A system integrator is connecting a legacy VPN appliance from 2010 that only supports policy-based VPN (static crypto maps) to an Azure VPN Gateway. The appliance also does not support BGP. Which Azure VPN Gateway mode/feature should the integrator select to ensure the VPN can be established and what are the trade-offs?

The correct option is to deploy a policy-based VPN connection. Legacy VPN appliances that only support policy-based VPNs (static crypto maps) and do not support BGP require an Azure policy-based VPN gateway. This gateway type is specifically designed for compatibility with such devices. However, policy-based VPNs have limitations: they do not support BGP, offer fewer features compared to route-based VPNs, are only available on specific SKUs (like the Basic SKU), and have restrictions on multiple tunnels and complex cross-premises routing. Using a route-based VPN Gateway with BGP disabled is incorrect because a policy-based appliance cannot establish a tunnel with a route-based gateway, even without BGP. Azure Virtual WAN is designed for modern, scalable network architectures and primarily uses route-based VPNs with BGP; it does not automatically translate policy-based configurations from legacy devices. Converting the device to NAT-traversal-enabled with L2TP is irrelevant as L2TP is a different VPN protocol and does not address the policy-based versus route-based fundamental incompatibility.