Azure Gateways in Enterprise Architecture

Azure Gateways in Enterprise Architecture

Types, SKUs, Usage, Configuration, Best Practices, and Subnet Requirements

Modern enterprise Azure environments rely on gateways to control traffic flow, enable hybrid connectivity, enforce security inspection, and provide application level routing. Selecting the correct gateway type and SKU directly impacts availability, compliance, performance, and cost.

This comprehensive guide covers:

1. Gateway Types
2. Gateway SKUs
3. Gateway Usage Scenarios
4. Gateway Feature Comparison Table
5. Gateway Configuration Overview
6. Gateway Best Practices
7. Gateway Subnetting Requirements

All content is structured for enterprise architecture documentation and Shopify blog publishing.

1. Gateway Types

Azure VPN Gateway
Entity: Azure VPN Gateway

Purpose
Encrypted IPsec connectivity between Azure and on premises or branch offices.

Common Use Cases
Site to Site VPN
Point to Site remote access
VNet to VNet connectivity

Azure ExpressRoute Gateway
Entity: Azure ExpressRoute

Purpose
Private dedicated connectivity to Azure through a connectivity provider.

Common Use Cases
Financial services workloads
High throughput replication
Mission critical hybrid connectivity

Azure Application Gateway
Entity: Azure Application Gateway

Purpose
Layer 7 HTTP and HTTPS load balancing with SSL termination and optional Web Application Firewall.

Common Use Cases
Public web applications
Microservices ingress
AKS ingress controller

Azure Firewall
Entity: Azure Firewall

Purpose
Centralized network security service with application and network rule filtering.

Common Use Cases
Hub and spoke security architecture
Egress filtering
Threat intelligence filtering

Azure NAT Gateway
Entity: Azure NAT Gateway

Purpose
Secure outbound internet access for private workloads using static public IP addresses.

Common Use Cases
AKS outbound connectivity
Private VM internet access
Controlled egress

Azure Front Door
Entity: Azure Front Door

Purpose
Global Layer 7 load balancing and web acceleration.

Common Use Cases
Global SaaS platforms
Active active regional deployments
Edge security and WAF

2. Gateway SKUs

VPN Gateway SKUs

ExpressRoute Gateway SKUs

Application Gateway SKUs

Azure Firewall SKUs

NAT Gateway

Single SKU model supporting high availability and up to 16 public IP addresses.

3. Gateway Usage Scenarios

VPN Gateway
Best suited for encrypted hybrid connectivity with moderate bandwidth requirements and cost sensitivity.

ExpressRoute
Designed for enterprises requiring private connectivity, predictable latency, and compliance alignment.

Application Gateway
Used when application layer routing, SSL offload, and WAF inspection are required.

Azure Firewall
Deployed in hub VNet to centralize traffic inspection and enforce outbound and east west filtering.

NAT Gateway
Ideal for outbound only traffic where inbound exposure must be prevented.

Front Door
Used for global HTTP routing and edge acceleration across multiple Azure regions.

4. Gateway Feature Comparison Table

5. Gateway Configuration Overview

VPN Gateway Configuration

1. Create a VNet with GatewaySubnet
2. Allocate Public IP
3. Deploy Virtual Network Gateway
4. Configure Local Network Gateway
5. Create IPsec connection

Application Gateway Configuration

1. Create dedicated subnet
2. Assign Public IP
3. Configure frontend listeners
4. Define backend pools
5. Configure HTTP settings
6. Create routing rules
7. Enable WAF if required

Azure Firewall Configuration

1. Create AzureFirewallSubnet
2. Assign Public IP
3. Deploy Firewall
4. Configure network rules
5. Configure application rules
6. Enable threat intelligence

NAT Gateway Configuration

1. Create Public IP resource
2. Deploy NAT Gateway
3. Associate NAT Gateway with workload subnet

ExpressRoute Gateway Configuration

1. Create GatewaySubnet
2. Deploy Virtual Network Gateway with ExpressRoute SKU
3. Link to ExpressRoute circuit
4. Enable BGP
5. Gateway Best Practices
6. Always use zone redundant SKUs in production
7. Use hub and spoke architecture for centralized control
8. Separate each gateway into dedicated subnet
9. Use Azure Firewall for centralized egress filtering
10. Use Application Gateway WAF for internet facing workloads
11. Enable diagnostic logs and monitoring
12. Implement BGP for dynamic routing
13. Avoid mixing VPN and ExpressRoute in unsupported configurations
14. Size GatewaySubnet appropriately
15. Monitor throughput and scale SKUs when required
16. Gateway Subnetting Requirements

VPN Gateway

Subnet name must be GatewaySubnet
Minimum recommended size is /27
No other resources allowed

ExpressRoute Gateway

Uses GatewaySubnet
Cannot share with other services
Recommended minimum /27

Application Gateway

Requires dedicated subnet
Cannot contain other resource types
Recommended /27 or larger for autoscaling

Azure Firewall

Subnet must be named AzureFirewallSubnet
Minimum size /26
No other resources allowed

NAT Gateway

No dedicated subnet required
Associated to workload subnet

Front Door

Global service
No VNet subnet required

Final Thoughts

Azure gateways are foundational networking components that control traffic flow, enforce security, and enable hybrid integration. Proper gateway selection depends on workload type, compliance requirements, traffic inspection depth, and resiliency expectations.

Enterprise environments typically combine multiple gateways:

VPN or ExpressRoute for hybrid connectivity
Azure Firewall for centralized security
Application Gateway for web routing
NAT Gateway for secure outbound traffic
Front Door for global distribution

When designed correctly, gateways provide a scalable, secure, and resilient foundation for enterprise cloud architecture.