We connect to multiple vendor and customer networks (our clients) from our Azure VNet, we have no control on what VPN gateway setup the client has. We cannot use the built-in Azure Virtual Network Gateway anymore due to multiple clients requiring policy-based tunnels. We also require NAT as our subnets overlap with our client's.

We are looking into an NGFW NVA such as PAN VM-Series, Check Point CloudGuard, Barracuda CloudGen but many of these are expensive and have way more features than we need.

I am wondering if Windows Server RRAS can be used but have found limited documentation on my scenario.

So what I would like to know is:

  1. Can RRAS manage 10-50 site-to-site tunnels all connected at the same time?

  2. Does it support multiple policy-based and route-based tunnels simultaneously?

  3. Are there any known limitations on what endpoint devices or tunnel configuration may be used at our clients' sites?

  4. Can static NAT be used to avoid subnet overlap conflicts at our clients' sites? Translating our VM's IP address to a non-conflicting address per tunnel (eg. per client)?

  5. Can we sandwich two RRAS VM's between two load balancers (external and internal) to provide HA or how would HA be expected to be configured? The load balancer sandwich is the setup used by all the thirdparty NGFW products from the vendors listed above.

  6. Is this scenario just too difficult for RRAS and we would be better off with one to the above thirdparty NGFW listed products?

Thank you.

1 Answer 1


RRAS is not supported by Microsoft to run on Azure: https://support.microsoft.com/en-gb/help/2721672/microsoft-server-software-support-for-microsoft-azure-virtual-machines and I think it will be anytime soon. When I worked at Microsoft I was involved once in trying to get it supported, but engineering decided it would not be.

And you can have multiple policy-based VPN connections on the same gateway pair: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-connect-multiple-policybased-rm-ps and also a mix of route-based and policy-based connections! :)

As per the non-RRAS questions of your list:

4) With a supported 3rd party NVA, yes, but ask the vendor for details.
5) Yes, this is a common solution with ILB HA ports feature. Ask the 3rd party NVA vendor as they usually have blueprints for these setups. In the past they just had scripts running inside the NVA to call ARM to change routes/public IPs/etc to failover from one instance to the other.
6) As RRAS is not supported, yes; but consider again Azure's native VPN solution as it might fit your needs.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .