VPN Gateway for hybrid connectivity in Azure - Mini Project: Build & Apply

VPN Gateway for hybrid connectivity

📖 Scenario: You work for a company that wants to connect their on-premises network securely to their Azure virtual network. They want to use a VPN Gateway to create a hybrid connection.

🎯 Goal: Build an Azure VPN Gateway configuration that connects an on-premises network to an Azure virtual network using a site-to-site VPN.

📋 What You'll Learn

Create a resource group named HybridNetworkRG

Create a virtual network named HybridVNet with address space 10.1.0.0/16

Create a subnet named GatewaySubnet with address prefix 10.1.255.0/27

Create a public IP address resource named VpnGatewayPublicIP

Create a VPN Gateway named HybridVpnGateway in the resource group

Configure the VPN Gateway with VpnGw1 SKU and RouteBased VPN type

Create a local network gateway named OnPremisesGateway with on-premises address space 192.168.0.0/24 and IP address 203.0.113.1

Create a VPN connection named SiteToSiteConnection between the VPN Gateway and the local network gateway

Use a shared key Azure123! for the VPN connection

💡 Why This Matters

🌍 Real World

Companies use VPN Gateways to securely connect their on-premises networks to Azure virtual networks, enabling hybrid cloud scenarios.

💼 Career

Cloud engineers and network administrators often configure VPN Gateways to establish secure hybrid connectivity between cloud and on-premises environments.

1

Create the resource group and virtual network

Create a resource group named HybridNetworkRG in eastus location. Then create a virtual network named HybridVNet with address space 10.1.0.0/16 inside the resource group. Also create a subnet named GatewaySubnet with address prefix 10.1.255.0/27 inside the virtual network.

Azure

# Your code here to create resource group, virtual network, and GatewaySubnet

Hint

Use Azure CLI or ARM template syntax to define resource group and virtual network with subnet.

2

Create the public IP address for the VPN Gateway

Create a public IP address resource named VpnGatewayPublicIP in the resource group HybridNetworkRG. Use Standard SKU and Static allocation method.

Azure

resource_group = {
    "name": "HybridNetworkRG",
    "location": "eastus"
}

virtual_network = {
    "name": "HybridVNet",
    "resource_group": resource_group["name"],
    "address_space": ["10.1.0.0/16"],
    "subnets": [
        {
            "name": "GatewaySubnet",
            "address_prefix": "10.1.255.0/27"
        }
    ]
}

# Your code here to create VpnGatewayPublicIP

Hint

Public IP for VPN Gateway must be static and standard SKU for reliability.

3

Create the VPN Gateway and local network gateway

Create a VPN Gateway named HybridVpnGateway in resource group HybridNetworkRG using the subnet GatewaySubnet from HybridVNet. Use SKU VpnGw1 and VPN type RouteBased. Then create a local network gateway named OnPremisesGateway with IP address 203.0.113.1 and address space 192.168.0.0/24.

Azure

resource_group = {
    "name": "HybridNetworkRG",
    "location": "eastus"
}

virtual_network = {
    "name": "HybridVNet",
    "resource_group": resource_group["name"],
    "address_space": ["10.1.0.0/16"],
    "subnets": [
        {
            "name": "GatewaySubnet",
            "address_prefix": "10.1.255.0/27"
        }
    ]
}

public_ip = {
    "name": "VpnGatewayPublicIP",
    "resource_group": resource_group["name"],
    "sku": "Standard",
    "allocation_method": "Static"
}

# Your code here to create HybridVpnGateway and OnPremisesGateway

Hint

VPN Gateway must use the GatewaySubnet and public IP. Local network gateway defines on-premises network.

4

Create the VPN connection with shared key

Create a VPN connection named SiteToSiteConnection between the VPN Gateway HybridVpnGateway and the local network gateway OnPremisesGateway. Use the shared key Azure123! for the connection.

Azure

resource_group = {
    "name": "HybridNetworkRG",
    "location": "eastus"
}

virtual_network = {
    "name": "HybridVNet",
    "resource_group": resource_group["name"],
    "address_space": ["10.1.0.0/16"],
    "subnets": [
        {
            "name": "GatewaySubnet",
            "address_prefix": "10.1.255.0/27"
        }
    ]
}

public_ip = {
    "name": "VpnGatewayPublicIP",
    "resource_group": resource_group["name"],
    "sku": "Standard",
    "allocation_method": "Static"
}

vpn_gateway = {
    "name": "HybridVpnGateway",
    "resource_group": resource_group["name"],
    "location": resource_group["location"],
    "vnet_name": virtual_network["name"],
    "subnet_name": "GatewaySubnet",
    "public_ip_name": public_ip["name"],
    "sku": "VpnGw1",
    "vpn_type": "RouteBased"
}

local_network_gateway = {
    "name": "OnPremisesGateway",
    "resource_group": resource_group["name"],
    "gateway_ip_address": "203.0.113.1",
    "address_space": ["192.168.0.0/24"]
}

# Your code here to create SiteToSiteConnection with shared key Azure123!

Hint

VPN connection links the Azure VPN Gateway and on-premises local network gateway using a shared key.

