How can I set up a site-to-site VPN between Azure VNet and an on-premises network using a single private IP for traffic selectors?

Below is an approach that many have found to work in this scenario:

---

Recommended Setup

Use the Azure VPN Gateway Private IP as the Traffic Selector

• Single Identity for On-Premises: Since the on-premises network only accepts one private IP for its traffic selectors, configure that to match the Azure VPN Gateway’s private IP address. This way, regardless of the VMs behind it, all traffic is funneled through the gateway.

• Routing Through the Gateway: In Azure, traffic from the VMs destined for on-premises will be routed to the VPN gateway. The gateway then encrypts and forwards traffic using its private IP that has been pre-approved by the on-premises team.

• No Need for Additional IPs: The VMs in your Azure VNet do not need to be added individually to the traffic selectors. Their traffic “inherits” the VPN gateway’s identity once it is routed through the gateway.

---

How It Works

1. Traffic Flow:

   • VM A/VM B → Routed to the Azure VPN Gateway
   • VPN Gateway → Uses its own private IP when establishing the VPN tunnel
   • On-Premises Gateway → Recognizes the traffic as coming from the approved IP address

2. Configuration on On-Premises Device:

   • Specify the approved Azure side IP (i.e., the VPN gateway’s private IP) in the traffic selectors settings.
   • Ensure that the on-premises device matches only this IP as the source/destination for the secured tunnel.

3. Azure VPN Gateway Behavior:

   • The gateway encapsulates the traffic from your VMs.
   • It presents the outbound traffic with its own IP address both for encryption and for IPsec processing, matching the configuration on the on-premises side.

---

Summary

Yes, using the VPN Gateway's private IP address as the single endpoint in your traffic selectors is a valid and common approach. This design simplifies the configuration since all your VMs' traffic destined for the on-premises network will be securely channeled through the gateway, which then becomes the identifiable endpoint.