Routing between Azure Virtual Network Gateway and On Premise LGW

Bret Hillier 30 Reputation points
2023-08-09T07:37:40.4066667+00:00

I have set up a S2S connection in Azure with a route based Virtual Network Gateway (VPN) connected to two Local Network Gateways (On premise).

I have configured the same static routes on both LGWs.

So there are two connections

VPN -> Connection 1 --> Primary LGW

VPN -> Connection 2 --> Secondary LGW

I was after an active-passive like this (but without the BGP requirement) as outlined here: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-highlyavailable

User's image

I would of thought that only one connection would be up and the other would be down. Both are coming up and showing as "Connected" at the same time. Is that expected and ok?

Thanks for helping me it's been quite a learning experience

Azure VPN Gateway
Azure VPN Gateway
An Azure service that enables the connection of on-premises networks to Azure through site-to-site virtual private networks.
1,554 questions
{count} votes

Accepted answer
  1. GitaraniSharma-MSFT 49,651 Reputation points Microsoft Employee
    2023-08-09T10:42:37.9633333+00:00

    Hello @Bret Hillier ,

    Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

    I understand that you've up a S2S connection in Azure with a route based Virtual Network Gateway (VPN) connected to two Local Network Gateways (On premise) with the same static routes on both LGWs and both connections are showing as "Connected" at the same time. You would like to know if this is expected.

    Previously, it was not possible to create VPN connections with overlapping address ranges and it used to fail but this changed when VPN gateway started supporting NAT, and now you can create 2 connections with different LNG IP addresses and same address ranges on the same VPN gateway and both will show connected.

    But due to the overlapping address ranges, only one connection is used at a specific moment in time (even if both tunnels are UP at MM level) as the VPN gateway will only install one NEXT HOP for STATIC Routes for the on-prem ranges in its routing table.

    So, this setup is still active-standby and only one connection will work at one time.

    More information on this can be found in the below thread:

    https://learn.microsoft.com/en-us/answers/questions/582404/route-table-of-2-tunnels-between-azure-and-on-prem (this thread discussion is back from 2021 when connection with same address ranges used to show disconnected, but the mechanism still remains the same).

    However, it is always best to adhere to the guidelines mentioned in Azure public docs.

    You should use BGP in such setups as mentioned in the below doc:

    https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-highlyavailable#multiple-on-premises-vpn-devices

    Kindly let us know if the above helps or you need further assistance on this issue.


    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

    1 person found this answer helpful.

0 additional answers

Sort by: Most helpful

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.