Practice

1. What is the primary purpose of an Azure VPN Gateway in hybrid connectivity?

easy

A. To manage Azure Active Directory users

B. To securely connect an Azure virtual network with an on-premises network

C. To provide public internet access to Azure resources

D. To host web applications in Azure

Solution

1. Step 1: Understand VPN Gateway role

   An Azure VPN Gateway creates a secure tunnel between Azure and on-premises networks.

2. Step 2: Identify correct purpose

   Among the options, only connecting Azure virtual network with on-premises securely matches the VPN Gateway's role.

3. Final Answer:

   To securely connect an Azure virtual network with an on-premises network -> Option B

4. Quick Check:

   VPN Gateway = Secure hybrid connection [OK]

Hint: VPN Gateway links cloud and local networks securely [OK]

Common Mistakes:

• Confusing VPN Gateway with web hosting services
• Thinking VPN Gateway manages user identities
• Assuming VPN Gateway provides public internet access

2. Which subnet name must you use when creating a VPN Gateway in an Azure virtual network?

easy

A. PublicSubnet

B. VPNSubnet

C. Subnet1

D. GatewaySubnet

Solution

1. Step 1: Recall required subnet for VPN Gateway

   Azure requires a subnet named exactly 'GatewaySubnet' for VPN Gateway deployment.

2. Step 2: Verify option correctness

   Only 'GatewaySubnet' matches the required name; others are invalid for VPN Gateway.

3. Final Answer:

   GatewaySubnet -> Option D

4. Quick Check:

   VPN Gateway subnet = GatewaySubnet [OK]

Hint: Always name VPN Gateway subnet as GatewaySubnet [OK]

Common Mistakes:

• Using generic subnet names instead of GatewaySubnet
• Confusing VPNSubnet with GatewaySubnet
• Not creating a dedicated subnet for VPN Gateway

3. Given this Azure CLI command snippet to create a VPN Gateway:

az network vnet-gateway create --name MyVpnGateway --public-ip-address MyPublicIP --resource-group MyResourceGroup --vnet MyVNet --gateway-type Vpn --vpn-type RouteBased --sku VpnGw1

What VPN type is being used here?

medium

A. RouteBased

B. PointToSite

C. ExpressRoute

D. PolicyBased

Solution

1. Step 1: Analyze the command parameters

   The parameter '--vpn-type RouteBased' explicitly sets the VPN type to RouteBased.

2. Step 2: Confirm VPN type meaning

   RouteBased VPN supports flexible connections and is commonly used for hybrid networks.

3. Final Answer:

   RouteBased -> Option A

4. Quick Check:

   --vpn-type RouteBased means RouteBased VPN [OK]

Hint: Look for --vpn-type parameter to identify VPN type [OK]

Common Mistakes:

• Confusing PolicyBased with RouteBased
• Assuming ExpressRoute is a VPN type
• Mixing PointToSite with Site-to-Site VPN types

4. You deployed a VPN Gateway but the connection to your on-premises network fails. Which of these is a likely misconfiguration?

medium

A. The virtual network has too many subnets

B. The VPN Gateway SKU is set to Basic for high throughput needs

C. The GatewaySubnet is missing or incorrectly named

D. The public IP address is assigned to a VM instead of the VPN Gateway

Solution

1. Step 1: Check subnet configuration

   VPN Gateway requires a correctly named GatewaySubnet; missing or wrong name causes failure.

2. Step 2: Evaluate other options

   Too many subnets is not a direct cause; SKU Basic may limit performance but not cause failure; public IP must be assigned to VPN Gateway, not VM.

3. Final Answer:

   The GatewaySubnet is missing or incorrectly named -> Option C

4. Quick Check:

   GatewaySubnet misconfiguration causes VPN failure [OK]

Hint: Verify GatewaySubnet exists and is named correctly [OK]

Common Mistakes:

• Ignoring GatewaySubnet naming requirements
• Assigning public IP to wrong resource
• Assuming SKU affects connection establishment

5. You want to set up a hybrid network with Azure using a VPN Gateway. Your on-premises network uses static routing. Which VPN type should you choose for maximum flexibility and why?

hard

A. RouteBased, because it supports both static and dynamic routing

B. PolicyBased, because it supports static routing only

C. ExpressRoute, because it is faster than VPN

D. PointToSite, because it supports multiple clients

Solution

1. Step 1: Understand VPN types and routing

   PolicyBased VPN supports only static routing; RouteBased supports static and dynamic routing.

2. Step 2: Match VPN type to flexibility needs

   RouteBased VPN is more flexible and recommended for hybrid networks with static or dynamic routing.

3. Step 3: Exclude other options

   ExpressRoute is a different service, not a VPN type; PointToSite is for individual client connections, not site-to-site.

4. Final Answer:

   RouteBased, because it supports both static and dynamic routing -> Option A

5. Quick Check:

   RouteBased VPN = flexible routing support [OK]

Hint: Choose RouteBased VPN for static and dynamic routing support [OK]

Common Mistakes:

• Choosing PolicyBased for flexibility
• Confusing ExpressRoute with VPN Gateway
• Using PointToSite for site-to-site connectivity