We connect to multiple vendor and customer networks (our clients) from our Azure VNet, we have no control on what VPN gateway setup the client has. We cannot use the built-in Azure Virtual Network Gateway anymore due to multiple clients requiring policy-based tunnels. We also require NAT as our subnets overlap with our client's.
We are looking into an NGFW NVA such as PAN VM-Series, Check Point CloudGuard, Barracuda CloudGen but many of these are expensive and have way more features than we need.
I am wondering if Windows Server RRAS can be used but have found limited documentation on my scenario.
So what I would like to know is:
Can RRAS manage 10-50 site-to-site tunnels all connected at the same time?
Does it support multiple policy-based and route-based tunnels simultaneously?
Are there any known limitations on what endpoint devices or tunnel configuration may be used at our clients' sites?
Can static NAT be used to avoid subnet overlap conflicts at our clients' sites? Translating our VM's IP address to a non-conflicting address per tunnel (eg. per client)?
Can we sandwich two RRAS VM's between two load balancers (external and internal) to provide HA or how would HA be expected to be configured? The load balancer sandwich is the setup used by all the thirdparty NGFW products from the vendors listed above.
Is this scenario just too difficult for RRAS and we would be better off with one to the above thirdparty NGFW listed products?