Why Azure VPN Gateway Needs a Public IP Address for Site-to-Site Tunnels
An administrator is deploying a site-to-site VPN gateway in Azure. The GatewaySubnet already exists, but the deployment fails because no public-facing address is available for the gateway. What is required for the gateway to deploy and accept the on-premises connection?
Quick Answer
The answer is to create and associate a public IP address with the VPN gateway. A site-to-site VPN gateway in Azure requires this public-facing address because it acts as the endpoint for the encrypted IPsec/IKE tunnel, allowing the gateway to send and receive traffic over the internet with the on-premises VPN device. Without a public IP assigned to the gateway’s frontend configuration, the deployment fails because Azure cannot provision a routable endpoint for the tunnel. On the AZ-104 exam, this concept tests your understanding of networking prerequisites—a common trap is assuming the GatewaySubnet alone is sufficient, but the subnet only hosts the gateway; the public IP is the actual communication endpoint. Remember the memory tip: “No public IP, no tunnel—the gateway needs a front door to talk to the outside world.”
⚠ Common exam trap
A common mix-up: candidates confuse the GatewaySubnet delegation requirement (which is already satisfied by default) with the need for a public IP address, or incorrectly think a Load Balancer or private endpoint can substitute for the public IP that is mandatory for site-to-site VPN connectivity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create and associate a public IP address with the VPN gateway.
A site-to-site VPN gateway in Azure requires a public IP address to establish the encrypted tunnel with the on-premises VPN device. The public IP address is assigned to the gateway's frontend configuration, enabling it to send and receive IPsec/IKE traffic over the internet. Without this public-facing address, the gateway cannot be provisioned or accept the on-premises connection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign a standard Load Balancer to the GatewaySubnet.
Why it's wrong here
A load balancer is not a replacement for the public IP resource required by the VPN gateway.
When this WOULD be correct
When deploying a load-balanced application behind a VPN gateway, such as for high-availability scenarios, you might associate a Standard Load Balancer with the gateway subnet to distribute traffic across multiple gateway instances.
- ✗
Create a private endpoint for the virtual network gateway.
Why it's wrong here
Private endpoints are used for supported PaaS services, not for exposing VPN gateway termination to on-premises peers.
When this WOULD be correct
This option would be correct in a scenario where the question asks how to securely connect to an Azure SQL Database from an on-premises network without exposing it to the public internet. In that case, creating a private endpoint for the SQL Database within a virtual network would be the appropriate solution.
- ✓
Create and associate a public IP address with the VPN gateway.
Why this is correct
A site-to-site VPN gateway needs a public IP address so the on-premises VPN device can establish and maintain the tunnel to Azure. The GatewaySubnet is the correct dedicated subnet, but it is not enough by itself. The gateway also requires a public-facing address resource assigned during deployment so it can receive VPN connections from outside Azure.
- ✗
Delegate the GatewaySubnet to Microsoft.Network/privateEndpoints.
Why it's wrong here
Subnet delegation for private endpoints is unrelated to VPN gateway deployment and does not provide tunnel termination.
When this WOULD be correct
This option would be correct in a scenario where you need to allow a private endpoint (e.g., for Azure SQL Database) to be created in a subnet. The question would ask: 'You need to configure a subnet to host a private endpoint. What should you do?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create and associate a public IP address with the VPN gateway.Correct answer▾
Why this is correct
A site-to-site VPN gateway needs a public IP address so the on-premises VPN device can establish and maintain the tunnel to Azure. The GatewaySubnet is the correct dedicated subnet, but it is not enough by itself. The gateway also requires a public-facing address resource assigned during deployment so it can receive VPN connections from outside Azure.
✗Assign a standard Load Balancer to the GatewaySubnet.Wrong answer — click to see why▾
Why this is wrong here
A standard Load Balancer is not used for VPN gateway public IP assignment; VPN gateways require a public IP address resource, not a load balancer, to provide the public-facing endpoint for site-to-site connections.
★ When this WOULD be the correct answer
When deploying a load-balanced application behind a VPN gateway, such as for high-availability scenarios, you might associate a Standard Load Balancer with the gateway subnet to distribute traffic across multiple gateway instances.
Why candidates choose this
Candidates may confuse the need for a public endpoint with load balancing, thinking a load balancer can provide the public IP, or they may recall that load balancers are used in other Azure networking scenarios.
✗Create a private endpoint for the virtual network gateway.Wrong answer — click to see why▾
Why this is wrong here
A private endpoint is used to securely connect to Azure PaaS services over a private IP address, not to provide public-facing connectivity for a VPN gateway. The VPN gateway requires a public IP address to establish the site-to-site tunnel with the on-premises device.
