Share via

Connectvity from on-prem to Azure VM via express Route

Renukappa Sresty D P 1 Reputation point
2023-07-11T12:16:54.29+00:00

Hi,

I have an ExpressRoute circuit and the following peering among networks:

on-prem <====VnetA Hub (ExpressRoute) <===(peering)===> VnetB

1.I wanted to advertise a custom route belonging to Access the VM in VnetB Routing between VnetA and VnetB is reachble via Globa Vnet (this is somehow a hub & (hub & spoke)) architecture.

  1. We connected <==VnetB==> another on-prem via S2S VPN, its working fine,
  2. we need to access the Vm in VnetB it is not working, advertised the routing in on-prem, allowed the ports in firewall,

Seeking your help

Azure VPN Gateway
Azure VPN Gateway
An Azure service that enables the connection of on-premises networks to Azure through site-to-site virtual private networks.
1,461 questions
Azure ExpressRoute
Azure ExpressRoute
An Azure service that provides private connections between Azure datacenters and infrastructure, either on premises or in a colocation environment.
344 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. GitaraniSharma-MSFT 49,401 Reputation points Microsoft Employee
    2023-07-11T13:47:38.27+00:00

    Hello @Renukappa Sresty D P ,

    Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

    If I understand correctly, you are not able to access VMs in Vnet B from your ExpressRoute connected on-premises. Please correct me if my understanding is wrong.

    As mentioned in the below document,

    https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview#gateways-and-on-premises-connectivity

    When you peer virtual networks that share a single Azure ExpressRoute connection, the traffic between them goes through the peering relationship. That traffic uses the Azure backbone network. You can still use local gateways in each virtual network to connect to the on-premises circuit. Otherwise, you can use a shared gateway and configure transit for on-premises connectivity.

    Since you are using a hub and spoke architecture and the Vnet A and Vnet B doesn't share a single ExpressRoute connection, the on-premises connectivity should be configured using the transit gateway setting in the Vnet peering. Gateway Transit is a peering property that enables a virtual network to utilize a VPN/ExpressRoute gateway in a peered virtual network. Gateway transit works for both cross premises and network-to-network connectivity.

    However, in point 2, you mentioned "We connected <==VnetB==> another on-prem via S2S VPN, its working fine", so I believe you have a VPN gateway configured in Vnet B, and hence configuring transit gateway will not be possible in this case. If the spoke virtual network already has a VPN gateway, the Use remote gateway option isn't supported on the spoke virtual network. This is because of a virtual network peering limitation.

    Refer: https://learn.microsoft.com/en-US/azure/virtual-network/virtual-network-troubleshoot-peering-issues#both-the-hub-virtual-network-and-the-spoke-virtual-network-have-a-vpn-gateway

    In your current setup, there are only 2 options to provide connectivity from on-prem to Azure VM in Vnet B via Express Route:

    1. Connect your Vnet B to your ExpressRoute circuit directly by creating an ExpressRoute gateway in Vnet B (co-existence with the already existing VPN gateway).

    You can link the spoke Vnet to the ExpressRoute circuit directly for communication between the spoke Vnet and on-premises. You can link up to 10 virtual networks on a standard ExpressRoute circuit, and up to 100 on a premium ExpressRoute circuit.

    Refer: https://learn.microsoft.com/en-us/azure/expressroute/expressroute-howto-linkvnet-portal-resource-manager

    https://learn.microsoft.com/en-us/azure/expressroute/expressroute-faqs#can-i-link-to-more-than-one-virtual-network-to-an-expressroute-circuit

    1. Remove the VPN gateway from Vnet B and deploy it in Vnet A along with the ExpressRoute gateway as a co-existence setup and then enable gateway transit in the Vnet B peering. You can configure your network where some sites connect directly to Azure over Site-to-Site VPN, and some sites connect through ExpressRoute.

    https://learn.microsoft.com/en-us/azure/expressroute/how-to-configure-coexisting-gateway-portal

    https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-peering-gateway-transit

    While enabling the gateway transit option, you need to make sure that the Vnet B is using the remote virtual network's (Vnet A ExpressRoute) gateway and Traffic to remote virtual network & Traffic forwarded from remote virtual network are set to Allow for both side Vnet peerings.

    Option 1 will be expensive as it will have 3 gateways in total, so my suggestion is to go for option 2.

    If you go with option 2, you can also enable connectivity between your local network that is connected to ExpressRoute and other local network that is connected to a site-to-site VPN connection by enabling BGP and setting up Azure Route Server (if needed in the future).

    Refer: https://learn.microsoft.com/en-us/azure/expressroute/how-to-configure-coexisting-gateway-portal?toc=%2Fazure%2Fvpn-gateway%2Ftoc.json#to-enable-transit-routing-between-expressroute-and-azure-vpn

    Kindly let us know if the above helps or you need further assistance on this issue.

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.