Hybrid cloud infrastructure.
Azure site‑to‑site Virtual Private Network, also called an Azure S2S VPN.
Alright, so what you're looking at here is a network extension,
that is to say,
a VPN being defined as a secure connection over an unsecure medium,
in this case, the public internet.
You're taking your edge router and terminating one
side of an IPSec IKEv2 tunnel, just garden variety VPN protocols,
and this is going to offer you an always‑on connection
from your on‑premises network into Azure,
and you can layer in some pretty cool features like
enabling Border Gateway Protocol, or BGP,
that's going to give you the ability to do redundancy and active‑active,
active‑passive failover kind of situations.
You also can do dynamic route exchange and route updates.
BGP is a good deal when it comes to the site‑to‑site VPN.
Notice on the Azure side, you've got a dedicated subnet called gateway subnet.
I normally do /24, but it can be smaller.
I mean it's all private non‑routable IP ranges anyway,
but you have a virtual network gateway that's going to terminate
the VPN circuit in your virtual network in Azure.
You represent your local on‑premises router with an
Azure resource called the local gateway,
and then you have one or more connections.
The connections can be site‑to‑site VPN,
VNet‑to‑VNet VPN, ExpressRoute circuits,
and then there is a point‑to‑site VPN capability,
as well that we looked at previously in this course.
So value propositions of the site‑to‑site VPN is we've got Layer 3
extension from our on‑premises environment into Azure,
so we could, for example,
join these Azure Virtual Machines to our local Active Directory domain,
we can deploy domain controllers into the virtual network
and stand up DNS and other services,
and you've got that transparent Layer 3 connection between the 2 environments,
it's pretty convenient.
And because we're dealing with an encrypted IPSec IKEv2 tunnel, we don't have the issue of plaintext, cleartext data going over the connection.