VPN Gateway / ExpressRoute
Zone-redundant gateway VMs are automatic on eligible SKUs — Azure explicitly states you don't need to initiate or validate zone failover. A gateway is always a single-region resource, though: regional DR means deploying independent gateways yourself.
Basic SKU / active-standby, non-zonal
Basic SKU VPN Gateway, or a non-zone-redundant SKU in active-standby mode — one gateway VM active, one on standby.
- Replication
- None
- RPO
- N/A — connectivity layer, not a data store
- RTO
- N/A across a zone failure — no zone protection
- Failover trigger
- Automatic
Basic SKU is explicitly dev/test only, with a lower SLA and no zone redundancy support.
Zone-redundant gateway SKU (VpnGw1AZ+ / ErGw1AZ+)
Gateway VMs automatically distributed across Availability Zones. Detection and failover are fully platform-managed — no customer action needed to initiate or validate it.
- Replication
- None
- RPO
- N/A — stateless connectivity layer, no persistent customer data
- RTO
- Brief interruption, typically up to about one minute while traffic redistributes
- Failover trigger
- Automatic
No extra cost for zone redundancy on VPN Gateway with an eligible SKU. ExpressRoute zone-redundant SKUs (ErGw1AZ+) do carry a higher rate.
Independent gateways in a second region (customer-built)
A gateway is inherently a single-region resource — if the region fails, the gateway fails with it. There is no cross-region replication of gateway state. The standard pattern is deploying a fully separate gateway (and, for ExpressRoute, a second circuit through a different peering location) in another region, with no interaction between the two.
- Replication
- N/A
- RPO
- N/A — connectivity layer
- RTO
- Entirely dependent on your architecture — client/on-premises devices must be configured or reconfigured to reach the surviving gateway
- Failover trigger
- Manual (customer-triggered)
Gotchas
A single ExpressRoute circuit is a single point of failure, SLA notwithstanding
ExpressRoute's per-circuit SLA describes that circuit's own uptime — it says nothing about the peering location it runs through. Real resiliency requires two connections through different peering locations (sites); a lone circuit, however well its SLA reads, is one physical-site outage away from a total connectivity loss.
Zone redundancy is automatic, but region redundancy never is
Microsoft's own reliability guidance is explicit: a virtual network gateway is a single-region resource, full stop. There's no premium SKU or setting that adds cross-region failover — regional DR for connectivity is always a second, independently managed gateway (and, for site-to-site VPN, reconfigured on-premises devices).
Basic SKU gateways have no zone redundancy option at all
Every VPN Gateway SKU except Basic supports zone redundancy — if a gateway is on Basic SKU in production, it has neither the SLA nor the zonal protection of the rest of the fleet.