I want to create 2 tunnels between Azure and my On Prem VPN (VPN Gateway 1 <=> On Prem VPN 1, VPN Gateway 2 <=> On Prem VPN 2). I need to use failover static route for these 2 tunnels, so how should I route on Azure for it to be done. Thanks, Duong Le

Hello @Lê Vũ Thùy Dương , Thank you for the update. Case 1: In case you want automatic failover between 2 VPN tunnels configured with 1 Azure VPN gateway & 2 on-premise VPN devices, then using BGP will allow the two connections to the same on-premises network to be UP at the same time and will support automatic and flexible prefix updates. Refer : https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-highlyavailable#multiple-on-premises-vpn-devices In case you want to use static routes, you need to set up a connection with LNG (local network gateway) pointing to VPN device 1, having the on-premises address range. Then create another connection with 2nd LNG having the Public IP of the VPN device 2 and the on-premises address range in there as well. What you will see is that since both connections have the same local range (which can cause an overlap) only the first one will come up while the second one will show disconnected but the moment the first connection goes down the second one will come up. So on Azure side, it will be taken care of automatically as long as you have the VPN gateway with 2 connections to the same on-premises site via 2 different local network gateways configured with 2 different VPN devices. Case 2: I'm not sure why you would want to setup case 2 where you have 2 VPN gateways in Azure with 2 on-premises VPN devices but this setup will not work if you have a single Vnet in Azure to access your resources as each virtual network can have only one VPN gateway. Refer : https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateways If you want to deploy the VPN gateway to a different Vnet and peer that Vnet with your other existing Vnets, then this setup is possible but then again it will be 2 different tunnels unless you create cross connections between the 2 VPN gateways & 2 VPN devices which will consist of total 4 tunnels as below: VPN gateway 1 ---> On-premise VPN 1 VPN gateway 1 ---> On-premise VPN 2 VPN gateway 2 ---> On-premise VPN 1 VPN gateway 2 ---> On-premise VPN 2 And the configuration & failover mechanism will be similar to what I explained above in case 1 static routes scenario. But with BGP, this setup will simplify to 1 VPN gateway with active-active configuration & 2 on-premises VPN devices as explained in below article: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-highlyavailable#dual-redundancy-active-active-vpn-gateways-for-both-azure-and-on-premises-networks Kindly let us know if the above helps or you need further assistance on this issue. ---------------------------------------------------------------------------------------------------------------- Please " Accept the answer " if the information helped you. This will help us and others in the community as well.

Route table of 2 tunnels between Azure and On Prem VPN

Accepted answer

GitaraniSharma-MSFT 47,676 Reputation points Microsoft Employee

2021-10-08T12:36:33.957+00:00

Hello @Lê Vũ Thùy Dương ,

Thank you for the update.

Case 1:
In case you want automatic failover between 2 VPN tunnels configured with 1 Azure VPN gateway & 2 on-premise VPN devices, then using BGP will allow the two connections to the same on-premises network to be UP at the same time and will support automatic and flexible prefix updates.
Refer : https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-highlyavailable#multiple-on-premises-vpn-devices

In case you want to use static routes, you need to set up a connection with LNG (local network gateway) pointing to VPN device 1, having the on-premises address range. Then create another connection with 2nd LNG having the Public IP of the VPN device 2 and the on-premises address range in there as well.

What you will see is that since both connections have the same local range (which can cause an overlap) only the first one will come up while the second one will show disconnected but the moment the first connection goes down the second one will come up. So on Azure side, it will be taken care of automatically as long as you have the VPN gateway with 2 connections to the same on-premises site via 2 different local network gateways configured with 2 different VPN devices.

Case 2:
I'm not sure why you would want to setup case 2 where you have 2 VPN gateways in Azure with 2 on-premises VPN devices but this setup will not work if you have a single Vnet in Azure to access your resources as each virtual network can have only one VPN gateway.
Refer : https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateways

If you want to deploy the VPN gateway to a different Vnet and peer that Vnet with your other existing Vnets, then this setup is possible but then again it will be 2 different tunnels unless you create cross connections between the 2 VPN gateways & 2 VPN devices which will consist of total 4 tunnels as below:

VPN gateway 1 ---> On-premise VPN 1
VPN gateway 1 ---> On-premise VPN 2
VPN gateway 2 ---> On-premise VPN 1
VPN gateway 2 ---> On-premise VPN 2

And the configuration & failover mechanism will be similar to what I explained above in case 1 static routes scenario.

