I'm still new to Azure concept.

Here's what we have.

For example, we have a directory called shazoom

We have one resource grouped called magic under this group we have all our networking setup for S2S VPN that connects to our facility. (we have some web stuff that connects to the SQL DB from Azure to on premises

Now I'm being asked to create another S2S connection to our data center where we house production stuff for now

Do I have to create a whole new GW Subnet, setup another S2S VPN under the new one to connect to the data center? takin these are policy based VPN. If I need to create a new VNET will take break the current setup for the websites talking to our on premises if we add that to the new VNET?


You can have only one VNG and site-to-site connection for all of your VNETs, what you have to pay attention is how to make it works. For the new environment you can create a new VNET and then configure a VNET Peering between your current VNET where exists site-to-site connection and also configure transit gateway / remote gteway. Basically your new VNET is going to use a remote gateway (your current VNET) to reach out your on premises site.

Please have a look at this page (https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-peering-gateway-transit) and see a topology how it works.

You current VNET must have configured Allow gateway transit and your new VNET must have configured Use Remote Gateway, this scenario you have only one GatewaySubnet.

Usually you have a HUB networking VNET and all of your site SPOKE on Azure uses a peering with gateway transit.

Just take care about your address space between VNET to avoid overlapping, same IP for both site.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.