If configuring VPN Gateway (site-to-site) with a static IP, does Azure charge an cost outside of VPN Gateway use for securing this Static IP?

Question

Hello,

When checking the Azure Pricing Calculator, regarding VPN gateway (site-to-site), I wish to confirm whether there is a "static IP" cost that is not listed in the Azure Pricing calculator or not (Or if this is a cost embedded in "Site to Site (S2S) Tunnels" -> "additional tunnels" charge)

In the Pricing Calculator, Under VPN Gateway, the "Basic VPN" option does not have an "Site to Site (S2S) Tunnels" -> "additional tunnels" charge.
HOWEVER, any gateway type above this (VpnGw1, VpnGw1 AZ, VpnGw2, etc) does have an associated cost.

If configuring VPN Gateway with a static IP:

1) Does this "tunnel cost" include securing the static IP?
2) Is it a separate cost from VPN Gateway?

Conversely, If IT IS a separate cost, configuring with dynamic IP instead, is this cost waived?

Thank you so much

Answer 1

Hello @Peter Thurwachter (MINDTREE LIMITED) ,

Apologies for the delay in response.

The price of the gateway does not include any IP addresses. As per this article, VPN gateway pricing consists of two things: the hourly compute costs for the virtual network gateway, and the egress data transfer from the virtual network gateway.

Public IP addresses have a nominal charge. To learn more about IP address pricing in Azure, review the IP address pricing page. And there is not much of a difference between Basic Static and Standard Static IP address pricing.

Zone-redundant and zonal gateways (gateway SKUs that have AZ in the name) both rely on a Standard SKU Azure public IP resource and these public IP resources must use a static allocation method. Other VPN gateway SKUs (such as VpnGw1, 2, 3.. etc) uses a Basic dynamic Public IP address by default.
Reference : https://learn.microsoft.com/en-us/azure/vpn-gateway/about-zone-redundant-vnet-gateways
https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-vpn-faq#can-i-get-my-vpn-gateway-ip-address-before-i-create-it

Regarding your question "In the Pricing Calculator, Under VPN Gateway, the "Basic VPN" option does not have an "Site to Site (S2S) Tunnels" -> "additional tunnels" charge. However, any gateway type above this (VpnGw1, VpnGw1 AZ, VpnGw2, etc) does have an associated cost."
The answer is : The first 10 S2S tunnels are included in the VPN gateway monthly pricing and only the tunnels 11 to 30 are charged as additional tunnels. Since Basic SKU VPN gateway can only have a maximum 10 tunnels, it doesn't have additional tunnels charge in the pricing calculator, however other SKUs such as (VpnGw1,2,3 etc) all have a maximum of 30 tunnels and hence they have an additional tunnel charge included in the pricing calculator for tunnels 11 to 30.

Coming to your last question:
If configuring VPN Gateway with a static IP:

1. Does this "tunnel cost" include securing the static IP? : No, it doesn't include the IP address cost.
2. Is it a separate cost from VPN Gateway? " : Yes, Public IP address cost is separate from the VPN gateway since Public IP address is a resource that has its own properties.
   Conversely, If it is a separate cost, configuring with dynamic IP instead, is this cost waived? : Like I mentioned before, Public IP addresses have a nominal charge as below:
   Basic (ARM) dynamic Public IP address costs $0.004/hour
   Basic (ARM) Static Public IP address costs $0.0036/hour
   Standard (ARM) Static Public IP address costs $0.005/hour

So, if you check the monthly pricing of these Public IP addresses, their difference is not a lot:

Kindly let us know if the above helps or you need further assistance on this issue.

----------------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.