VPN Gateway: site-to-site to a simulated office

Cost check: the gateways start billing as soon as they’re created. Delete them at the end of this lesson.

1Build the “office” network

Create vnet-onprem with its own GatewaySubnet and an office subnet:

az group create --name rg-saat-onprem --location centralindia --tags course=saatvedha-azure lesson=49 -o none
az network vnet create --resource-group rg-saat-onprem --name vnet-onprem --address-prefixes 10.80.0.0/16 --subnet-name GatewaySubnet --subnet-prefixes 10.80.0.0/27 --tags course=saatvedha-azure lesson=49 -o none
az network vnet subnet create --resource-group rg-saat-onprem --vnet-name vnet-onprem --name snet-office --address-prefixes 10.80.1.0/24 --default-outbound-access false -o none

2Start both gateways (30 to 45 minutes)

Create a Standard public IP for each, then start the gateways without waiting:

az network public-ip create --resource-group rg-saat-hub --name pip-vpngw-hub --sku Standard --zone 1 2 3 --tags course=saatvedha-azure lesson=49 -o none
az network public-ip create --resource-group rg-saat-onprem --name pip-vpngw-office --sku Standard --tags course=saatvedha-azure lesson=49 -o none
az network vnet-gateway create --resource-group rg-saat-hub --name vpngw-hub --vnet vnet-hub --public-ip-addresses pip-vpngw-hub --gateway-type Vpn --vpn-type RouteBased --sku VpnGw1AZ --tags course=saatvedha-azure lesson=49 --no-wait
az network vnet-gateway create --resource-group rg-saat-onprem --name vpngw-office --vnet vnet-onprem --public-ip-addresses pip-vpngw-office --gateway-type Vpn --vpn-type RouteBased --sku Basic --tags course=saatvedha-azure lesson=49 --no-wait

The hub gets VpnGw1AZ because gateway transit doesn’t work with Basic. The office side is only a stand-in, so Basic keeps it cheap.

While they build, create one test VM in the office and one in spoke 1:

$offSub = az network vnet subnet show --resource-group rg-saat-onprem --vnet-name vnet-onprem --name snet-office --query id -o tsv
$s1Sub = az network vnet subnet show --resource-group rg-saat-hub --vnet-name vnet-spoke1 --name snet-app --query id -o tsv
az vm create --resource-group rg-saat-onprem --name vm-office --image Canonical:ubuntu-24_04-lts:server:latest --size Standard_B1s --subnet $offSub --private-ip-address 10.80.1.4 --public-ip-address '""' --nsg '""' --admin-username azureuser --generate-ssh-keys --tags course=saatvedha-azure lesson=49 -o none
az vm create --resource-group rg-saat-onprem --name vm-s1 --image Canonical:ubuntu-24_04-lts:server:latest --size Standard_B1s --subnet $s1Sub --private-ip-address 10.41.1.4 --public-ip-address '""' --nsg '""' --admin-username azureuser --generate-ssh-keys --tags course=saatvedha-azure lesson=49 -o none

Then wait for both gateways:

az network vnet-gateway wait --resource-group rg-saat-hub --name vpngw-hub --created
az network vnet-gateway wait --resource-group rg-saat-onprem --name vpngw-office --created
$hubIp = az network public-ip show --resource-group rg-saat-hub --name pip-vpngw-hub --query ipAddress -o tsv
$offIp = az network public-ip show --resource-group rg-saat-onprem --name pip-vpngw-office --query ipAddress -o tsv

3Describe each side to the other

Each side gets a local network gateway: the other side’s public IP and the ranges behind it. The office must know the hub and both spokes:

az network local-gateway create --resource-group rg-saat-hub --name lng-office --gateway-ip-address $offIp --local-address-prefixes 10.80.0.0/16 --tags course=saatvedha-azure lesson=49 -o none
az network local-gateway create --resource-group rg-saat-onprem --name lng-hub --gateway-ip-address $hubIp --local-address-prefixes 10.40.0.0/16 10.41.0.0/16 10.42.0.0/16 --tags course=saatvedha-azure lesson=49 -o none

4Connect them with a shared key

Generate one key and use it on both connections:

$key = -join ((65..90) + (97..122) + (48..57) | Get-Random -Count 24 | ForEach-Object { [char]$_ })
az network vpn-connection create --resource-group rg-saat-hub --name cn-hub-to-office --vnet-gateway1 vpngw-hub --local-gateway2 lng-office --shared-key $key -o none
az network vpn-connection create --resource-group rg-saat-onprem --name cn-office-to-hub --vnet-gateway1 vpngw-office --local-gateway2 lng-hub --shared-key $key -o none
az network vpn-connection show --resource-group rg-saat-hub --name cn-hub-to-office --query "{status:connectionStatus, inBytes:ingressBytesTransferred, outBytes:egressBytesTransferred}" -o table

After a minute or two you should see something like this:

Status     InBytes    OutBytes
---------  ---------  ----------
Connected  1480       1312

5Let spoke 1 use the hub gateway

Turn on gateway transit on the hub side and use remote gateways on the spoke side:

az network vnet peering update --resource-group rg-saat-hub --vnet-name vnet-hub --name hub-to-spoke1 --set allowGatewayTransit=true -o none
az network vnet peering update --resource-group rg-saat-hub --vnet-name vnet-spoke1 --name spoke1-to-hub --set useRemoteGateways=true -o none
az vm run-command invoke --resource-group rg-saat-onprem --name vm-office --command-id RunShellScript --scripts 'ping -c 2 -W 2 10.41.1.4 | tail -2' --query "value[0].message" -o tsv

You should see something like this:

[stdout]
2 packets transmitted, 0 received, 100% packet loss, time 1015ms

The tunnel is up and the peering is right, yet the ping fails. Hold that thought: it’s the first break below.

✅ Checkpoint: Both gateways exist, cn-hub-to-office shows Connected with bytes moving, and spoke 1’s peering uses the hub’s gateway.