Skip to content

Commit b5d0f42

Browse files
v-dirichardsv-dirichards
authored
Merge pull request #282233 from cherylmc/design-rewrite
VPN Gateway design rewrite
2 parents 448db17 + e65a79b commit b5d0f42

File tree

4 files changed

+22
-25
lines changed

4 files changed

+22
-25
lines changed

‎articles/vpn-gateway/design.md

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -3,27 +3,31 @@ title: 'Azure VPN Gateway topologies and design'
33
description: Learn about VPN Gateway topologies and designs you can use to connect on-premises locations to virtual networks.
44
author: cherylmc
55
ms.service: vpn-gateway
6-
ms.topic: article
7-
ms.date: 05/15/2024
6+
ms.topic: concept-article
7+
ms.date: 07/30/2024
88
ms.author: cherylmc
99

1010
---
1111
# VPN Gateway topology and design
1212

13-
There are many different configuration options available for VPN Gateway connections. Use the diagrams and descriptions in the following sections to help you select the connection topology that meets your requirements. The diagrams show the main baseline topologies, but it's possible to build more complex configurations using the diagrams as guidelines.
13+
There are many different configuration options available for VPN Gateway connections. To help you select the connection topology that meets your requirements, use the diagrams and descriptions in the following sections. The diagrams show the main baseline topologies, but it's possible to build more complex configurations using the diagrams as guidelines.
1414

1515
## <a name="s2smulti"></a>Site-to-site VPN
1616

17-
A site-to-site (S2S) VPN gateway connection is a connection over IPsec/IKE (IKEv1 or IKEv2) VPN tunnel. Site-to-site connections can be used for cross-premises and hybrid configurations. A site-to-site connection requires a VPN device located on-premises that has a public IP address assigned to it. For information about selecting a VPN device, see the [VPN Gateway FAQ - VPN devices](vpn-gateway-vpn-faq.md#s2s).
17+
A site-to-site (S2S) VPN gateway connection is a connection over IPsec/IKE (IKEv1 or IKEv2) VPN tunnel. Site-to-site connections can be used for cross-premises and hybrid configurations. A site-to-site connection requires a VPN device located on-premises that has a public IP address assigned to it.
1818

1919
:::image type="content" source="./media/tutorial-site-to-site-portal/diagram.png" alt-text="Diagram of site-to-site VPN Gateway cross-premises connections." lightbox="./media/tutorial-site-to-site-portal/diagram.png":::
2020

21-
VPN Gateway can be configured in active-standby mode using one public IP or in active-active mode using two public IPs. In active-standby mode, one IPsec tunnel is active and the other tunnel is in standby. In this setup, traffic flows through the active tunnel, and if some issue happens with this tunnel, the traffic switches over to the standby tunnel. Setting up VPN Gateway in active-active mode is *recommended* in which both the IPsec tunnels are simultaneously active, with data flowing through both tunnels at the same time. Another advantage of active-active mode is that customers experience higher throughputs.
22-
23-
You can create more than one VPN connection from your virtual network gateway, typically connecting to multiple on-premises sites. When working with multiple connections, you must use a RouteBased VPN type (known as a dynamic gateway when working with classic VNets). Because each virtual network can only have one VPN gateway, all connections through the gateway share the available bandwidth. This type of connection is sometimes referred to as a "multi-site" connection.
21+
You can create more than one VPN connection from your virtual network gateway, typically connecting to multiple on-premises sites. When working with multiple connections, you must use a RouteBased VPN type. Because each virtual network can only have one VPN gateway, all connections through the gateway share the available bandwidth. This type of connectivity design is sometimes referred to as *multi-site*.
2422

2523
:::image type="content" source="./media/design/multi-site.png" alt-text="Diagram of site-to-site VPN Gateway cross-premises connections with multiple sites." lightbox="./media/design/multi-site.png":::
2624

25+
If you want to create a design for highly available gateway connectivity, you can configure your gateway to be in active-active mode. This mode lets you configure two active tunnels (one from each gateway virtual machine instance) to the same VPN device to create highly available connectivity. In addition to being a highly available connectivity design, another advantage of active-active mode is that customers experience higher throughputs.
26+
27+
* For information about selecting a VPN device, see the [VPN Gateway FAQ - VPN devices](vpn-gateway-vpn-faq.md#s2s).
28+
* For information about highly available connections, see [Designing highly available connections](vpn-gateway-highlyavailable.md).
29+
* For information about active-active mode, see [About active-active mode gateways](about-active-active-gateways.md).
30+
2731
### Deployment models and methods for S2S
2832

2933
[!INCLUDE [site-to-site table](../../includes/vpn-gateway-table-site-to-site-include.md)]
@@ -74,9 +78,9 @@ You can configure a site-to-site VPN as a secure failover path for ExpressRoute,
7478

