How to advertise point to site address pool to on prem services

Question

How to advertise point to site address pool to on prem services

Finbar Pimlott 0

We are looking to deploy autopilot in Azure and have point-to-site configuration enabled on a VPN Gateway.

The VNET that the VPN gateway is deployed is reachable from our on prem services via expressoute.

However the client point to site hosts are not able to reach the on prem services it needs to access to as the address

pool is not currently reachable. I was thinking to change the point to point address pool to a range within the VNET that VPN gateway is in but looks like that is not supported

For example Azure Supernet

10.138.128/19 > Reachable for On prem

VPN Gateway deployed into the vnet with point to site configuration with address pool : 10.220.220/24

When client clients to point to site it can currently reach the services it needs in Azure but not the on prem services it needs to complete auto pilot configuration

What is the best way to advertise the address pool client IP's so that it can reach the services it needs on prem

KapilAnanth-MSFT 49,421 Reputation points Microsoft Employee Moderator

2023-03-03T13:06:59.8666667+00:00

@Finbar Pimlott

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Thanks,

Kapil
Finbar Pimlott 0 Reputation points

2023-03-03T15:20:13.0533333+00:00

Thanks @KapilAnanth-MSFT

My plan is to use a IPSEC tunnel between Onprem and Azure VPN Gateway

Please see diagram AutoPilot.jpeg

Do you think that is a good test approach? What we need is for the client to have reachability to both Azure VNET services and Onprem services
KapilAnanth-MSFT 49,421 Reputation points Microsoft Employee Moderator

2023-03-07T13:34:45.1866667+00:00

@Finbar Pimlott

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Thanks,

Kapil

1 answer

Your answer

KapilAnanth-MSFT 49,421 Reputation points Microsoft Employee Moderator

2023-03-03T13:06:59.8666667+00:00

@Finbar Pimlott

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Thanks,

Kapil
Finbar Pimlott 0 Reputation points

2023-03-03T15:20:13.0533333+00:00

Thanks @KapilAnanth-MSFT

My plan is to use a IPSEC tunnel between Onprem and Azure VPN Gateway

Please see diagram AutoPilot.jpeg

Do you think that is a good test approach? What we need is for the client to have reachability to both Azure VNET services and Onprem services
KapilAnanth-MSFT 49,421 Reputation points Microsoft Employee Moderator

2023-03-07T13:34:45.1866667+00:00

@Finbar Pimlott

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Thanks,

Kapil

Answer 1

KapilAnanth-MSFT 49,421 Microsoft Employee Moderator

@Finbar Pimlott

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you would like to use Azure as Transit between P2S Clients and OnPrem network.

Your case is documented here : One VNet and a branch office (BGP)

There are two requirements to be met here,

You must enable BGP for Azure VPN Gateway to Advertise the P2S address range to the OnPremise network
Manually add the OnPrem route to the P2S Client configuration file. (for Windows clients)

Advertise custom routes for P2S VPN clients:

Thanks,

Kapil

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

Finbar Pimlott 0 Reputation points

2023-03-03T17:11:04.3433333+00:00

AutoPilot.jpeg

Thanks our plan is to build an IPSEC tunnel between onprem and Azure VPN Gateway. Please see image.

Is there any reason why that would'nt work?
KapilAnanth-MSFT 49,421 Reputation points Microsoft Employee Moderator

2023-03-06T06:11:46.0233333+00:00

@Finbar Pimlott

I can't see a reason why this won't work.

As long as BGP is enabled and you have added the OnPrem Routes to the client configuration file, this should work as expected.

Cheers,

Kapil

Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer

Share via

How to advertise point to site address pool to on prem services

1 answer

Your answer