We are running with express route in our environment, have one requirement to build site to site vpn between our azure cloud to one of our client cloud (not onprem), can we use the existing gateway subnet for site to site vpn virtual network gateway which used for express route??

If the existing gateway subnet is /27, you can plan the co-existence of site-to-site vpn along with express route. if the gateway subnet prefix is /28 or longer (/29, /30, etc.), you have to delete the existing gateway and to re-create it to increase the gateway subnet size. Refer the following article and follow from step 10 onwards to use the existing site to site vpn virtual network gateway coexisting connections --please don't forget to upvote and Accept as answer if the reply is helpful--

Azure express route and site to site vpn

Accepted answer

Manu Philip 18,151 Reputation points MVP

2023-09-10T17:57:49.4+00:00

If the existing gateway subnet is /27, you can plan the co-existence of site-to-site vpn along with express route. if the gateway subnet prefix is /28 or longer (/29, /30, etc.), you have to delete the existing gateway and to re-create it to increase the gateway subnet size. Refer the following article and follow from step 10 onwards to use the existing site to site vpn virtual network gateway

coexisting connections

--please don't forget to upvote and Accept as answer if the reply is helpful--
Please sign in to rate this answer.

1 person found this answer helpful.
nepolian A 45 Reputation points

2023-09-11T04:37:18.6566667+00:00

Hi Manu,

Thanks for the answer, In this case using same gateway subnet for S2S VPN and Express route, Can we send the traffic via S2S VPN for that particular site (Third party vendor) which we build it, For example after creating spoke vnet for third party i will be peering with hubVnet the same vnet attached into express route, The traffic will go to our on-prem using express route or will go third party cloud using S2S VPN?

GitaraniSharma-MSFT 49,466 Reputation points Microsoft Employee

2023-09-11T05:24:44.0666667+00:00

Hello @nepolian A ,

There are 2 configuration designs for ExpressRoute and Site-to-Site Coexistence:

Configuring a Site-to-Site VPN as a failover path for ExpressRoute --> In this configuration, both ExR and S2S connects to the same site. ExpressRoute circuit is preferred over Site-to-Site VPN when both routes are the same, but Azure will still use the longest prefix match to choose the route towards the packet's destination.

Configuring a Site-to-Site VPN to connect to sites not connected through ExpressRoute --> In this configuration, both ExR and S2S connects to 2 different sites and hence are independent of each other.

Refer: https://learn.microsoft.com/en-us/azure/expressroute/how-to-configure-coexisting-gateway-portal#configuration-designs

Your case seems to be the 2nd configuration where S2S will be connecting to a different site than ExR, so traffic to your on-prem will use ExR and traffic to third party cloud will use S2S VPN.

Regards,

Gita

nepolian A 45 Reputation points

2023-09-11T06:14:10.7966667+00:00

Hi Gitarani,

Thanks for your brief explanation, One last query Our design is second one,

Configuring a Site-to-Site VPN to connect to sites not connected through ExpressRoute --> In this configuration, both ExR and S2S connects to 2 different sites and hence are independent of each other.

In this case, Same gateway subnet can be used for ER and S2S VPN?

GitaraniSharma-MSFT 49,466 Reputation points Microsoft Employee

2023-09-11T06:20:33.4733333+00:00

Yes @nepolian A , same gateway subnet can be used for ExR and S2S VPN.

Just make sure you take a look into the pre-reqs and limitations:

https://learn.microsoft.com/en-us/azure/expressroute/how-to-configure-coexisting-gateway-portal#limits-and-limitations

nepolian A 45 Reputation points

2023-09-13T08:27:39.16+00:00

Thanks for the details and your help
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Azure express route and site to site vpn

0 additional answers

Your answer