Introduction

• Understand what a site-to-site VPN connection is and when to use it.
• Identify the high-level components in an Azure site-to-site VPN deployment.
• Follow step-by-step Azure configuration and typical on‑premises settings to establish a working S2S VPN.

​

What is a site-to-site VPN?

• Hybrid cloud connectivity between on-premises datacenters and Azure VNets.
• Secure branch-to-branch connectivity over the internet.
• Encrypted IP-level connectivity where ExpressRoute is not required or available.

​

High-level technical overview

​

Azure S2S VPN: Step-by-step configuration (high level)

1. Create a resource group (if you don’t have one):

az group create --name `RG_NAME` --location `eastus`

2. Create a virtual network and subnets (include a GatewaySubnet):

az network vnet create \
  --resource-group `RG_NAME` \
  --name `VNetName` \
  --address-prefix `10.1.0.0/16` \
  --subnet-name `default` \
  --subnet-prefix `10.1.0.0/24`

az network vnet subnet create \
  --resource-group `RG_NAME` \
  --vnet-name `VNetName` \
  --name `GatewaySubnet` \
  --address-prefix `10.1.255.0/27`

3. Create a public IP for the VPN gateway:

az network public-ip create \
  --resource-group `RG_NAME` \
  --name `VNetGatewayIP` \
  --allocation-method Dynamic

4. Create the Virtual Network Gateway (this can take 20–45 minutes):

az network vpn-gateway create \
  --resource-group `RG_NAME` \
  --name `VNetGateway` \
  --public-ip-address `VNetGatewayIP` \
  --vnet `VNetName` \
  --gateway-type Vpn \
  --sku VpnGw1 \
  --vpn-type RouteBased \
  --no-wait

5. Create a Local Network Gateway to represent your on-premises site:

az network local-gateway create \
  --resource-group `RG_NAME` \
  --name `OnPremLocalGateway` \
  --gateway-ip-address `203.0.113.10` \
  --local-address-prefixes `10.10.0.0/16` \
  --asn 65010  # optional for BGP

6. Create the S2S connection with a pre-shared key (PSK):

az network vpn-connection create \
  --resource-group `RG_NAME` \
  --name `S2SConnection` \
  --vnet-gateway1 `VNetGateway` \
  --local-gateway2 `OnPremLocalGateway` \
  --shared-key `yourPresharedKeyHere` \
  --enable-bgp false

• For BGP-enabled connections, add the ASN/peer settings and set --enable-bgp true.
• A route-based VPN is the standard for Azure S2S; policy-based is limited in features.

​

On‑premises configuration checklist

• Public IP: the device must have a stable public IP known to Azure.
• Pre-shared key: must match sharedKey used in the Azure Connection resource.
• IKE version: use IKEv2 when possible.
• Encryption & integrity algorithms: ensure compatibility (e.g., AES256/SHA256).
• Tunnel type: route-based (virtual tunnel interfaces) if using Azure route-based gateways.
• Local network prefixes: configured to advertise/route the on-prem address ranges.
• BGP: if using BGP, configure ASN and peer IPs; ensure BGP timers and MTU are compatible.

​

Routing considerations

• Avoid overlapping IP address spaces between Azure VNets and on-prem networks.
• Choose static routes for simple topologies or BGP for dynamic route exchange and scale.
• When using BGP, ensure both sides have unique ASNs and compatible BGP neighbors.

​

Troubleshooting checklist

​

Links and references

• Azure Virtual Network Gateway documentation: https://learn.microsoft.com/azure/vpn-gateway/
• Azure VPN Gateway troubleshooting: https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-troubleshoot-azure-to-onprem
• IPsec/IKE overview: https://datatracker.ietf.org/doc/html/rfc7296