in Azure Virtual Netowrk Gateway Vnet 2 Vnet, i build connection (IPSec) between 2 Gateways and connection established and 2 vnet can connect to eaqch other. but i want to understand how the routes exchanged between both Gateway?

RouteBased VPNs were previously called dynamic routing gateways in the classic deployment model. RouteBased VPNs use "routes" in the IP forwarding or routing table to direct packets into their corresponding tunnel interfaces. The tunnel interfaces then encrypt or decrypt the packets in and out of the tunnels. The policy (or traffic selector) for RouteBased VPNs are configured as any-to-any (or wild cards). The value for a RouteBased VPN type is RouteBased . To understand it easily when you are creating S2S(IPSec) vpn to on-prem or other cloud you create local network gateway to feed in the ranges that works as routes. Consider this same as that it's just under the hood MS is taking care for you but underlying tech is same it's connection between 2 gateways. Please Click " Accept as answer " if this helps.

Virtual Network Gateway (Vnet 2 Vnet)-Routing

Accepted answer

Tushar Kumar 3,321 Reputation points MVP

2023-09-17T09:32:18.8033333+00:00

RouteBased VPNs were previously called dynamic routing gateways in the classic deployment model. RouteBased VPNs use "routes" in the IP forwarding or routing table to direct packets into their corresponding tunnel interfaces. The tunnel interfaces then encrypt or decrypt the packets in and out of the tunnels. The policy (or traffic selector) for RouteBased VPNs are configured as any-to-any (or wild cards). The value for a RouteBased VPN type is RouteBased.

To understand it easily when you are creating S2S(IPSec) vpn to on-prem or other cloud you create local network gateway to feed in the ranges that works as routes. Consider this same as that it's just under the hood MS is taking care for you but underlying tech is same it's connection between 2 gateways.

Please Click "Accept as answer" if this helps.
Please sign in to rate this answer.

1 person found this answer helpful.
ZEIN Ahmed OBS/S EUR 125 Reputation points

2023-09-17T10:09:36.7366667+00:00

thats clear for me, my question: which protocol used to propagate the routes across both GWs? i understand it is not static (because it it route based) correct? if correct, then i was undewrstanding it is BGP, however i cannot see any BGP peers in both GWs (both cannot see each others as BGP peers)!
then how they both propagate (advertise) the routes of their corresponding VNets?
i see in the VM-NIC the routes of other Vnet pointing to the GW, i.e. routes already propagated acreoss both Vnets (2 different regions) but How?

ZEIN Ahmed OBS/S EUR 125 Reputation points

2023-09-17T10:11:20.67+00:00

so more precisely, under the hood MS is taking care for you using which protocol ?
is there a name for this automatic behaviour? like default routing etc. or it is BGP not shown!
my conviousion is coming because i cannot see the routing table of any of the GWs!

GitaraniSharma-MSFT 49,466 Reputation points Microsoft Employee

2023-09-18T09:01:59.8166667+00:00

Hello @ZEIN Ahmed OBS/S EUR ,

Yes, Azure adds default system routes for different Azure capabilities. Depending on the capability, Azure adds optional default routes to either specific subnets within the virtual network, or to all subnets within a virtual network. One of such optional default route is called Virtual network gateway.

Virtual network gateway: One or more routes with Virtual network gateway listed as the next hop type are added when a virtual network gateway is added to a virtual network. The source is also virtual network gateway, because the gateway adds the routes to the subnet. If your on-premises network gateway exchanges border gateway protocol (BGP) routes with a virtual network gateway, the system adds a route for each route. These routes are propagated from the on-premises network gateway.

Refer: https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview#optional-default-routes

Also, if you check Azure VPN gateway FAQ, you can find the below:

What address prefixes will Azure VPN gateways advertise to me?

The gateways advertise the following routes to your on-premises BGP devices:

Your virtual network address prefixes.

Address prefixes for each local network gateway connected to the Azure VPN gateway.

Routes learned from other BGP peering sessions connected to the Azure VPN gateway, except for the default route or routes that overlap with any virtual network prefix.

Refer: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-vpn-faq#what-address-prefixes-will-azure-vpn-gateways-advertise-to-me

So, basically, the Azure VPN gateway will advertise a mix of default (which are static) routes and BGP routes (if BGP is enabled).

If you would like to retrieve a list of routes the virtual network gateway is advertising to the specified peer or a list of routes the virtual network gateway has learned, including routes learned from BGP peers, you can use the below REST APIs:

https://learn.microsoft.com/en-us/rest/api/network-gateway/virtual-network-gateways/get-advertised-routes?tabs=HTTP

https://learn.microsoft.com/en-us/rest/api/network-gateway/virtual-network-gateways/get-learned-routes?tabs=HTTP

Kindly let us know if the above helps or you need further assistance on this issue.

Regards,

Gita
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Virtual Network Gateway (Vnet 2 Vnet)-Routing

0 additional answers

Your answer