Azure Stack often needs to be integrated into public Azure or other on-premise infrastructure setups. This is where a site-to-site VPN connection needs to be in place to connect the different infrastructure services. As Azure Stack nowadays is working with a shared VPN device for all customers on it, you will need to set up the site-to-site connection between some devices on premise, in Azure, or even using a network virtual appliance from a third party vendor to set up the connectivity needed.