Managing VPN tunnel after office hours

Question

I have created a site-to-site vpn tunnel but want it to be disabled after office hours to save some costs.

Any recommendations on how to cut cost regarding the vpn tunnel?

Also saw some other posts where there is a way to delete and recreate the vpn gateway via ARM templates or Terraform. is there a guide for this?

Answer 1

@CHIA WAI YONG

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you would like to keep the costs of using a VPN Gateway to minimum.

I wouldn't suggest creating and deleting a VPN Gateway daily as a good option.

The best way is to make sure you select an SKU at better matches your requirement.

• Refer : SKU Comparison and pricing

You can still go ahead with deleting and recreating the VPN Gateway everyday.

• But you must make sure you use the same Public IP to be associated to the VPN Gateway
• For Bicep/ARM/Terraform templates,
  • VPN Gateway : https://learn.microsoft.com/en-us/azure/templates/microsoft.network/virtualnetworkgateways?pivots=deployment-language-arm-template
  • VPN Connection in a VPN gateway : https://learn.microsoft.com/en-us/azure/templates/microsoft.network/connections?pivots=deployment-language-arm-template
  Or also consider using Azure Automation Account + Powershell
  • How to use Automation account : https://learn.microsoft.com/en-us/azure/automation/learn/automation-tutorial-runbook-textual
  • How to create a VPN Gateway with Powershell : https://learn.microsoft.com/en-us/azure/vpn-gateway/create-routebased-vpn-gateway-powershell
  Kindly let us know if this helps or you need further assistance on this issue. Thanks, Kapil

---

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

Answer 2

Hi Chia,

Thanks for reaching out, certainly to cut costs regarding your site-to-site VPN tunnel, you have a few options:

• Automated shutdown: Configure an automated process to shut down the VPN tunnel during non-office hours and reactivate it when needed. This can be achieved using scripting or automation tools like Azure Logic Apps or AWS Lambda functions. By disabling the VPN tunnel during off-hours, you can significantly reduce costs.
• Reserved Instances: Check if your cloud provider offers reserved instances or reserved VPN connections. These programs allow you to commit to a longer-term contract in exchange for discounted rates. By committing to a reserved instance, you can save costs compared to using on-demand resources.

Traffic routing optimization: Review your network traffic patterns and optimize the routing of data. If possible, direct non-critical traffic over the public internet instead of going through the VPN tunnel. This can help reduce the amount of data transmitted over the VPN, resulting in lower costs.

Regarding deleting and recreating the VPN gateway using ARM templates or Terraform, both options can be used for infrastructure provisioning and management. Here's a general guide on using these tools:

ARM Templates:

• Start by creating an ARM template that defines your VPN gateway and associated resources (virtual network, subnets, etc.).
• Use the Azure portal, Azure CLI, or PowerShell to deploy the ARM template and provision the VPN gateway.
• To delete and recreate the VPN gateway, you can update the ARM template or create a new template with the desired changes.
• Use the appropriate deployment method (portal, CLI, PowerShell) to redeploy the ARM template and recreate the VPN gateway.

Terraform:

• Install and configure Terraform on your local machine.
• Create a Terraform configuration file (usually named main.tf) that describes the desired state of your VPN gateway and related resources.
• Run terraform init to initialize your Terraform project.
• Use terraform apply to provision the VPN gateway based on your configuration.
• To delete and recreate the VPN gateway, modify your Terraform configuration file and run terraform apply again to apply the changes.

Be aware that the exact steps and commands may vary based on your cloud provider and the specific details of your VPN setup. It's recommended to refer to the official documentation and guides provided by your cloud provider for detailed instructions on deploying, managing, and deleting VPN gateways using ARM templates or Terraform.

I hope this answers your query?