★ When this WOULD be the correct answer
This option would be correct in a scenario where the question asks how to securely connect to an Azure SQL Database from an on-premises network without exposing it to the public internet. In that case, creating a private endpoint for the SQL Database within a virtual network would be the appropriate solution.
Why candidates choose this
Candidates may confuse private endpoints with the need for private connectivity, thinking that a private endpoint could replace the public IP requirement for the VPN gateway, or they may mistakenly believe that a private endpoint can provide the necessary network interface for the gateway.
✗Delegate the GatewaySubnet to Microsoft.Network/privateEndpoints.Wrong answer — click to see why▾
Why this is wrong here
Delegating the GatewaySubnet to Microsoft.Network/privateEndpoints is used for private endpoints, not for VPN gateways. VPN gateways require a public IP address for site-to-site connectivity, not a private endpoint delegation.
★ When this WOULD be the correct answer
This option would be correct in a scenario where you need to allow a private endpoint (e.g., for Azure SQL Database) to be created in a subnet. The question would ask: 'You need to configure a subnet to host a private endpoint. What should you do?'
Why candidates choose this
Candidates may confuse the need for network connectivity with private endpoints, thinking that delegating the subnet to a service provider is required for the gateway to function, similar to how subnet delegation works for other Azure services.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
Learn chapter
VPN Gateway and ExpressRoute
Key term
IP address
An IP address is a unique numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication.
Key term
Public IP address
A globally unique IP address assigned to a device that allows it to communicate directly over the internet.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
4 more ways this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator is deploying an Azure VPN gateway for a site-to-site connection. The deployment fails because required network resources are missing. Which configuration is required before the gateway can be created?
medium- ✓ A.A subnet named GatewaySubnet and a public IP address for the VPN gateway.
- B.A subnet named AzureBastionSubnet and a static private IP address.
- C.A network security group attached directly to the virtual network gateway.
- D.A load balancer with a public frontend to terminate the VPN connection.
Why A: A VPN gateway in Azure requires a dedicated subnet named 'GatewaySubnet' to host the gateway instances, and a public IP address resource must be allocated to the gateway to establish the site-to-site VPN tunnel over the internet. Without these two prerequisites, the deployment will fail because the gateway cannot be provisioned or addressed externally.
Variation 2. An administrator is deploying a site-to-site VPN gateway in the Azure portal. The deployment fails validation because the gateway does not have a public-facing address to terminate the tunnel. What must be created and associated with the VPN gateway?
medium- A.A load balancer frontend IP configuration in front of the gateway subnet.
- ✓ B.A public IP address resource associated with the VPN gateway.
- C.A NAT gateway attached to GatewaySubnet.
- D.A private endpoint for the virtual network gateway resource.
Why B: A site-to-site VPN gateway in Azure requires a public IP address to terminate the IPSec tunnel from the on-premises device. The public IP address resource must be created and associated with the VPN gateway during deployment; without it, the gateway has no routable endpoint for the tunnel, causing validation to fail.
Variation 3. An administrator is deploying a site-to-site VPN gateway in Azure. Which resource must be attached to the gateway so it can receive encrypted connections from the on-premises VPN device?
easy- ✓ A.A public IP address resource.
- B.A private endpoint.
- C.A service endpoint.
- D.A network security group.
Why A: A site-to-site VPN gateway in Azure requires a public IP address resource to be attached so that the on-premises VPN device can establish an encrypted IPsec/IKE tunnel to it. The public IP address provides the routable endpoint on the internet that the on-premises device connects to, and it is assigned to the gateway's front-end configuration. Without this public IP, the gateway cannot receive inbound encrypted traffic from the external network.
Variation 4. An administrator is preparing an Azure site-to-site VPN gateway deployment for an existing VNet. Which two prerequisites must be in place for the gateway to deploy successfully? Select two.
medium- ✓ A.A dedicated GatewaySubnet must exist in the VNet.
- ✓ B.The gateway must have a public IP address resource assigned to it.
- C.The VNet must already contain a private endpoint for on-premises connectivity.
- D.A network security group must be attached to the GatewaySubnet.
- E.The VNet must use a service endpoint for Microsoft.Network.
Why A: A dedicated GatewaySubnet is a mandatory requirement for deploying any Azure VPN gateway. This subnet must be named 'GatewaySubnet' and must have a minimum address prefix of /29 (though /27 is recommended) to accommodate the gateway VMs and future scaling. Without this subnet, the gateway creation will fail as Azure uses it to host the gateway VMs and route traffic. Additionally, the VPN gateway requires a public IP address resource to be assigned to it. This public IP provides the internet-facing IP address used for the IPsec tunnel, and without it the gateway cannot be deployed. Both are mandatory prerequisites.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.