AZ-700 Question 93
Single answerYou have created a virtual network with the required gateway subnet and deployed a VPN-type virtual network gateway to establish a site-to-site (S2S) VPN connection from your on-premises network to Azure. However, the connection keeps failing, and the Azure gateway logs show that no valid on-premises address space is found. In reviewing your configuration, which action should you take to properly establish the S2S VPN connection?
- A
Recreate the virtual network gateway with the ExpressRoute gateway type.
- B
Enable Active-Active mode on the virtual network gateway.
- C
Correctly configure the Local Network Gateway with the on-premises public IP address and address range.
- D
Expand the gateway subnet size to accommodate future connections.
Show answer and explanation
Correct answer: C
Explanation
When creating and configuring a virtual network gateway for a site-to-site VPN, you must define both the Azure Virtual Network Gateway and the Local Network Gateway properly. The Local Network Gateway represents your on-premises environment in Azure, so it must contain the correct public IP address of your on-premises VPN device and the local IP address ranges. If these details are incorrect or missing, the connection will fail. For more information, refer to Microsoft documentation on configuring a site-to-site VPN connection (https://docs.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-site-to-site-resource-manager-portal).
- A. Incorrect.
Option 1 is incorrect. Changing the gateway type to ExpressRoute would not allow a site-to-site VPN connection. ExpressRoute gateways are for private dedicated connections, not standard IPsec VPN tunnels.
- B. Incorrect.
Option 2 is incorrect. While Active-Active mode provides increased availability by creating dual tunnels, it does not address the fundamental issue of the on-premises IP range configuration.
- C. Correct.
Option 3 is correct. The Local Network Gateway must be configured with the correct on-premises public IP address and local address range. If this configuration is incorrect or missing, the Azure Virtual Network Gateway cannot establish a site-to-site tunnel.
- D. Incorrect.
Option 4 is incorrect. Simply expanding the gateway subnet doesn't fix an address space mismatch. A larger gateway subnet allows for more advanced gateway configurations but won't resolve connection issues due to incorrect local network settings.