An engineer is preparing a VNet to host a site-to-site VPN gateway. The deployment fails because the subnet name is not accepted. Which subnet name is required for a VPN gateway?
Show answer and explanation
Answer: A
A virtual network gateway, such as a VPN gateway or ExpressRoute gateway, must be deployed into a subnet named exactly GatewaySubnet. Azure uses that name to identify the subnet where gateway instances are placed. Microsoft recommends a /27 or larger range to allow for growth and SKU changes. Other workloads should not share the subnet, and NSG association is not supported on it. Any other name will cause the deployment to fail.
Why the other options are wrong
- B. VPNSubnet is an arbitrary name with no special meaning to Azure. The portal and deployment would not recognize it as the gateway subnet, so the gateway could not be created there.
- C. AzureGatewaySubnet is not a recognized subnet name. Azure looks only for GatewaySubnet, so a subnet with this name would not be used for the gateway.
- D. GatewayTunnelSubnet is not the name Azure uses for virtual network gateways. Only GatewaySubnet is accepted, so this name would block the deployment.