7579
[!INCLUDE [ExpressRoute coexist table](../../includes/vpn-gateway-table-coexist-include.md)]
7680

77-
## <a name="highly-available"></a>Highly available connections
81+
## Highly available connections
7882

79-
For planning and design for highly available connections, see [Highly available connections](vpn-gateway-highlyavailable.md).
83+
For planning and designing highly available connections, including active-active mode configurations, see [Design highly available gateway connectivity for cross-premises and VNet-to-VNet connections](vpn-gateway-highlyavailable.md).
8084

8185
## Next steps
8286

‎includes/vpn-gateway-table-coexist-include.md

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@
66
ms.date: 02/28/2024
77
ms.author: cherylmc
88
---
9-
| **Deployment model/method** | **Azure portal** | **PowerShell** |
9+
| Deployment model| Azure portal| PowerShell |
1010
| --- | --- | --- |
11-
| Resource Manager | **Supported** | [Tutorial](../articles/expressroute/expressroute-howto-coexist-resource-manager.md)|
12-
| Classic (legacy deployment model)| **Not Supported** | [Tutorial](../articles/expressroute/expressroute-howto-coexist-classic.md) |
11+
| Resource Manager |[Tutorial](../articles/expressroute/how-to-configure-coexisting-gateway-portal.md)| [Tutorial](../articles/expressroute/expressroute-howto-coexist-resource-manager.md)|

‎includes/vpn-gateway-table-site-to-site-include.md

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,9 @@
33
author: cherylmc
44
ms.service: vpn-gateway
55
ms.topic: include
6-
ms.date: 02/28/2024
6+
ms.date: 07/30/2024
77
ms.author: cherylmc
88
---
9-
| **Deployment model/method** | **Azure portal** | **PowerShell** | **Azure CLI** |
10-
| --- | --- | --- | --- |
11-
| Resource Manager |[Tutorial](../articles/vpn-gateway/tutorial-site-to-site-portal.md) |[Tutorial](../articles/vpn-gateway/vpn-gateway-create-site-to-site-rm-powershell.md) | [Tutorial](../articles/vpn-gateway/vpn-gateway-howto-site-to-site-resource-manager-cli.md) |
12-
| Classic (legacy deployment model)|[Tutorial**](../articles/vpn-gateway/vpn-gateway-howto-site-to-site-classic-portal.md) |[Tutorial](../articles/vpn-gateway/vpn-gateway-multi-site.md) | Not Supported |
13-
14-
(**) denotes that this method contains steps that require PowerShell.
9+
|Deployment model| Azure portal | PowerShell| Azure CLI |
10+
| --- | --- | --- |---|
11+
| Resource Manager |[Tutorial](../articles/vpn-gateway/tutorial-site-to-site-portal.md) |[Tutorial](../articles/vpn-gateway/vpn-gateway-create-site-to-site-rm-powershell.md) | [Tutorial](../articles/vpn-gateway/vpn-gateway-howto-site-to-site-resource-manager-cli.md) |

‎includes/vpn-gateway-table-vnet-to-vnet-include.md

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,14 +3,11 @@
33
author: cherylmc
44
ms.service: vpn-gateway
55
ms.topic: include
6-
ms.date: 02/28/2024
6+
ms.date: 07/30/2024
77
ms.author: cherylmc
88
---
9-
| **Deployment model/method** | **Azure portal** | **PowerShell** | **Azure CLI** |
9+
| Deployment model| Azure portal | PowerShell| Azure CLI |
1010
| --- | --- | --- | --- |
1111
| Resource Manager |[Tutorial+](../articles/vpn-gateway/vpn-gateway-howto-vnet-vnet-resource-manager-portal.md) |[Tutorial](../articles/vpn-gateway/vpn-gateway-vnet-vnet-rm-ps.md) |[Tutorial](../articles/vpn-gateway/vpn-gateway-howto-vnet-vnet-cli.md)|
12-
| Classic (legacy deployment model)|[Tutorial*](../articles/vpn-gateway/vpn-gateway-howto-vnet-vnet-portal-classic.md)|Supported | Not Supported|
13-
| Connections between Resource Manager and Classic (legacy) deployment models|[Tutorial*](../articles/vpn-gateway/vpn-gateway-connect-different-deployment-models-portal.md) |[Tutorial](../articles/vpn-gateway/vpn-gateway-connect-different-deployment-models-powershell.md) | Not Supported |
1412

15-
(+) denotes this deployment method is available only for VNets in the same subscription.<br>
16-
(*) denotes that this deployment method also requires PowerShell.
13+
(+) Denotes this deployment method is available only for VNets in the same subscription.

0 commit comments

Comments
 (0)