enough address space for the additional subnet that you’ll need for the VPN gateway. The address space for this virtual network must not overlap with the on-premises network that you’ll be connecting to. Remember that you can deploy only one VPN gateway within a virtual network.
• Gateway Subnet- Deploy a subnet called Gateway Subnet for the VPN gateway. Use at least a /27 address mask to make sure you have enough IP addresses in the subnet for future growth. You can’t use this subnet for any other services.
• Public IP address– Create a Basic-SKU dynamic public IP address if using a non-zone-aware gateway. This address provides a public-routable IP address as the target for your on-premises VPN device. This IP address is dynamic, but it won’t change unless you delete and re-create the VPN gateway.
• Local network gateway- Create a local network gateway to define the on-premises network’s configuration: where the VPN gateway will connect and what it will connect to. This configuration includes the on-premises VPN device’s public IPv4 address and the on-premises routable networks. This information is used by the VPN gateway to route packets that are destined for on-premises networks through the IPSec tunnel.
• Virtual network gateway- Create the virtual network gateway to route traffic between the virtual network and the on-premises data center or other virtual networks. The virtual network gateway can be either configured as a VPN gateway or an ExpressRoute gateway, but this module deals only with VPN virtual network gateways.
• Connection- Create a Connection resource to create a logical connection between the VPN gateway and the local network gateway. You can create multiple connections to the same gateway.
• The connection is made to the on-premises VPN device’s IPv4 address as defined by the local network gateway.
• The connection is made from the virtual network gateway and its associated public IP address.          

Required on-premises resources

To connect your data canter to a VPN gateway, you’ll need these on-premises resources:

• A VPN device that supports policy-based or route-based VPN gateways
• A public-facing (internet-routable) IPv4 address        

High availability scenarios

There are several ways to ensure you have a fault-tolerant configuration.         

• Active/standby-

By default, VPN gateways are deployed as two instances in an active/standby configuration, even if you only see one VPN gateway resource in Azure. When planned maintenance or unplanned disruption affects the active instance, the standby instance automatically assumes responsibility for connections without any user intervention. Connections are interrupted during this failover, but they’re typically restored within a few seconds for planned maintenance and within 90 seconds for unplanned disruptions.

• Active/active-

With the introduction of support for the BGP routing protocol, you can also deploy VPN gateways in an active/active configuration. In this configuration, you assign a unique public IP address to each instance. You then create separate tunnels from the on-premises device to each IP address. You can extend the high availability by deploying another VPN device on-premises.

• ExpressRoute failover-

Another high-availability option is to configure a VPN gateway as a secure failover path for ExpressRoute connections. ExpressRoute circuits have resiliency built in but aren’t immune to physical problems that affect the cables delivering connectivity or outages affecting the complete ExpressRoute location. In high availability scenarios, where there’s risk associated with an outage of an ExpressRoute circuit, you can also configure a VPN gateway that uses the internet as an alternative method of connectivity, thus ensuring there’s always a connection to the Azure virtual networks.

• Zone-redundant gateways-

In regions that support availability zones, VPN and ExpressRoute gateways can be deployed in a zone-redundant configuration. This configuration brings resiliency, scalability, and higher availability to virtual network gateways. Deploying gateways in Azure Availability Zones physically and logically separates gateways within a region while protecting your on-premises network connectivity to Azure from zone-level failures. These require different gateway SKUs and use Standard public IP addresses instead of Basic public IP addresses.

Reference: Microsoft