Azure VPN Gateway SKUs - Documentation

This document provides a comprehensive overview of the various Stock Keeping Units (SKUs) available for Azure VPN Gateway. Choosing the correct SKU is crucial for performance, cost, and feature set.

Understanding VPN Gateway SKUs

Azure VPN Gateway offers different SKUs, each designed to meet specific requirements for throughput, tunnel count, and features like active-active connectivity and zone redundancy. The naming convention generally indicates the capabilities:

Basic: Entry-level SKU, suitable for development/testing.
VpnGw1 to VpnGw5: General-purpose SKUs offering increasing performance and features.
VpnGw1AZ to VpnGw5AZ: Zone-redundant versions of the general-purpose SKUs.
ErGw1AZ to ErGw3AZ: ExpressRoute Gateway SKUs (not covered in detail here, but related).

Key Differentiating Factors

Max Throughput: The aggregate tunnel throughput in Mbps.
Number of Connections: The maximum number of P2S (Point-to-Site) and S2S (Site-to-Site) connections supported.
IPsec/IKE Support: Compatibility with different IPsec/IKE protocol versions and encryption algorithms.
BGP Support: Whether Border Gateway Protocol is supported for dynamic routing.
Active-Active Support: Ability to configure the gateway for high availability.
Zone Redundancy: Deployment across Availability Zones for enhanced resilience.

SKU Comparison Table

The following table summarizes the capabilities of the primary Azure VPN Gateway SKUs. Please refer to official Azure documentation for the most up-to-date specifications.

SKU	Max Throughput (Gbps)	Max P2S Connections	Max S2S Connections	Active-Active Support	Zone Redundancy	Notes
`Basic`	~0.1 (100 Mbps)	125	10	No	No	Development/testing only. Not recommended for production.
`VpnGw1`	~0.65 (650 Mbps)	125	50	Yes	No	Entry-level production SKU.
`VpnGw2`	~1.25 (1.25 Gbps)	250	100	Yes	No	Increased throughput and connections.
`VpnGw3`	~2.5 (2.5 Gbps)	500	200	Yes	No	Higher performance.
`VpnGw4`	~5.0 (5.0 Gbps)	1000	400	Yes	No	Significant performance boost.
`VpnGw5`	~10.0 (10.0 Gbps)	2000	1000	Yes	No	Highest performance non-zone-redundant SKU.
`VpnGw1AZ`	~0.65 (650 Mbps)	125	50	Yes	Yes	Zone-redundant version of VpnGw1.
`VpnGw2AZ`	~1.25 (1.25 Gbps)	250	100	Yes	Yes	Zone-redundant version of VpnGw2.
`VpnGw3AZ`	~2.5 (2.5 Gbps)	500	200	Yes	Yes	Zone-redundant version of VpnGw3.
`VpnGw4AZ`	~5.0 (5.0 Gbps)	1000	400	Yes	Yes	Zone-redundant version of VpnGw4.
`VpnGw5AZ`	~10.0 (10.0 Gbps)	2000	1000	Yes	Yes	Zone-redundant version of VpnGw5.

Important Considerations:

Throughput is measured using standardized test methods. Actual throughput may vary based on network conditions, encryption, and traffic patterns.
The Basic SKU is not recommended for any production workloads due to its performance limitations and lack of advanced features.
Zone-redundant SKUs (ending in AZ) offer higher availability by distributing the gateway across multiple Availability Zones within a region.
Ensure your on-premises devices and network configurations are compatible with the chosen VPN Gateway SKU and its features.
Always check the official Azure pricing page for the most current costs associated with each SKU.

Choosing the Right SKU

The selection process should be guided by your specific requirements:

Determine Required Throughput: Estimate your peak network traffic needs between your on-premises network and Azure.
Assess Connection Count: Count the number of site-to-site tunnels and point-to-site clients you anticipate needing.
Evaluate Availability Needs: For mission-critical applications, consider zone-redundant SKUs for enhanced resilience.
Consider Future Growth: It's often advisable to select a SKU that can accommodate anticipated future growth in traffic and connections.
Budget Constraints: Higher SKUs come with higher costs. Balance performance needs with budget.

Example Scenario: