A Generation1 VPN gateway SKU with zone redundancy, 650 Mbps and as many as 30 site-to-site tunnels. Because AZ SKUs survive a zone failure without dropping tunnels, they are recommended for new gateways.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains VpnGw1AZ in context, with comparison tables and the common traps.
Terms in this definition
- VPN gateway
Terminates IPsec tunnels for site-to-site, point-to-site and VNet-to-VNet connections, as a VPN-type virtual network gateway in GatewaySubnet. It gets a Standard static public IP when created, and that IP can't be swapped.
- SKU
The size or tier of a service, for example a VM size or the Premium tier of ACR.
- Redundancy
So that hardware failures, datacentre outages or a regional disaster cannot destroy data, Azure Storage keeps multiple copies: only in the primary region with LRS and ZRS, or in a secondary region as well with GRS and GZRS.
Related terms
- AZ SKU
Any VPN or ExpressRoute gateway SKU carrying the AZ suffix (VpnGw1AZ to 5AZ, ErGw1Az to 3Az). In regions with availability zones its instances spread across zones; in other regions it deploys regionally, becoming zone-redundant once zones are introduced there.
- VpnGw1
The entry-level VPN gateway SKU above Basic, without zone redundancy, offering 30 site-to-site tunnels and BGP; it is the minimum for ExpressRoute coexistence and OpenVPN/Entra ID point-to-site. Non-AZ VpnGw1 to VpnGw5 could not be created after 1 November 2025 and retired on 30 September 2026, moving to VpnGw1AZ to VpnGw5AZ.