Exam AZ-103 topic 4 question 52 discussion

Why 2 local network gateways? On Azure, you would need only 1. You will need 2 on your onprem env.

Correct, see https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-site-to-site-resource-manager-portal#LocalNetworkGateway When creating the Local Network gateway in Azure it says: "IP address: This is the public IP address of the VPN device that you want Azure to connect to." So the IP's of the local gateway are not Azure Public IP's and the question is about what resources you need in Azure.

referring doc this ans is correct

2 IPs, 1 VPN Gateway, 2 Local Network Gateways. Here's Why: 1. https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-highlyavailable#multiple-on-premises-vpn-devices 2. https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateways **This a Multiple On-Premis Device setup** 1. The MS docs specify: for every on-premis VPN device you need a Local Network Gateway. As there are two on-premis VPN devices you need two Az Local Network Gateways. 2. The MS docs also says for every Local Network Gateway you need a unique Public IP address. Therefore 2x Local Network Gateways = 2x Pubic IPs. ("The local network gateways corresponding to your VPN devices must have unique public IP addresses in the "GatewayIpAddress" property.") 3. There is only one vNET in the question, a vNET can have only one VPN Gateway, but it can have multiple connections. Therefore only 1 Az VPN Gateway required.

1-> VNG* (not LG) 1-> Only 1 ip in AZURE 2 ->2 LNG but NOT AZURE ip required.

Try this: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-highlyavailable We can using a simple scheme - 2 on-prem GW + 1 azure vpn GW (active/passive mode because as MS says "For unplanned issues, the connection recovery will be longer, about 1 minute to 1 and a half minutes in the worst case"). So, why can't we use 1,1,2?

The question states that ''..ensure that if a single instance of an Azure VPN gateway fails, or a single on-premises VPN device fails...''. If it is considering a failure on Azure VPN Gateway, we need to have two of them. So, 2-2-2. Two VPN Gateways, two IPs, two local gateways.

If I read this Active Active is not required https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-highlyavailable Every Azure VPN gateway consists of two instances in an active-standby configuration. For any planned maintenance or unplanned disruption that happens to the active instance, the standby instance would take over (failover) automatically, and resume the S2S VPN or VNet-to-VNet connections. The switch over will cause a brief interruption. For planned maintenance, the connectivity should be restored within 10 to 15 seconds. For unplanned issues, the connection recovery will be longer, about 1 minute to 1 and a half minutes in the worst case. For P2S VPN client connections to the gateway, the P2S connections will be disconnected and the users will need to reconnect from the client machines. so it would be 1 1 2