To connect an on-premises network to an Azure virtual network securely, you must first deploy an Azure VPN gateway within your virtual network. This gateway sits in its own dedicated gateway subnet and handles the encrypted traffic flowing across the public internet. If you have an ExpressRoute circuit set up for private peering, you can combine it with your VPN gateway to create a secure, redundant backup path. To complete the connection on the cloud side, you must define a local network gateway in Azure. This resource represents your physical on-premises VPN device and stores its public IP address and the local IP address spaces that need to reach the cloud.
Once the gateways are configured, you create a virtual site-to-site connection to link them together. During this setup, you define a shared key that both the Azure gateway and your physical on-premises device use to establish a secure IPsec/IKE tunnel. You can configure multiple tunnels to increase throughput and build network redundancy in case one path fails. For traffic routing, you can use static routes or enable Border Gateway Protocol (BGP) to dynamically exchange routing information between networks. When BGP is enabled, the gateway advertises specific prefixes to prioritize the encrypted VPN path over your ExpressRoute connection for certain data flows.
Before sending production traffic, you must verify that there are no overlapping IP ranges between your on-premises network and your Azure virtual networks, as overlaps cause routing failures. You should also configure routing filters to force specific traffic paths, keeping sensitive data inside the encrypted VPN tunnel. To confirm everything works, use Azure diagnostics and other monitoring tools to track BGP sessions and IPsec tunnel health in the Azure portal. These tools help you validate that network traffic flows properly, routing tables converge, and keys remain synchronized over time.
Eager to master hybrid server management? Discover how to administer Windows Server Hybrid Core Infrastructure on Azure, setting your path towards the Microsoft Certified: Azure Hybrid Infrastructure Administrator Associate certification!
Prepare and test your skills
Prepare and test your skills
An Azure VPN gateway is deployed in a dedicated gateway subnet inside your Azure virtual network and handles encrypted traffic across the public internet. A local network gateway represents your physical on-premises VPN device and stores its public IP address and the local IP address spaces that need to reach the cloud.
Static routes are one option for traffic routing in a site-to-site connection. Border Gateway Protocol (BGP) dynamically exchanges routing information between networks, and when BGP is enabled, the gateway advertises specific prefixes to prioritize the encrypted VPN path over an ExpressRoute connection for certain data flows.
If you have an ExpressRoute circuit set up for private peering, you can combine it with your Azure VPN gateway to create a secure, redundant backup path. With Border Gateway Protocol (BGP) enabled, the gateway can advertise specific prefixes to prioritize the encrypted VPN path over the ExpressRoute connection for certain data flows.
Before sending production traffic, verify that there are no overlapping IP ranges between your on-premises network and your Azure virtual networks, because overlaps cause routing failures. You should also configure routing filters to force specific traffic paths and keep sensitive data inside the encrypted VPN tunnel. Use Azure diagnostics and other monitoring tools to track BGP sessions and IPsec tunnel health.
StudyCerts
StudyCerts