| Aspect | Azure VPN Gateway | AWS Site-to-Site VPN | Google Cloud VPN |
|--------|-------------------|----------------------|-----------------|
| Starting price | Published gateway compute and data egress pricing (region and SKU dependent) | Published per-connection and data transfer pricing; optional acceleration features incur additional published charges | Published tunnel/gateway and data transfer pricing; costs depend on topology and endpoints |
| Recommended use | Azure-centric hybrid networking into VNets using a managed gateway model | AWS-centric hybrid connectivity into VPCs using managed AWS VPN constructs | GCP-centric hybrid connectivity into VPCs using managed Cloud VPN |
| Key strengths | Integration with Azure networking; supports S2S, P2S, VNet-to-VNet; managed operational model | Per-connection pricing model integrated with AWS networking services | Fit for GCP networks with explicit guidance on transfer charging relative to tunnel endpoints |
| Key weaknesses | Recurring feedback about perceived cost and troubleshooting complexity; HA/failover behaviors can disconnect P2S clients in some configurations | Subject to data transfer costs and complexity when combined with multi-component AWS network designs (TGW, Cloud WAN) | Similar complexity tradeoffs and pricing variability depending on transfer and topology details |
Narrative analysis
- Azure VPN Gateway versus ZTNA alternatives (Cloudflare Zero Trust, Twingate, Prisma Access)
- ZTNA solutions are not direct 1:1 replacements for S2S VPN; they often replace remote user VPN with app- or identity-centric access patterns.
- If the primary requirement is remote user access to specific private applications rather than full network-level access, ZTNA and identity-centric architectures may be more appropriate.
- This perspective appears across operator discussions and third-party comparison pages.
- Azure VPN Gateway versus NVAs (Fortinet/Palo Alto VM firewalls in Azure)
- NVAs can provide richer security features (next-generation firewall capabilities, advanced routing) and may be cost-effective in some scenarios, but they require licensing, VM sizing and scaling, high-availability architecture design, and operational ownership for patching and maintenance.
- Some practitioners report choosing NVA deployments in Azure in response to specific feature or cost tradeoffs.