Site-to-Site VPN over Internet AND ExpressRoute

Question

Hello,

I'm trying to determine whether or not the following is possible:

We have an existing Site-to-Site VPN from DC1 to Azure over the Internet and are in the process of provisioning our ExpressRoute connectivity from DC2 to Azure.

Can I create a highly available VPN configuration with a second tunnel going over the MPLS and ExpressRoute from DC1 to Azure via DC2?

Regards,

Ben

Answer 1

Hello @Ben ,

I understand that you would like to create a site-to-site VPN configuration with a second tunnel going over the MPLS and ExpressRoute from DC1 to Azure via DC2.

Meaning the VPN connection should be DC1 <--S2S--> DC2 <--S2S--> Azure

DC1 <--S2S--> DC2 --> This configuration has to be done on your end, so cannot comment much on this setup.

DC2 <--S2S--> Azure --> Using the existing VPN gateway, you can connect DC2 site (via another local network gateway) with Azure using BGP.

NOTE: BGP should also be enabled for the existing Site-to-Site VPN from DC1 to Azure.

Once BGP is enabled, you can use AS path prepend to prefer direct path over the indirect path.

Azure VPN gateway honors AS Path prepending to help make routing decisions when BGP is enabled. A shorter AS Path is preferred in BGP path selection.

Refer: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-vpn-faq#does-azure-vpn-gateway-honor-as-path-prepending-to-influence-routing-decisions-between-multiple-connections-to-my-on-premises-sites

Kindly let us know if the above helps or you need further assistance on this issue.

---

Please don’t forget to "Accept the answer" wherever the information provided helps you, this can be beneficial to other community members.