A retailer firewall drops any flow that returns on a different tunnel from the one it used outbound. They still want an Azure VPN that fails over if the active instance is lost. Which gateway mode fits?
Select an answer to reveal the explanation.
Short Explanation
Your firewall insists the reply walk back through the same door. You use Azure active-standby so one instance owns the path and failover moves that path as a unit. Active-active can send the reply through the other tunnel, and Microsoft does not promise those two directions match.
Full Explanation
Microsoft documents that an active-active VPN gateway may send return traffic on either tunnel and does not guarantee symmetry for a flow. A firewall that drops asymmetric flows will blackhole sessions in that mode. Active-standby keeps one instance active so the path fails over as a unit, which is the mode that fits a symmetry requirement and still recovers if that instance is lost. The recovery includes the brief interruption Microsoft describes for standby promotion. Active-active is the wrong choice when symmetry is mandatory, even though it fails over with less interruption. A policy-based Basic gateway does not run two active instances and does not run BGP. Two static routes toward one public address do not create a second Azure instance. Exam caveat: if the retailer can relax the firewall to accept both tunnels, active-active becomes the better availability choice. The stem does not allow that. Operational check: the gateway should show active-standby, and a flow capture on the firewall should see both directions of a session on the same tunnel.