AZ-700 Question 85
Single answerYou are configuring a site-to-site VPN between your on-premises network, which has a static public IP address, and an Azure virtual network (VNet). You have created the Azure Virtual Network Gateway (VNG) using a route-based VPN type and set up a Local Network Gateway referencing the on-premises public IP. However, the tunnel will not establish, and you notice that there is no active connection resource in the Azure portal. Which additional step should you take to successfully complete the site-to-site VPN configuration?
- A
Modify your Network Security Group rules to explicitly allow UDP ports 500 and 4500 from Azure to on-premises.
- B
Create a Virtual Network Peering between the on-premises network and the Azure VNet.
- C
Add a connection resource in Azure to link the Virtual Network Gateway and the Local Network Gateway with a shared key.
- D
Enable forced tunneling on the Azure VNet and specify the on-premises public IP as the default gateway.
Show answer and explanation
Correct answer: C
Explanation
For a site-to-site VPN in Azure, you need three main resources in Azure: the Virtual Network Gateway (configured for route-based or policy-based VPN), the Local Network Gateway (defining on-premises endpoint and address ranges), and the connection resource (that specifies the IPsec pre-shared key and links both gateways). Without the connection resource, the tunnel cannot be established. For more details, see Microsoft� documentation on 'Configure a site-to-site connection' in Azure.
- A. Incorrect.
Incorrect: While you do need to allow traffic on UDP ports 500 and 4500 for IKE and IPsec, simply modifying the NSG rules in Azure is not sufficient if you never define the connection resource itself. The NSG rules alone won�t establish the tunnel.
- B. Incorrect.
Incorrect: Virtual Network Peering is used to connect two Azure VNets within Azure. It does not connect an on-premises network to a VNet, and therefore cannot be used for site-to-site VPN connections.
- C. Correct.
Correct: You must explicitly create a connection resource that links the Virtual Network Gateway to the Local Network Gateway, including the shared IPsec/IKE pre-shared key. This step finalizes the site-to-site VPN configuration in Azure.
- D. Incorrect.
Incorrect: Forced tunneling steers internet traffic through the on-premises edge, but it does not create or replace the actual site-to-site VPN connection resource. Enabling forced tunneling is optional and not required to establish basic VPN connectivity.