Category
Azure VPN – Blog No 1
Time to Read
25 Minutes
Who should read this blog?
If you want to learn about the VPN tunnel types supported in Azure and which one you should choose for your requirement ?

Preface

I will start this blog with a very famous historical event, I promise it will be very short.

Have you heard about the Berlin Wall tunnel?

In 1961, A wall was built famously knowns as Berlin Wall, to divide East and West Berlin, physically separating families, friends, and communities.

In response to this oppressive barrier, a group of students and activists known as the “Tunnel 29” took on the daring task of tunneling under the Berlin Wall to help people escape from East to West Berlin.

I would like you to remember one learning from this event – “Tunnel helps to connect the places guarded by the walls” Same is true about the VPN tunnels, they help to connect the network separated by firewalls securely”. When it comes to Azure, it offers many types of VPN tunnels as below.

Types of Azure VPN Tunnels

Azure cloud is a protected network, where can deploy your IAAS, and PAAS resources, very often you would like to connect your on-prem resources to the resources deployed on the cloud securely. The same can be achieved by using VPNs. Now there are different offerings provided by Azure based on multiple factors and it is important you understand these factors before making a call as to what solution you select.

Factors for Choosing Azure VPN Types

1. Point-to-Site VPN:
   • Individual client device connectivity to Azure.
   • Suitable for remote workers or small-scale access requirements.
   • Offers flexibility and ease of use.
2. Site-to-Site VPN:
   • Connect on-premises networks to Azure through the internet.
   • Ideal for organizations with multiple locations or extensive network infrastructure.
   • Provides secure and reliable connectivity.
3. ExpressRoute:
   • The dedicated private connection between on-premises networks and Azure.
   • The private connectivity is achieved through a private circuit offered generally by an ISP.
   • Offers higher bandwidth, lower latency, and enhanced security.
   • Suitable for large-scale and mission-critical applications.

Considerations:

• Scalability: Assess the number of connections required and future growth potential.
• Performance: Evaluate bandwidth, latency, and throughput needs.
• Security: Consider encryption protocols, authentication methods, and compliance requirements.
• Cost: Evaluate pricing structure based on gateway type, data transfer, and connections.
• Integration: Determine compatibility with existing infrastructure and other Azure services.
• Management: Evaluate management and monitoring capabilities.
• Use Cases: Align VPN type with specific use cases, such as remote access or inter-site connectivity.

By considering these factors, you can select the appropriate Azure VPN type (Point-to-Site, Site-to-Site, or ExpressRoute) that best suits your connectivity requirements, scalability needs, performance expectations, security considerations, and budget constraints.

Let’s see each one individually :

Point-to-site VPN

Point-to-Site (P2S) VPN is a connectivity option in Azure that allows individual client devices to securely connect to an Azure virtual network. It enables remote users or devices to access resources within an Azure virtual network over an encrypted connection.

Aspect	Description
Secure Remote Access	Provides a secure and encrypted tunnel for remote users/devices to access Azure resources.
Individual Client Connectivity	Connects individual client devices to an Azure virtual network.
Client Compatibility	Supports various platforms: Windows, macOS, Linux, iOS, and Android.
User Authentication	Supports Azure AD, certificate-based, and RADIUS authentication methods.
Scalability and Flexibility	Allows scaling up the number of concurrent client connections as needed.
Integration with Azure Virtual Network	Seamlessly integrates with Azure Virtual Network for secure communication.
Management and Monitoring	Provides management tools and monitoring capabilities for P2S VPN connections.
Supported Protocols	Supports commonly used protocols such as OpenVPN, Ikev2 and Secure Socket Tunneling Protocol (SSTP).

---

Site-to-Site VPN

Azure Site-to-Site (S2S) connectivity is a networking solution that enables secure and reliable communication between an on-premises network and an Azure virtual network. It establishes a connection over the public internet, allowing resources in the on-premises network to securely access resources in the Azure virtual network.

Note

Azure also offers a connectivity method where two Vnets can form site-to-site tunnel between the two VPN Gateways of each Vnet. This is an alternative to vnet peering but have slight differences related to dynamic routing. This method is known as vnet-to-vnet connection. In reality this is just a form of Site-to-SIte VPN.

Aspect	Description
Secure Communication	Establishes an encrypted tunnel between the on-premises network and Azure virtual network.
Hybrid Network Extension	Extends the on-premises network to Azure, creating a seamless hybrid network environment.
Extensive Compatibility	Supports a wide range of network devices and software VPN solutions for compatibility.
Scalability and Redundancy	Can be scaled up to support multiple connections and provides options for redundancy and high availability.
Integration with Azure Virtual Network	Seamlessly integrates with Azure Virtual Network for secure communication.
Management and Monitoring	Provides management tools and monitoring capabilities for S2S connectivity.

---

ExpressRoute

Azure ExpressRoute is a connectivity option that provides a dedicated and private network connection between your on-premises network and Azure. It offers a more reliable, secure, and high-performance connection compared to typical internet-based connections.

Here are the key aspects and benefits of Azure ExpressRoute connectivity:

Aspect	Description
Private and Dedicated Connection	Establishes a private and dedicated connection between on-premises network and Azure.
High Performance and Low Latency	Provides high-performance network connectivity with low latency for fast access to Azure services.
Enhanced Network SLAs	Offers enhanced Service Level Agreements (SLAs) for network availability and performance.
Extensive Reach and Connectivity Options	Available in multiple global locations with connectivity options through various partners.
Private Peering and Microsoft Peering	Supports both Private Peering and Microsoft Peering for direct and online service connectivity.
Hybrid Cloud Integration	Enables seamless integration and resource sharing between on-premises and Azure environments.
Enhanced Security and Compliance	Provides a more secure connection, additional security measures, and compliance support.
Scalability and Bandwidth Options	Offers flexible scalability with a range of bandwidth options to meet varying network requirements.

---