But with BGP, this setup will simplify to 1 VPN gateway with active-active configuration & 2 on-premises VPN devices as explained in below article:
https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-highlyavailable#dual-redundancy-active-active-vpn-gateways-for-both-azure-and-on-premises-networks

Kindly let us know if the above helps or you need further assistance on this issue.

----------------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Please sign in to rate this answer.

1 person found this answer helpful.
Lê Vũ Thùy Dương 36 Reputation points

2021-10-11T01:15:33.25+00:00

Thank you very much, @GitaraniSharma-MSFT
Your information is very helpful to me.

Regards,

Duong Le

Lê Vũ Thùy Dương 36 Reputation points

2021-10-11T03:01:39.157+00:00

Hi @GitaraniSharma-MSFT

I have one more problem that I need your help with.

For Case 1: If I use 1 VPN Gateway and 2 On Prem VPN and VPN Gateway use active-active mode and static route, is it still ok? So will the configuration & failover mechanism be same as what you explained above in case of 1 scenario of static routes correct or is there something else changed?

Thanks,
Duong Le

GitaraniSharma-MSFT 47,676 Reputation points Microsoft Employee

2021-10-11T08:17:27.107+00:00

Hello @Lê Vũ Thùy Dương ,

If you use 1 VPN Gateway and 2 On Prem VPN devices but the VPN Gateway uses active-active mode and static route, you would need to create 4 connections.
Active-active gateways have two Gateway IP configurations and two public IP addresses.
Refer : https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-highlyavailable#active-active-vpn-gateways
https://learn.microsoft.com/en-us/azure/vpn-gateway/active-active-portal

This means, the connectivity to your on-premises devices should be enabled between both your on-prem VPN device IPs and both Public IPs of the Azure VPN gateway. So, you will create 2 local network gateways but 4 connections as below:

VPN gateway Public IP address 1 ---> On-premise VPN 1
VPN gateway Public IP address 1 ---> On-premise VPN 2
VPN gateway Public IP address 2 ---> On-premise VPN 1
VPN gateway Public IP address 2 ---> On-premise VPN 2

The failover mechanism will be similar to what I explained in case 1 static routes scenario.

Thanks,
Gita

Lê Vũ Thùy Dương 36 Reputation points

2021-10-11T08:47:31.857+00:00

Thanks for your support, @GitaraniSharma-MSFT

Regards,

Duong Le

Nay Lin Oo 0 Reputation points

2024-01-13T08:50:23.78+00:00

Hi GitaraniSharma-MSFT, Would you mind to explain the route process and traffic flow detail behind the Case 1 ?

When I do testing, Failover/Failback process is very fast and looks like working

Based on the best practice scenario, we must use the BGP.

May I know the disadvantage behind the case 1 ?

GitaraniSharma-MSFT 47,676 Reputation points Microsoft Employee

2024-03-07T11:11:52.7533333+00:00

Hello @Nay Lin Oo ,

Apologies for the delay in response as I missed this comment.

The S2S IPSEC connections use the LPM (Longest Prefix Match) standard for both static routing (Local Network Gateway address spaces) and dynamic routing (BGP).

https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview#how-azure-selects-a-route

VPN gateways have active/passive data paths by default. If the ‘active’ or ‘primary’ instance goes down due to required reboot or failure the ‘passive’ or ‘secondary’ instance will take over running the VPN tunnel. VPN gateways do encrypt and decrypt traffic. It is the VPN gateway who sends its learned routes to the VNet, so the VMs can learn them. These routes are added to the effective routes of the VMs and then LMP is used to route the traffic.

May I know the disadvantage behind the case 1?

You need to manage the route manually or configure the routes on your VPN devices in a way that they should be removed or withdrawn automatically in case of any failure, so that the traffic will be switched over to the other active IPsec tunnel.

You will not have the ease of automatic and flexible prefix updates. Every time, some address spaces are changed/added/removed, you need to manually change/add/remove them in the local network gateways.

You cannot have automatic propagation of address prefixes from different networks when they're indirectly connected (transit routing feature). You will have to create 1:1 S2S VPN connections between the sites and Vnets and add all the address prefixes to the LNGs for it to work.

Refer: https://learn.microsoft.com/en-us/answers/questions/844525/problem-on-creating-vpn-gateway-on-existing-vnet

Regards,

Gita
Sign in to comment

Route table of 2 tunnels between Azure and On Prem VPN

0 additional answers