Active/Active VPN Gateway and BGP

Question

Active/Active VPN Gateway and BGP

Marco Mancini 60

Active/Active Azure VPN gateway with BGP peering over S2S vpn with single on premise device.
Both vpn tunnels are up, IKE and IPSEC SA established. However, only 1 bgp peering is established, while the second one keeps being on Connecting status in the Bpg Peers section. Same status ofc on the on prem device. The configurations are basically the same, could you please advice? The on premise device is Palo Alto.
Thanks

KapilAnanth-MSFT 49,611 Reputation points Microsoft Employee Moderator

2023-09-20T04:43:55.56+00:00
@Marco Mancini

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you are trying to configure a Active-Active VPN Gateway with one OnPrem device.

I believe your scenario is : https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-highlyavailable#active-active-vpn-gateways

This is strange.

I would suggest you to

Try resetting the Connection once

If that didn't help, please reset the entire VPN Gateway

Refer : https://learn.microsoft.com/en-us/azure/vpn-gateway/reset-gateway

If the above did not help,

May I ask if the connections are showing as connected state?

On the blade for your virtual network gateway, click Connections. You can see the status of each connection.

Or the Connection is also in a connecting state ?

Please enable the VPN gateway logs

Enable Logs : Set up logging

And check for RouteDiagnosticLog

You should see the logs like below

Cheers,

Kapil
KapilAnanth-MSFT 49,611 Reputation points Microsoft Employee Moderator

2023-09-21T05:30:51.8966667+00:00

@Marco Mancini

May I know if you got a chance to review my previous comment?

Please let me know if you are facing any challenges or if there are any follow-up questions, I shall be glad to address them.

Thanks,

Kapil
Marco Mancini 60 Reputation points

2023-09-21T05:35:25.7266667+00:00

Dear @KapilAnanth-MSFT many thanks for your help. Our scenario matches with the link you provided. I went through it thoroughly, and then I realized that our configuration on Azure side was wrong, since we created 2 local gateways. After amending this and revising also on prem setup, we have now both Ipsec tunnels up and running, and the 2 bgp peering established!
Thanks a lot again!
Regards
Marco
KapilAnanth-MSFT 49,611 Reputation points Microsoft Employee Moderator

2023-09-21T05:48:47.7433333+00:00

@Marco Mancini

That is wonderful news :)

I have summarized my comments and posted it as a new answer.

I would highly appreciate if you could Accept the answer and close this thread

Original posters help the community find answers faster by identifying the correct answer.

Thanks,

Kapil
Ramirez, Eduardo 5 Reputation points

2023-10-27T06:38:00.2533333+00:00

@Marco Mancini I have exactly same situation, active/active with single on-prem Palo Alto, but how you Peer the secondary tunnel which Azure BGP adddres 169.254.x.x you used for your Tunnel2 on the Palo as the the Local Network Group just have 169.254.21.1... for Palo Alto Tunnnel1... I jst don't get it !!! Any help will be appreciated
Marco Mancini 60 Reputation points

2023-10-27T06:56:55.2966667+00:00

Eduardo, I did not use apipa for BGP Peering.
On Azure side, if you have an active/active setup you will see in the configuration 2 Bgp peer addresses (Default and Second Default). and I used them.
On palo alto side I created a loopback interface and I used that for bgp peering with both tunnels/peers.
Ramirez, Eduardo 5 Reputation points

2023-10-27T22:05:12.79+00:00

@Marco Mancini thanks for the feedback, creating loopback did the trick ... just one thing when I tried to use (Default and Second Default) Ip addresses that were assigned from Subnet Gateway ... and changing VLN peer Ip to use one of this to use one for the IP form same rang you know just for consistency, I got error, so it only worked using this holy APIPA addresses ... lol!

Not sure why Azure does that ... with OCI and other Cloud you can specify what you to use for peering ... anyways I really appreciate you answer and help, would be nice Azure got this documented in case other customers wants to use Active/Active with a single Customer on-premises gateway.

Gracias !!!

