How to set up a S2S VPN with active-passive redundancy

Question

I need help setting up a S2S VPN with active-passive redundancy using 1 VPN Gateway and 2 Local Gateways. Are there any instructions or documentation available? Thank you.

Answer 1

Hello @Anonymous ,

I understand that you needed help setting up a S2S VPN with active-passive redundancy using 1 VPN Gateway and 2 Local Gateways and wanted to know if there are any instructions or documentation available for same.

You can setup a S2S VPN with active-passive redundancy using 1 VPN Gateway and 2 Local Gateways.

But there are 2 types of setups in this active-passive configuration:

1. Both VPN devices in the same on-premises location:

Refer: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-highlyavailable#multiple-on-premises-vpn-devices

2. The 2 VPN devices are in different on-premises locations:

If the VPN devices are in different sites, then this type of setup is generally known as multi-site configuration and can be seen in the below doc:

https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-multi-site-to-site-resource-manager-portal

So, depending upon where your VPN devices are, the prerequisites for the setup may differ.

If both the VPN devices are in the same site, then BGP is required for this configuration.

If both the VPN devices are in different sites, then refer the below doc for the prerequisites.

https://learn.microsoft.com/en-us/azure/vpn-gateway/add-remove-site-to-site-connections#before

In case you want automatic failover between 2 VPN tunnels configured with 1 Azure VPN gateway & 2 on-premises VPN devices in the same site, then using BGP will allow the two connections to the same on-premises network to be UP at the same time and will support automatic and flexible prefix updates.

Refer: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-highlyavailable#multiple-on-premises-vpn-devices

https://learn.microsoft.com/en-us/azure/vpn-gateway/bgp-howto

In case you want to use static routes, you need to set up a connection with LNG (local network gateway) pointing to VPN device 1 having the on-premises address range. Then create another connection with 2nd LNG having the Public IP of the VPN device 2 and the on-premises address range in there as well.

You confirmed that the issue is now resolved.

Kindly let us know if the above helps or you need further assistance on this issue.

---

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.