Site-to-site VPN vs point-to-site VPN

windows azure security vpn azure-virtual-network
user2713516 picture user2713516 · May 10, 2017 · Viewed 18.1k times · Source

I have a scenario where I have a Windows VM in windows Azure that needs to connect to an external customer network (and connect to a database that is not in Azure).

This traffic is uni-directional in that it is only my VM that needs to connect to the customer's databases and not the other way around. Site to site is managed on Azure, which I cannot really test locally.

Conceptually, connecting to the customer's network via a point-to-site VPN seems more suitable (by creating the VPN connection in Windows itself via the network config).

The customer prefers site-to-site even though they don't need to connect to my VM. Am I missing something?

Answer

Bruno Faria picture Bruno Faria · May 10, 2017

In point-to-site, you have to connect to the network you want to access manually. Usually, if you log-off or restart the workstation it loses connection, and you have to reconnect every time. It's common to use this type of VPN when we are working remotely, and we need to access our company assets. The channel is bi-directional, but it's 1-to-many.

Site-to-site is used when you want to connect two networks and keep the communication up all the time. It's also bi-directional, but it's many-to-many and stays up no matter if your server/workstation is running or not because the connection is established through a network gateway and not from the computer operating system.

In Azure, the Virtual Network Gateway is the platform providing both functionalities. You can configure site-to-site to connect to your customer network. If this network is not running in Azure, they usually have an appliance to establish dedicated tunnels. As long as it supports IPsec IKE, you are good to go.

If you are using the VM in Azure as a workstation, then point-to-site may be enough, but if your application needs to get data from the customer database automatically with or without someone logged in the VM, then site-to-site is a better approach.

A better explanation can be found here

Related questions

MSOnline can't be imported on PowerShell (Connect-MsolService error)

I had this issue and couldn´t find any answer. The issue was that I was trying to use Azure cdmlets to connect to O365 via c# code, but I couldn´t get the connect-msolservice. ""The term is not recognized" …

Read More
Windows Azure Virtual Machine - Opening a port

I am trying to open a port in a Windows Azure virtual machine. I have a game listening on that port, and I am able to access it via localhost, so the game is running. I have also opened the …

Read More
How do I upload some file into Azure blob storage without writing my own program?

I created an Azure Storage account. I have a 400 megabytes .zip file that I want to put into blob storage for later use. How can I do that without writing code? Is there some interface for that?

Read More