Configure ExpressRoute and Site-to-Site coexisting connections

Configuring Site-to-Site VPN and ExpressRoute coexisting connections has several advantages. You can configure a Site-to-Site VPN as a secure failover path for ExressRoute, or use Site-to-Site VPNs to connect to sites that are not connected through ExpressRoute. We cover the steps to configure both scenarios in this article. This article applies to the Resource Manager deployment model and uses PowerShell. This configuration is not available in the Azure portal.

Important

ExpressRoute circuits must be pre-configured before you follow the instructions below. Make sure that you have followed the guides to create an ExpressRoute circuit and configure routing before you proceed.

Limits and limitations

  • Transit routing is not supported. You cannot route (via Azure) between your local network connected via Site-to-Site VPN and your local network connected via ExpressRoute.
  • Basic SKU gateway is not supported. You must use a non-Basic SKU gateway for both the ExpressRoute gateway and the VPN gateway.
  • Only route-based VPN gateway is supported. You must use a route-based VPN Gateway.
  • Static route should be configured for your VPN gateway. If your local network is connected to both ExpressRoute and a Site-to-Site VPN, you must have a static route configured in your local network to route the Site-to-Site VPN connection to the public Internet.
  • ExpressRoute gateway must be configured first and linked to a circuit. You must create the ExpressRoute gateway first and link it to a circuit before you add the Site-to-Site VPN gateway.

Configuration designs

Configure a Site-to-Site VPN as a failover path for ExpressRoute

You can configure a Site-to-Site VPN connection as a backup for ExpressRoute. This applies only to virtual networks linked to the Azure private peering path. There is no VPN-based failover solution for services accessible through Azure public and Microsoft peerings. The ExpressRoute circuit is always the primary link. Data flows through the Site-to-Site VPN path only if the ExpressRoute circuit fails.

Note

While ExpressRoute circuit is preferred over Site-to-Site VPN when both routes are the same, Azure will use the longest prefix match to choose the route towards the packet's destination.

Coexist

Configure a Site-to-Site VPN to connect to sites not connected through ExpressRoute

You can configure your network where some sites connect directly to Azure over Site-to-Site VPN, and some sites connect through ExpressRoute.

Coexist

Note

You cannot configure a virtual network as a transit router.

Selecting the steps to use

There are two different sets of procedures to choose from. The configuration procedure that you select depends on whether you have an existing virtual network that you want to connect to, or you want to create a new virtual network.

  • I don't have a VNet and need to create one.

    If you don’t already have a virtual network, this procedure walks you through creating a new virtual network using Resource Manager deployment model and creating new ExpressRoute and Site-to-Site VPN connections. To configure a virtual network, follow the steps in To create a new virtual network and coexisting connections.

  • I already have a Resource Manager deployment model VNet.

    You may already have a virtual network in place with an existing Site-to-Site VPN connection or ExpressRoute connection. The To configure coexisting connections for an already existing VNet section walks you through deleting the gateway, and then creating new ExpressRoute and Site-to-Site VPN connections. When creating the new connections, the steps must be completed in a specific order. Don't use the instructions in other articles to create your gateways and connections.

    In this procedure, creating connections that can coexist requires you to delete your gateway, and then configure new gateways. You will have downtime for your cross-premises connections while you delete and recreate your gateway and connections, but you will not need to migrate any of your VMs or services to a new virtual network. Your VMs and services will still be able to communicate out through the load balancer while you configure your gateway if they are configured to do so.

To create a new virtual network and coexisting connections

This procedure walks you through creating a VNet and Site-to-Site and ExpressRoute connections that will coexist.

  1. Install the latest version of the Azure PowerShell cmdlets. For information about installing the cmdlets, see How to install and configure Azure PowerShell. The cmdlets that you use for this configuration may be slightly different than what you might be familiar with. Be sure to use the cmdlets specified in these instructions.
  2. Log in to your account and set up the environment.

    login-AzureRmAccount
    Select-AzureRmSubscription -SubscriptionName 'yoursubscription'
    $location = "Central US"
    $resgrp = New-AzureRmResourceGroup -Name "ErVpnCoex" -Location $location
    $VNetASN = 65010
    
  3. Create a virtual network including Gateway Subnet. For more information about the virtual network configuration, see Azure Virtual Network configuration.

    Important

    The Gateway Subnet must be /27 or a shorter prefix (such as /26 or /25).

    Create a new VNet.

    $vnet = New-AzureRmVirtualNetwork -Name "CoexVnet" -ResourceGroupName $resgrp.ResourceGroupName -Location $location -AddressPrefix "10.200.0.0/16"
    

    Add subnets.

