Eager to master hybrid server management? Discover how to administer Windows Server Hybrid Core Infrastructure on Azure, setting your path towards the Microsoft Certified: Azure Hybrid Infrastructure Administrator Associate certification!
Gauge your current knowledge
Gauge your current knowledge
To connect an on-premises network to an Azure virtual network securely, you must first deploy an Azure VPN gateway within your virtual network. This gateway sits in its own dedicated gateway subnet and handles the encrypted traffic flowing across the public internet. If you have an ExpressRoute circuit set up for private peering, you can combine it with your VPN gateway to create a secure, redundant backup path. To complete the connection on the cloud side, you must define a local network gateway in Azure. This resource represents your physical on-premises VPN device and stores its public IP address and the local IP address spaces that need to reach the cloud.
Once the gateways are configured, you create a virtual site-to-site connection to link them together. During this setup, you define a shared key that both the Azure gateway and your physical on-premises device use to establish a secure IPsec/IKE tunnel. You can configure multiple tunnels to increase throughput and build network redundancy in case one path fails. For traffic routing, you can use static routes or enable Border Gateway Protocol (BGP) to dynamically exchange routing information between networks. When BGP is enabled, the gateway advertises specific prefixes to prioritize the encrypted VPN path over your ExpressRoute connection for certain data flows.
Before sending production traffic, you must verify that there are no overlapping IP ranges between your on-premises network and your Azure virtual networks, as overlaps cause routing failures. You should also configure routing filters to force specific traffic paths, keeping sensitive data inside the encrypted VPN tunnel. To confirm everything works, use Azure diagnostics and other monitoring tools to track BGP sessions and IPsec tunnel health in the Azure portal. These tools help you validate that network traffic flows properly, routing tables converge, and keys remain synchronized over time.
StudyCerts
StudyCerts