So this means, traffic between these above IP ranges and APAC VNet will use this local network gateway. The Address Space is a collection of one or more IP ranges, which represents the network which this Local Network Gateway represents.ДЇor example, when we have created a local network gateway for East US2 in the APAC region, we have specified below address ranges : Notice the Address Space field carefully. So in this case, we have to create the following Local VPN gateways : However, due to this S2S offers more flexibility, as we are creating the local network gateway manually. On the other hand, VNet-to-VNet can be created only between Azure VNets, where all VPN gateway must be Azure VPN gateway. So the other site VPN Gateway may or may not be Azure VPN Gateway. This is because, S2S connection can be created between heterogeneous environment, where one side is Azure and another side can be something else (Like on-premises). This is one key difference between S2S and VNet-to-vnet However, in VNet-to-VNet connection, Azure will automatically configure the Local Network gateway. In Site-to-site connection, we have to create each Local Network gateway manually. From location B: VPN Gateway of B and Local Network gateway of A (created at location B).From location A: VPN Gateway of A and Local Network gateway of B (created at location A).So for each Site-to-site connection, we need a local network gateway, which will represent the opposite side VPN gateway.ДЇor a site-to-site connection between A & B, this is how the connection is actually configured: In general, this should be fine becauseД«y default Azure VPN gateway has a hot standby, and creates two service VMs per VPN gateway. By default, Active-Active mode is disabled.This Public IP address will not be changed unless you are deleting and re-creating the VPN gateway.

The VPN Gateway must have one Public IP, which Azure will automatically provide during creation.

Azure VPN gateway comes with multiple SKUs, here we have selected.

Please do not create any other resource under Gateway Subnet, and please do not try to rename that subnet.

The VPN gateway must be within Gateway Subnet.You can create only one VPN Gateway per VNet.Д®ven if you want to create multiple S2S connections to connect your VNet with other VNets and on-premises, you have to use that single VPN Gateway within that VNet.These VPN Gateways would be used while configuring Site-to-site VPN connection. We have created VPN Gateway in each VNet, under the gateway subnet. We will create all network resources within this resource group. We have created a Resource Group TestNetworkDesign. In the absence of a real on-premises location in our lab, this Azure VNet would represent the on-premises data center. The on-premises hub which you can see in the diagram is actually another Azure VNet.All hubs and spokes are connected with each other through site-to-site VPN.We will discuss this in more detail later. Among these two options, we opted for Site-to-site VPN, since it offers more flexibility.Since we could not use VNet Peering, we have two options 1) Site-to-site VPN and 2) VNet-to-VNet.Traffic in VNet Peering flows through Microsoft backbone network, but it is not encrypted. As traffic encryption is one of the primary requirement, we could not opt for VNet Peering.

Azure point to site vpn audit