    Add-AzureRmVirtualNetworkSubnetConfig -Name "App" -VirtualNetwork $vnet -AddressPrefix "10.200.1.0/24"
    Add-AzureRmVirtualNetworkSubnetConfig -Name "GatewaySubnet" -VirtualNetwork $vnet -AddressPrefix "10.200.255.0/24"
    

    Save the VNet configuration.

    $vnet = Set-AzureRmVirtualNetwork -VirtualNetwork $vnet
    
  4. Create an ExpressRoute gateway. For more information about the ExpressRoute gateway configuration, see ExpressRoute gateway configuration. The GatewaySKU must be Standard, HighPerformance, or UltraPerformance.

    $gwSubnet = Get-AzureRmVirtualNetworkSubnetConfig -Name "GatewaySubnet" -VirtualNetwork $vnet
    $gwIP = New-AzureRmPublicIpAddress -Name "ERGatewayIP" -ResourceGroupName $resgrp.ResourceGroupName -Location $location -AllocationMethod Dynamic
    $gwConfig = New-AzureRmVirtualNetworkGatewayIpConfig -Name "ERGatewayIpConfig" -SubnetId $gwSubnet.Id -PublicIpAddressId $gwIP.Id
    $gw = New-AzureRmVirtualNetworkGateway -Name "ERGateway" -ResourceGroupName $resgrp.ResourceGroupName -Location $location -IpConfigurations $gwConfig -GatewayType "ExpressRoute" -GatewaySku Standard
    
  5. Link the ExpressRoute gateway to the ExpressRoute circuit. After this step has been completed, the connection between your on-premises network and Azure, through ExpressRoute, is established. For more information about the link operation, see Link VNets to ExpressRoute.

    $ckt = Get-AzureRmExpressRouteCircuit -Name "YourCircuit" -ResourceGroupName "YourCircuitResourceGroup"
    New-AzureRmVirtualNetworkGatewayConnection -Name "ERConnection" -ResourceGroupName $resgrp.ResourceGroupName -Location $location -VirtualNetworkGateway1 $gw -PeerId $ckt.Id -ConnectionType ExpressRoute
    
  6. Next, create your Site-to-Site VPN gateway. For more information about the VPN gateway configuration, see Configure a VNet with a Site-to-Site connection. The GatewaySKU must be Standard, HighPerformance, or UltraPerformance. The VpnType must RouteBased.

    $gwSubnet = Get-AzureRmVirtualNetworkSubnetConfig -Name "GatewaySubnet" -VirtualNetwork $vnet
    $gwIP = New-AzureRmPublicIpAddress -Name "VPNGatewayIP" -ResourceGroupName $resgrp.ResourceGroupName -Location $location -AllocationMethod Dynamic
    $gwConfig = New-AzureRmVirtualNetworkGatewayIpConfig -Name "VPNGatewayIpConfig" -SubnetId $gwSubnet.Id -PublicIpAddressId $gwIP.Id
    New-AzureRmVirtualNetworkGateway -Name "VPNGateway" -ResourceGroupName $resgrp.ResourceGroupName -Location $location -IpConfigurations $gwConfig -GatewayType "Vpn" -VpnType "RouteBased" -GatewaySku "Standard"
    

    Azure VPN gateway supports BGP routing protocol. You can specify ASN (AS Number) for that Virtual Network by adding the -Asn switch in the following command. Not specifying that parameter will default to AS number 65515.

    $azureVpn = New-AzureRmVirtualNetworkGateway -Name "VPNGateway" -ResourceGroupName $resgrp.ResourceGroupName -Location $location -IpConfigurations $gwConfig -GatewayType "Vpn" -VpnType "RouteBased" -GatewaySku "Standard" -Asn $VNetASN
    

    You can find the BGP peering IP and the AS number that Azure uses for the VPN gateway in $azureVpn.BgpSettings.BgpPeeringAddress and $azureVpn.BgpSettings.Asn. For more information, see Configure BGP for Azure VPN gateway.

  7. Create a local site VPN gateway entity. This command doesn’t configure your on-premises VPN gateway. Rather, it allows you to provide the local gateway settings, such as the public IP and the on-premises address space, so that the Azure VPN gateway can connect to it.

    If your local VPN device only supports static routing, you can configure the static routes in the following way:

    $MyLocalNetworkAddress = @("10.100.0.0/16","10.101.0.0/16","10.102.0.0/16")
    $localVpn = New-AzureRmLocalNetworkGateway -Name "LocalVPNGateway" -ResourceGroupName $resgrp.ResourceGroupName -Location $location -GatewayIpAddress *<Public IP>* -AddressPrefix $MyLocalNetworkAddress
    

    If your local VPN device supports the BGP and you want to enable dynamic routing, you need to know the BGP peering IP and the AS number that your local VPN device uses.

