So the Azure VPN gateway can be used for Always On VPN,
but it's not without its kind of drawbacks and limitations.
So first of all, when we're talking about deploying an Azure VPN gateway,
the advantage to using something like that would be,
of course, that it's a fully managed VPN infrastructure.
There's no software to install and configure, no hardware to maintain or manage.
You know, you just basically use it.
It's fantastic in that regard.
It does have some disadvantages in that its support for
Always On VPN specifically is quite limited.
To begin,
the Azure VPN Gateway will support only the device tunnel or the user tunnel.
It will not support both concurrently.
So if you're deploying the Azure VPN Gateway and you're
expecting to use both device tunnel and user tunnel,
the VPN Gateway can only be configured for one authentication mode at a time.
And so you can use either device authentication or user authentication, but
you cannot do both, so that means you have to choose whether you're going
to use the device tunnel or the user tunnel.
In addition, the Azure VPN Gateway has limited support for SSTP.
It only supports 128 concurrent connections if you're using the standard
gateway, or if you're using the active‑active gateway,
you can double that to 256.
So for a smaller deployment that might work well,
but for most enterprise deployments, that simply isn't enough connections.
And again,
as you've heard me mention throughout this course, SSTP really is
the protocol of choice for user‑based connections because of its
obviously firewall friendliness.
So in that case, if you're planning to support the user tunnel,
just know that your upper limit for the number of current connections is going
to be quite limited, and that's regardless of SKU. Also,
there can only be one VPN Gateway per VNet. So some folks have asked,
well, you know,
can I get around this limitation of single‑mode
authentication by just deploying two gateways?
You certainly could,
but they would have to be in separate VNets, and then
you would have to peer those VNets.
So maybe technically possible,
but certainly complex and and rather challenging. I would
probably avoid that type of scenario.
Also,
the Azure VPN Gateway does not provide support for
force tunneling for VPN clients,
so there is no internet egress allowed for force
tunneling when you're using Always On VPN.
There's no support for geographic redundancy,
so you couldn't have multiple gateways and multiple VNets and
then load balance between them geographically.
That's not supported.
And the reason for that is because we don't have control
over the subject name of the gateway,
so each gateway would have its own subject name, and there would
be no way to use like a common name and just use like Azure
Traffic Manager to route between them.
So unfortunately, that's not supported either.
And then finally, you must use a route‑based gateway. Just keep that in
mind. It doesn't support using the policy gateway.
So for all of those reasons,
you'll find that the Azure VPN Gateway is of limited usefulness for an Always On VPN deployment.