Traffic routing through two IPSec VPN tunnels over Express Route Private Peering

Question

Let us consider following setup or environment

• One On-premise FW and Azure VPN GWs in active-active config. There are two IPSec VPN tunnel over Express Route Private peering.
• Two IPSec tunnels are terminating on only one On-premise FW. Enabled BGP on these tunnels.
• Azure ER GW and VPN GW are in Hub subscription and Azure FW in same Hub subscription.
• Spoke subnets in Spoke Vnets or workload subnet in HUB Vnets has UDR attached to it with next hop as Azure FW for On-premise IP prefixes
• Gateway Subnet in Hub Vnet has a UDR attached to it for workload subnets or Azure spoke IP prefixes with next hop as Azure FW
• BGP multi-path feature is enabled at On-premise FW since there are two paths available to Azure IP prefixes. It will perform auto load balancing of the traffic at On-premise end when traffic is initiated from On-premise
• At On-premise end, certain IP prefixes ( example, Prefix-A & its subnets) are advertised over tunnle-1 and certain IP prefixes ( example, Prefix-B & its subnets) are advertised over tunnle-2 towards Azure

Following is the query

When traffic is initiated from VM in one of the Hub or Spoke workload subnet destined towards On-premise IP Prefix-A. Traffic will be routed to Azure FW first, Azure FW will route it to VPN Gateway and then it will take tunnel-1 as a path (as per route advertisement from On-premise), however return traffic from On-premise will take same tunnel-1 as path or tunnel-2 ? (because we can not tweak route advertisement from Azure VPN GW towards On-premise) and whether it will cause asymmetical routing or not ?

Answer 1

Hi @Raviraj Velankar ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.
I understand that you would like to understand how the flow of packets in Active-Active VPN connections happen.

This is documented here in : https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-highlyavailable

From Azure perspective, for a single flow, Azure will send the packets to the same tunnel during the entire flow.

However, we cannot comment on the behavior of the OnPrem device/FW. Mostly, it should also send the packets via same tunnel.
However, I would recommend you get in touch with your VPN device vendor to get this clarified.

I hope this helps. Let me know should you have any follow up questions on this.

Cheers,
Kapil

----------------------------------------------------------------------------------------------------------------

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.