Active - Active Site 2 Site VPN

Ramakrishnan Venkataraman 46 Reputation points
2022-10-27T11:58:55.883+00:00

Dear All,

As showed in the diagram. I have two spoke VNETs nameingly vnet-prod and vnet-non-prod.
As we are using 2 different pac file(s) for PD and NPD & two distinct AD(PD and NPD) authentications. So I want to establish the tunnel to Zscaler cloud to get proxy service. When NP VM communicates non-prod Zscaler proxy I wanted to route thru VPN gateway PIP-1, similarly PD traffic should go through VPN gateway PIP-2.
Question 1: Is this technically feasible for my above requirement?
Question 2: When I read MSFT document says "the traffic from your Azure virtual network to your on-premises network will be routed through both tunnels simultaneously" what does it meant, if so when Zscaler side(3rd party) prod proxy receives the non prod traffic it will drop.
Question 3: What sort of (conceptually) I would as Zscaler to perform such distinct routing.

Your swift response much appreciated.

254763-image.png

Azure VPN Gateway
Azure VPN Gateway
An Azure service that enables the connection of on-premises networks to Azure through site-to-site virtual private networks.
1,394 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. ChaitanyaNaykodi-MSFT 23,106 Reputation points Microsoft Employee
    2022-10-28T19:48:24.78+00:00

    @Ramakrishnan Venkataraman ,

    Thank you for providing the confirmation above. Based on my understanding from your issue above.

    Question 1: Is this technically feasible for my above requirement?

    I think to make this type of connectivity work you will have to create two S2S VPN connections one for Prod env and another one for Non-Prod env. To establish this type of connectivity with a single VPN Gateway you can use the Multi-Site VPN which is a variation of a site-to-site configuration that allows you to connect multiple on-premises sites to a virtual network. You can add additional Site-to-Site (S2S) connections to a VPN gateway that has an existing connection. To use Multi-Site VPN your VPN Gateway should be route based. When you create multiple connections to the same VPN gateway, all VPN tunnels share the available gateway bandwidth.

    Question 2: When I read MSFT document says "the traffic from your Azure virtual network to your on-premises network will be routed through both tunnels simultaneously" what does it meant, if so when Zscaler side(3rd party) prod proxy receives the non prod traffic it will drop.

    As mentioned in the document you have referenced above the active-active functionality of Azure VPN Gateway is used to provide high availability and although there are two tunnels deployed, Azure VPN Gateway treats it as single connection only and Equal-cost multi-path routing (ECMP) routing is required. Based on my comment above if you can create two connections for each for Prod and Non-prod the traffic will not get exchanged between them.

    Question 3: What sort of (conceptually) I would as Zscaler to perform such distinct routing.

    I am not familiar with Zscaler, but from Azure VPN perspective if you are using active-active mode then for two connections you will create 4 tunnels in total which will require 4 Local Network gateways and for Multi-Site VPN you need to configure BGP to establish connectivity. We do not have a document specific for Zscaler but I think you can refer to this article related to S2S VPN between Azure and AWS for reference.

    Hope this helps! Please let me know if you have any questions. Thank you!

    0 comments