Create Azure Virtual Network Gateway with Basic SKU Using PowerShell

Why Do You Need a Virtual Network Gateway?

A Virtual Network Gateway is essential for establishing secure connectivity between your on-premises network and Azure Virtual Network (VNet). It acts as the VPN endpoint in Azure, encrypting traffic using IPsec/IKE tunnels. Without it, you cannot create a secure VPN tunnel to Azure.

Why Use the Basic SKU?

• Cost-Effective: The Basic SKU is the most affordable option, making it ideal for test, dev, or non-production environments.

• Quick Deployment: Unlike higher SKUs that can take 30–45 minutes, the Basic SKU typically deploys in only 7–10 minutes.

• Sufficient for Small Workloads: Supports basic VPN connectivity without advanced features like BGP or high throughput.

Note: The Basic SKU is no longer available in the Azure Portal UI, but you can still deploy it using PowerShell or Azure CLI.

PowerShell Script to Deploy Basic SKU VPN Gateway

Here’s how to create a Virtual Network Gateway with Basic SKU in an existing VNet that already has a GatewaySubnet:

# Variables
$rg          = "rg-azxx-org-vpn"
$vnetName    = "vnet-azxx-org-vpn"
$gwName      = "vng-azxx-org-vpn"
$pipName     = "pip-vng-azxx-org-vpn"

# Resolve location from the existing resource group
$location = (Get-AzResourceGroup -Name $rg).Location

# Get existing VNet and GatewaySubnet
$vnet     = Get-AzVirtualNetwork -Name $vnetName -ResourceGroupName $rg
$gwSubnet = Get-AzVirtualNetworkSubnetConfig -Name "GatewaySubnet" -VirtualNetwork $vnet

# Create the required Public IP (Basic + Dynamic for Basic SKU gateways)
$pip = New-AzPublicIpAddress -Name $pipName -ResourceGroupName $rg -Location $location `
       -Sku Basic -AllocationMethod Dynamic

# Build the gateway IP configuration (binds GatewaySubnet + Public IP)
$ipcfg = New-AzVirtualNetworkGatewayIpConfig -Name "gwipconfig1" `
         -SubnetId $gwSubnet.Id -PublicIpAddressId $pip.Id

# Create the VPN Gateway (Basic SKU). Use RouteBased unless you specifically need PolicyBased.
New-AzVirtualNetworkGateway -Name $gwName -ResourceGroupName $rg -Location $location `
  -IpConfigurations $ipcfg -GatewayType Vpn -VpnType RouteBased -GatewaySku Basic

Key Points

• Ensure your VNet has a GatewaySubnet (required for the gateway).

• The Public IP must be Basic SKU and Dynamic allocation.

• Use RouteBased VPN type unless you have a specific need for PolicyBased.

Summary

The Basic SKU Virtual Network Gateway is a budget-friendly and fast-to-deploy option for test or non-production environments. While it lacks advanced features, it’s perfect for simple VPN connectivity scenarios.