I've been working allot with Azure virtual network (VNET) virtual private network (VPN) gateways of late. The project I'm working on at the moment requires two sites to connect to a multi-site dynamic routing VPN gateway in Azure. This is for redundancy when connecting to the Azure cloud as there is a dedicated link between the two branch sites.
The Azure portal and some of the Azure documentation is a little confusing in the wording related to gateway sizes and SKU's. There is a basic, standard and high performance gateway. However, in the preview portal you find:
A static routing gateway connects a VNET to a single site or on-premises network. This type of gateway is also known as policy based VPN gateway. Previously the distinction between a static routing gateway and a dynamic routing gateway was confusing. I wrote a blog about how I helped improve the documentation around Azure VPN gateways.
A basic gateway is actually harder to figure out than what you would think. Detailed via Microsoft articles don't mention a basic gateway other than the pricing for one being $0.0365 per hour or ~$28.00 per month. I asked the program managers at Microsoft the question and feedback received was that a static routing gateway provision on a VNET is considered a basic gateway. After discussions with the Microsoft Azure networking program managers, the team have updated the official documentation to clear things up. A basic gateway now is still a dynamic routing gateway (route based gateway) which does not have Express Route support.
A standard gateway or a small gateway as shown in the preview portal is the most common gateway provisioned. A standard gateway allows for 100MBps VPN throughput, 1000MBps Expressroute throughput, up to 10 concurrent VPN tunnels, $0.1918 per hour or ~$143.00 per month subscription + data transfer fees and a SLA of 99.9% update. A standard gateway also is known as a dynamic routing gateway. Express route is available as a standard feature.
A high performance gateway or a small gateway as shown in the preview portal offers created capacity and performance over a standard gateway. A ‘highperformance’ gateway SKU allows for 200MBps VPN throughput, 2000MBps Expressroute throughput, up to 30 concurrent VPN tunnels, $0.4945 per hour or ~$369.00 per month subscription + data transfer fees and a SLA of 99.9% update. Furthermore, a high performance gateway is also a dynamic routing gateway only with more throughput and you guessed it captain obvious- higher performance.
I've asked, through the Azure Advisors: Portal Advisors Yammer community, the Azure portal team why the gateway size is always SMALL. For now I've not heard any feedback but as soon as I do, i'll post here!
To find the gateway SKU in the Azure portal, go to… NOPE! You can't do that here.
In the Azure preview portal you see the SKU, though it does call the gateway either small or well, small. To find out, navigate to:
Managing a gateway is a more streamlined process via Powershell. You can not only create and remove a gateway, but you can also upgrade a gateway from default or standard to high performance, as well as change the gateway type from “staticrouting” to “dynamicrouting”.
To create a gateway:
New-AzureVNetGateway –VNetName "MyAzureVNet" –GatewayType "DynamicRouting" –GatewaySKU "HighPerformance"
To upgrade a gateway from a standard SKU to a highperformance SKU:
Resize-AzureVNetGateway –VNetName "MyAzureVNet" –GatewaySKU "HighPerformance" Resize-AzureVNetGateway –VNetName "MyAzureVNet" –GatewaySKU "Default"
VNET gateway SKUs and information could be a little more clearer. I found it confusing when staring down the rabbit hole. I hope this information makes it a little more easy to understand. Thanks for reading!
Follow or start a discussion for this blog (Azure VNET gateway: basic, standard and high performance) on Twitter. If you're after something more in depth, or want to ask me an expanded question: raise an issue in my open GitHub AMA repo.