Accepted answer

0 additional answers

Your answer

KapilAnanth-MSFT 49,611 Reputation points Microsoft Employee Moderator

2023-09-20T04:43:55.56+00:00

@Marco Mancini

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you are trying to configure a Active-Active VPN Gateway with one OnPrem device.

I believe your scenario is : https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-highlyavailable#active-active-vpn-gateways

This is strange.

I would suggest you to

Try resetting the Connection once

If that didn't help, please reset the entire VPN Gateway

Refer : https://learn.microsoft.com/en-us/azure/vpn-gateway/reset-gateway

If the above did not help,

May I ask if the connections are showing as connected state?

On the blade for your virtual network gateway, click Connections. You can see the status of each connection.

Or the Connection is also in a connecting state ?

Please enable the VPN gateway logs

Enable Logs : Set up logging

And check for RouteDiagnosticLog

You should see the logs like below

Cheers,

Kapil
KapilAnanth-MSFT 49,611 Reputation points Microsoft Employee Moderator

2023-09-21T05:30:51.8966667+00:00

@Marco Mancini

May I know if you got a chance to review my previous comment?

Please let me know if you are facing any challenges or if there are any follow-up questions, I shall be glad to address them.

Thanks,

Kapil
Marco Mancini 60 Reputation points

2023-09-21T05:35:25.7266667+00:00

Dear @KapilAnanth-MSFT many thanks for your help. Our scenario matches with the link you provided. I went through it thoroughly, and then I realized that our configuration on Azure side was wrong, since we created 2 local gateways. After amending this and revising also on prem setup, we have now both Ipsec tunnels up and running, and the 2 bgp peering established!
Thanks a lot again!
Regards
Marco
KapilAnanth-MSFT 49,611 Reputation points Microsoft Employee Moderator

2023-09-21T05:48:47.7433333+00:00

@Marco Mancini

That is wonderful news :)

I have summarized my comments and posted it as a new answer.

I would highly appreciate if you could Accept the answer and close this thread

Original posters help the community find answers faster by identifying the correct answer.

Thanks,

Kapil
Ramirez, Eduardo 5 Reputation points

2023-10-27T06:38:00.2533333+00:00

@Marco Mancini I have exactly same situation, active/active with single on-prem Palo Alto, but how you Peer the secondary tunnel which Azure BGP adddres 169.254.x.x you used for your Tunnel2 on the Palo as the the Local Network Group just have 169.254.21.1... for Palo Alto Tunnnel1... I jst don't get it !!! Any help will be appreciated
Marco Mancini 60 Reputation points

2023-10-27T06:56:55.2966667+00:00

Eduardo, I did not use apipa for BGP Peering.
On Azure side, if you have an active/active setup you will see in the configuration 2 Bgp peer addresses (Default and Second Default). and I used them.
On palo alto side I created a loopback interface and I used that for bgp peering with both tunnels/peers.
Ramirez, Eduardo 5 Reputation points

2023-10-27T22:05:12.79+00:00

@Marco Mancini thanks for the feedback, creating loopback did the trick ... just one thing when I tried to use (Default and Second Default) Ip addresses that were assigned from Subnet Gateway ... and changing VLN peer Ip to use one of this to use one for the IP form same rang you know just for consistency, I got error, so it only worked using this holy APIPA addresses ... lol!

Not sure why Azure does that ... with OCI and other Cloud you can specify what you to use for peering ... anyways I really appreciate you answer and help, would be nice Azure got this documented in case other customers wants to use Active/Active with a single Customer on-premises gateway.

Gracias !!!

Answer 1

@Marco Mancini

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you are trying to configure a Active-Active VPN Gateway with one OnPrem device.

I believe your scenario is : https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-highlyavailable#active-active-vpn-gateways

User's image

You confirmed that you were using 2 LNGs and this was causing the issue.

Following the above documentation, you were successfully able to resolve the issue.

I am glad we could be of help. Please let us know if we can be of any further assistance here.

Thanks,

Kapil

Please Accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer.

Share via

Active/Active VPN Gateway and BGP

0 additional answers

Your answer