Cloudguard IAAS Routing doubt and S2S VPN

[Blason_R]

Hi Team,

Just a confusion about routing in Azure and would really appreicate if someone can help me on the doubt

I am going to setup Check Point cluster in Azure which will have 

• VNET - 10.1.0.0/16
• FE Subnet - 10.1.1.0/24
• BE Subnet- 10.1.2.0/24
• FE-FW1 - 10.1.1.4/24
• FE-FW2 - 10.1.1.5/24
• FE Cluster - 10.1.1.7/24
• BE-FW1 - 10.1.2.4/24
• BE-FW2 - 10.1.2.5/24
• BE Cluster - 10.1.2.7/24
• DB Subnet - 10.1.3.0/24 
• App Subnet - 10.1.4.0/24
• BE LB - 10.1.2.6/24
• FE LB - 10.1.1.6/24

In this case for DB & App Subnet UDRs will be

0.0.0.0/0  NH 10.1.2.4 or 10.1.2.6?

for 10.1.0.0/16 NH 10.1.2.4 or 10.1.2.6?

Plus I have received two public IP addresses for both the VMs. Since I wanted to configure VPN which Public IP should be configured on VPN Link selection page?

TIA

Blason R