What is Azure VPN Gateway?
Azure VPN Gateway is a managed service for encrypted network connections between Azure Virtual Networks and other networks. The service supports Site-to-Site VPN for connecting on-premises data centers, Point-to-Site VPN for remote workers, and VNet-to-VNet connections between Azure regions. All connections are encrypted with IPsec/IKE.
VPN Gateway is the cost-effective alternative to ExpressRoute for hybrid cloud scenarios when a dedicated private connection is not required.
Important for new deployments: since November 2025, new gateways can no longer be created on the classic, non-zone-redundant SKUs (VpnGw1 through VpnGw5). Microsoft recommends the zone-redundant SKUs (VpnGw1AZ through VpnGw5AZ) for all new deployments; existing gateways on the older SKUs are being migrated to the AZ SKUs by September 2026.
Key Features
- Site-to-Site VPN: IPsec/IKE tunnels to on-premises VPN devices, with throughput ranging from roughly 100 Mbps (Basic) up to several Gbps on the largest AZ SKUs
- Point-to-Site VPN: Remote access for individual clients via OpenVPN, IKEv2, or SSTP
- VNet-to-VNet: Encrypted connections between Azure VNets in different regions
- Active-Active: Highly available configuration with two gateway instances and BGP support
- Zone-redundant: Deployment across Availability Zones for higher availability on the AZ SKUs (VpnGw1AZ-VpnGw5AZ)
Typical Use Cases
Hybrid Cloud Connectivity: Secure connection between an on-premises data center and Azure VNets for accessing cloud workloads.
Remote Workers: Point-to-Site VPN for developers and administrators who need to access Azure resources.
Disaster Recovery: VNet-to-VNet connections between Azure regions for replication and failover scenarios.
Benefits
- Cost-effective: Cheaper than ExpressRoute for moderate bandwidth requirements
- Managed: No need to operate your own VPN hardware; Microsoft handles maintenance and patching
- Broad Compatibility: Support for common VPN devices from Cisco, Fortinet, Palo Alto, and other vendors
- Encrypted: All connections secured with IPsec/IKE by default
Frequently Asked Questions about Azure VPN Gateway
Which gateway SKU do I need?
For new deployments, Microsoft recommends exclusively the zone-redundant SKUs VpnGw1AZ through VpnGw5AZ, which offer increasing bandwidth and Point-to-Site connection limits at higher tiers. The classic SKUs VpnGw1-5 (without AZ) can no longer be newly created since November 2025. The Basic SKU remains available for simple test scenarios but is not intended for production.
How many connections are possible?
Site-to-Site and VNet-to-VNet tunnels are limited to 30 (smaller SKUs) or up to 100 depending on the SKU; for more tunnels, Azure Virtual WAN is recommended. Point-to-Site supports a few hundred to several thousand concurrent client connections depending on the SKU.
What is the difference from ExpressRoute?
VPN Gateway uses encrypted connections over the public internet. ExpressRoute provides private, dedicated connections that typically offer higher bandwidth and lower latency, but is generally more expensive and requires a connectivity provider. Both services can be combined in a coexisting setup with VPN as a failover path for ExpressRoute.
Which VPN devices are supported?
Microsoft publishes validated configurations for devices from vendors including Cisco, Fortinet, Juniper, Palo Alto, Check Point, and Barracuda. In general, any IKEv2/IPsec-compatible device can be used.
What does Azure VPN Gateway cost?
Costs consist of an hourly charge for the chosen gateway SKU plus charges for outbound data transfer. Traffic between VNets in the same region is free; traffic to on-premises or to other regions is billed at standard egress rates. Current prices are available on the official pricing page.
Integration with innFactory
As a Microsoft Solutions Partner, innFactory supports you with Azure VPN Gateway: from hybrid architecture design to selecting the right (zone-redundant) gateway SKU to implementing high-availability setups and migrating existing gateways to current SKUs.
Note: All product information on this page has been compiled with care, but is provided without guarantee and may be outdated or incomplete. Cloud services evolve rapidly — features, pricing, SLAs, and availability change frequently. Authoritative and up-to-date information can only be found on the official product page of Azure (official documentation). This page does not represent an offer by Azure.
