# Virtual Network Gateway

> Virtual network gateways, the underlying resource behind both VPN and ExpressRoute connectivity, bill hourly by SKU whether or not any traffic flows. An oversized SKU chosen on day 1 keeps charging its full rate indefinitely, so ZopNight records gateway type and SKU via Resource Graph to drive downgrade and cleanup review.

Source: https://zop.dev/integrations/azure/vnet-gateway
Updated: 2026-08-19

---

Virtual network gateways are the underlying gateway resources for VPN and ExpressRoute connectivity, billed hourly by SKU whether or not traffic flows. Oversized gateway SKUs are a common set-and-forget cost.

## One resource, two connectivity roles

The virtual network gateway is the generic Azure resource that both connectivity products instantiate: created with type Vpn it terminates IPsec tunnels, created with type ExpressRoute it attaches a VNet to a circuit. The distinction matters for cost review because the two roles fail differently. A VPN-type gateway goes idle when its remote sites disappear, while an ExpressRoute-type gateway goes idle when the circuit behind it is deprovisioned or traffic moves to another path. Either way the gateway itself keeps metering, because its charge is bound to existence, not throughput.

## SKU-hours regardless of throughput

Every gateway bills hourly at a rate set by its SKU, and the SKU ladder trades money for throughput and features. The meter is flat: hour after hour at the chosen tier, with data transfer charged separately where applicable. Since resizing is possible but disruptive, gateways are usually sized once at project start, when nobody knows the real traffic profile, and the initial guess hardens into a permanent rate.

## The set-and-forget SKU problem

Oversizing is the signature waste here. A high-throughput SKU selected "to be safe" for a link that settled at a fraction of its capacity pays the premium tier every hour for years. The second pattern is the stranded gateway: an ExpressRoute-type gateway left attached to a VNet after its circuit was decommissioned, or a VPN-type gateway surviving a connectivity redesign. ZopNight's coverage (discovered via Azure Resource Graph with gateway type and SKU, spend attributed through Cost Management) exists precisely to support SKU-downgrade and cleanup review. Gateways are discovery and cost visibility only; no stop operation exists, so savings come from resizing or deleting.

## Finding virtual network gateways in the portal

Azure portal → Virtual network gateways shows each gateway's type, SKU, and attached VNet. Reading the SKU against the gateway's actual utilization metrics is the downgrade check; a gateway of type ExpressRoute with no circuit connection remaining is the cleanup one.