    $localVPNPublicIP = "<Public IP>"
    $localBGPPeeringIP = "<Private IP for the BGP session>"
    $localBGPASN = "<ASN>"
    $localAddressPrefix = $localBGPPeeringIP + "/32"
    $localVpn = New-AzureRmLocalNetworkGateway -Name "LocalVPNGateway" -ResourceGroupName $resgrp.ResourceGroupName -Location $location -GatewayIpAddress $localVPNPublicIP -AddressPrefix $localAddressPrefix -BgpPeeringAddress $localBGPPeeringIP -Asn $localBGPASN
    
  8. Configure your local VPN device to connect to the new Azure VPN gateway. For more information about VPN device configuration, see VPN Device Configuration.
  9. Link the Site-to-Site VPN gateway on Azure to the local gateway.

    $azureVpn = Get-AzureRmVirtualNetworkGateway -Name "VPNGateway" -ResourceGroupName $resgrp.ResourceGroupName
    New-AzureRmVirtualNetworkGatewayConnection -Name "VPNConnection" -ResourceGroupName $resgrp.ResourceGroupName -Location $location -VirtualNetworkGateway1 $azureVpn -LocalNetworkGateway2 $localVpn -ConnectionType IPsec -SharedKey <yourkey>
    

To configure coexisting connections for an already existing VNet

If you have an existing virtual network, check the gateway subnet size. If the gateway subnet is /28 or /29, you must first delete the virtual network gateway and increase the gateway subnet size. The steps in this section show you how to do that.

If the gateway subnet is /27 or larger and the virtual network is connected via ExpressRoute, you can skip the steps below and proceed to "Step 6 - Create a Site-to-Site VPN gateway" in the previous section.

Note

When you delete the existing gateway, your local premises will lose the connection to your virtual network while you are working on this configuration.

  1. You'll need to install the latest version of the Azure PowerShell cmdlets. For more information about installing cmdlets, see How to install and configure Azure PowerShell. The cmdlets that you use for this configuration may be slightly different than what you might be familiar with. Be sure to use the cmdlets specified in these instructions.
  2. Delete the existing ExpressRoute or Site-to-Site VPN gateway.

    Remove-AzureRmVirtualNetworkGateway -Name <yourgatewayname> -ResourceGroupName <yourresourcegroup>
    
  3. Delete Gateway Subnet.

    $vnet = Get-AzureRmVirtualNetwork -Name <yourvnetname> -ResourceGroupName <yourresourcegroup> Remove-AzureRmVirtualNetworkSubnetConfig -Name GatewaySubnet -VirtualNetwork $vnet
    
  4. Add a Gateway Subnet that is /27 or larger.

    Note

    If you don't have enough IP addresses left in your virtual network to increase the gateway subnet size, you need to add more IP address space.

    $vnet = Get-AzureRmVirtualNetwork -Name <yourvnetname> -ResourceGroupName <yourresourcegroup>
    Add-AzureRmVirtualNetworkSubnetConfig -Name "GatewaySubnet" -VirtualNetwork $vnet -AddressPrefix "10.200.255.0/24"
    

    Save the VNet configuration.

    $vnet = Set-AzureRmVirtualNetwork -VirtualNetwork $vnet
    
  5. At this point, you have a VNet with no gateways. To create new gateways and complete your connections, you can proceed with Step 4 - Create an ExpressRoute gateway, found in the preceding set of steps.

To add point-to-site configuration to the VPN gateway

You can follow the steps below to add Point-to-Site configuration to your VPN gateway in a co-existence setup.

  1. Add VPN Client address pool.

    $azureVpn = Get-AzureRmVirtualNetworkGateway -Name "VPNGateway" -ResourceGroupName $resgrp.ResourceGroupName
    Set-AzureRmVirtualNetworkGatewayVpnClientConfig -VirtualNetworkGateway $azureVpn -VpnClientAddressPool "10.251.251.0/24"
    
  2. Upload the VPN root certificate to Azure for your VPN gateway. In this example, it's assumed that the root certificate is stored in the local machine where the following PowerShell cmdlets are run.

    $p2sCertFullName = "RootErVpnCoexP2S.cer" 
    $p2sCertMatchName = "RootErVpnCoexP2S" 
    $p2sCertToUpload=get-childitem Cert:\CurrentUser\My | Where-Object {$_.Subject -match $p2sCertMatchName} 
    if ($p2sCertToUpload.count -eq 1){write-host "cert found"} else {write-host "cert not found" exit} 
    $p2sCertData = [System.Convert]::ToBase64String($p2sCertToUpload.RawData) Add-AzureRmVpnClientRootCertificate -VpnClientRootCertificateName $p2sCertFullName -VirtualNetworkGatewayname $azureVpn.Name -ResourceGroupName $resgrp.ResourceGroupName -PublicCertData $p2sCertData
    

For more information on Point-to-Site VPN, see Configure a Point-to-Site connection.

Next steps

For more information about ExpressRoute, see the ExpressRoute FAQ.