How does Azure Subnet Extension Works?

Question

How does Azure Subnet Extension Works?

Mark Jaycob Casera 20

Mar 8, 2023, 2:57 AM

Can someone confirm if this is how subnet extension works?

Onprem Server (10.0.1.1) > OnPrem NVA (192.168.1.1) > IPSec/ExpressRoute > Azure NVA (192.168.2.1) > Azure Server (10.0.0.100)

Basically, the onprem server EXPLICITLY connects to the OnPrem NVA IP and it gets taken care of right?

TIA,

markcasera_

KapilAnanth-MSFT 49,106 Reputation points Microsoft Employee

Mar 8, 2023, 6:36 AM

@Mark Jaycob Casera

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you would like to know how Azure Subnet Extension Works.

Your understanding is correct.

However, it is not as simple as that and it is not recommended.

The statement is "onprem server EXPLICITLY connects to the Azure NVA IP".

This method is recommended for phased migration, and not for providing connectivity.

If you could state your exact requirement, we can provide more details or other services that may support this, such as VPN Gateway NAT

Cheers,

Kapil
msrini-MSFT 9,291 Reputation points Microsoft Employee

Mar 8, 2023, 8:02 AM

Hi,

I just read through the public doc on this. If you want to have an L2 extension from On-Prem to Azure, you will need to have an NVA on both the ends which will provide the overlay network for your VMs which are extended. You will need to have VxLAN encapsulation or nvGRE encap to get this working.
Mark Jaycob Casera 20 Reputation points

Mar 9, 2023, 4:51 AM

Yeah so the reason being is that the client is unable to change the destination IP (in this example, 10.0.0.100) that needs to be moved to cloud. The application running on the source (10.0.1.1) has hard coded the destination IP (10.0.0.100) and they don't have the developer of the legacy application no more.

I'm clarifying if the NVA IP (192.168.1.1) needs to be explicitly defined on the source server for the subnet extension to work. If yes, then it would not work on this specific use case that I'm working on.

Thank you and regards Kapil,

markcasera_
KapilAnanth-MSFT 49,106 Reputation points Microsoft Employee

Mar 9, 2023, 3:43 PM

@Mark Jaycob Casera

Thanks for clarifying your requirement.

Wrt, "I'm clarifying if the NVA IP (192.168.1.1) needs to be explicitly defined on the source server for the subnet extension to work"

-The NVA IP (OnPrem) can have any IP address as long as it's not overlapping with the Azure VNet to which you are trying to establish a connection.

Cheers,

Kapil
Mark Jaycob Casera 20 Reputation points

Mar 10, 2023, 6:38 AM

Kapil,

Thank you for the response. The confirmation I need is similar to the statement of TP on this thread.

`Your Onprem Server will continue to operate as usual. Once the NVAs are configured, they will handle the translation of traffic between on premises and Azure transparently.

For example, if your onprem server sends out ARP request looking for MAC address for 10.0.0.100, the onprem NVA will encapsulate and send to the Azure NVA, which decapsulates and sends on Azure subnet, and when response comes back the process is reversed so that onprem server receives response.`

Can you confirm if this is correct? Again, I need to confirm if the onprem server needs to operate as usual or does it need to explicitly forward the traffic to the onprem NVA IP.

Regards,

markcasera_
KapilAnanth-MSFT 49,106 Reputation points Microsoft Employee

Mar 10, 2023, 9:50 AM

@Mark Jaycob Casera

I am glad TP 's answer helped you.

Cheers,

Kapil

Accepted answer

0 additional answers

Your answer

KapilAnanth-MSFT 49,106 Reputation points Microsoft Employee

Mar 8, 2023, 6:36 AM

@Mark Jaycob Casera

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you would like to know how Azure Subnet Extension Works.

Your understanding is correct.

However, it is not as simple as that and it is not recommended.

The statement is "onprem server EXPLICITLY connects to the Azure NVA IP".

This method is recommended for phased migration, and not for providing connectivity.

If you could state your exact requirement, we can provide more details or other services that may support this, such as VPN Gateway NAT

Cheers,

Kapil
msrini-MSFT 9,291 Reputation points Microsoft Employee

Mar 8, 2023, 8:02 AM

Hi,

I just read through the public doc on this. If you want to have an L2 extension from On-Prem to Azure, you will need to have an NVA on both the ends which will provide the overlay network for your VMs which are extended. You will need to have VxLAN encapsulation or nvGRE encap to get this working.
Mark Jaycob Casera 20 Reputation points

Mar 9, 2023, 4:51 AM

Yeah so the reason being is that the client is unable to change the destination IP (in this example, 10.0.0.100) that needs to be moved to cloud. The application running on the source (10.0.1.1) has hard coded the destination IP (10.0.0.100) and they don't have the developer of the legacy application no more.

I'm clarifying if the NVA IP (192.168.1.1) needs to be explicitly defined on the source server for the subnet extension to work. If yes, then it would not work on this specific use case that I'm working on.

Thank you and regards Kapil,

markcasera_
KapilAnanth-MSFT 49,106 Reputation points Microsoft Employee

Mar 9, 2023, 3:43 PM

@Mark Jaycob Casera

Thanks for clarifying your requirement.

Wrt, "I'm clarifying if the NVA IP (192.168.1.1) needs to be explicitly defined on the source server for the subnet extension to work"

-The NVA IP (OnPrem) can have any IP address as long as it's not overlapping with the Azure VNet to which you are trying to establish a connection.

Cheers,

Kapil
Mark Jaycob Casera 20 Reputation points

Mar 10, 2023, 6:38 AM

Kapil,

Thank you for the response. The confirmation I need is similar to the statement of TP on this thread.

`Your Onprem Server will continue to operate as usual. Once the NVAs are configured, they will handle the translation of traffic between on premises and Azure transparently.

For example, if your onprem server sends out ARP request looking for MAC address for 10.0.0.100, the onprem NVA will encapsulate and send to the Azure NVA, which decapsulates and sends on Azure subnet, and when response comes back the process is reversed so that onprem server receives response.`

Can you confirm if this is correct? Again, I need to confirm if the onprem server needs to operate as usual or does it need to explicitly forward the traffic to the onprem NVA IP.

Regards,

markcasera_
KapilAnanth-MSFT 49,106 Reputation points Microsoft Employee

Mar 10, 2023, 9:50 AM

@Mark Jaycob Casera

I am glad TP 's answer helped you.

Cheers,

Kapil

Answer 1

TP 113.1K

Mar 9, 2023, 9:21 AM

Hi,

Your Onprem Server will continue to operate as usual. Once the NVAs are configured, they will handle the translation of traffic between on premises and Azure transparently.

For example, if your onprem server sends out ARP request looking for MAC address for 10.0.0.100, the onprem NVA will encapsulate and send to the Azure NVA, which decapsulates and sends on Azure subnet, and when response comes back the process is reversed so that onprem server receives response.

Above is based on reviewing extended network for Azure documentation and my knowledge of VXLAN.

If my answer was helpful please click Accept Answer.

Thanks.

-TP

Mark Jaycob Casera 20 Reputation points

Mar 10, 2023, 6:39 AM

Appreciate it TP. Thank you!

AI Skills Fest

Share via

How does Azure Subnet Extension Works?

0 additional answers

Your answer