How to Configure Azure Site-to-Site (S2S) VPN – Step-by-Step Enterprise Guide (2026)
Establishing a Site-to-Site (S2S) VPN between an On-Premises Environment and Azure is a foundational requirement for a Hybrid Cloud Architecture. This guide provides a Step-by-Step Configuration Process aligned with Enterprise Networking and Security Best Practices.
What Is Site-to-Site VPN?
An Azure Site-to-Site VPN creates an encrypted IPsec/IKE tunnel between:
v On-premises network
v Azure Virtual Network (vNet)
It allows secure communication over the public internet.
Used for:
v Hybrid identity integration
v Datacenter extension
v Backup and DR
v Gradual cloud migration
Architecture Components
To configure S2S VPN, you need:
v Azure Virtual Network (VNet)
v Gateway Subnet
v Virtual Network Gateway
v Local Network Gateway
v VPN Connection
v On-prem VPN device
Prerequisites
Before starting, ensure:
v You have a public IP on your on-prem firewall/router
v Supported VPN device (IPsec/IKE compatible)
v Defined address spaces (no overlapping CIDRs)
v Appropriate Azure permissions
Step 1 – Create Virtual Network (VNet)
Create a VNet in Azure.
Example:
Address space: 10.10.0.0/16
Subnet: 10.10.1.0/24
Azure Portal:
Azure → Virtual Networks → Create
Step 2 – Create Gateway Subnet
Inside the VNet, create a subnet named:
GatewaySubnet
Minimum recommended size:
/27 or larger
Example:
10.10.255.0/27
Important:
The name must be exactly GatewaySubnet.
Step 3 – Create Virtual Network Gateway
Azure Portal:
Virtual Network Gateway → Create
Configuration:
v Gateway type: VPN
v VPN type: Route-based
v SKU: VpnGw1 or higher (enterprise recommended)
v Generation: Gen2
v Public IP: New
Deployment may take 30–45 minutes.
Step 4 – Create Local Network Gateway
This represents your on-prem environment.
Configuration:
v Name
v On-prem public IP address
v Address space of on-prem network
Example:
Public IP: 203.0.113.10
Address space: 192.168.0.0/16
Step 5 – Create the VPN Connection
Azure Portal:
Virtual Network Gateway → Connections → Add
Configuration:
v Connection type: Site-to-site (IPsec)
v Shared key (PSK): Strong complex key
v Associate Local Network Gateway
Save.
Step 6 – Configure On-Prem VPN Device
On your firewall/router:
v Configure IPsec tunnel
v Enter Azure public IP
v Use shared key
v Match IKE version (IKEv2 recommended)
v Match encryption parameters
Common enterprise settings:
v IKEv2
v AES256
v SHA256
v DH Group 14
v Lifetime 28800
Step 7 – Validate the Tunnel
In Azure:
Virtual Network Gateway → Connections
Status should show:
Connected
Test by:
v Ping from Azure VM to on-prem resource
v Check logs
v Validate route tables
Security Best Practices
v Use strong pre-shared keys
v Restrict NSGs
v Enable Azure Monitor diagnostics
v Log to Log Analytics
v Use BGP if multiple sites
v Consider ExpressRoute for production-scale workloads
S2S VPN vs ExpressRoute
S2S VPN:
v Internet-based
v Lower cost
v Quick deployment
v Suitable for small-to-medium workloads
ExpressRoute:
v Private connectivity
v Higher bandwidth
v Lower latency
v Enterprise-grade SLAs
Use S2S VPN for:
v DR
v Dev/Test
v Initial hybrid phase
Use ExpressRoute for:
v Production ERP
v Large-scale enterprise workloads
Final Thoughts
Site-to-Site VPN remains a core component of hybrid cloud networking. When properly configured with secure cryptographic settings and governance controls, it provides reliable connectivity between on-premises and Azure environments.
For enterprise architecture, S2S VPN is often the first step before transitioning to ExpressRoute or multi-region hub-and-spoke models.
0 comments