With two S2S VPN connections, how should traffic be routed to a certain S2S connection in the event of ER downtime?

Veera 260 Reputation points
2023-11-30T10:08:16.63+00:00

Please check the attached diagram for network topology & traffic flow.

picture

ENV


A) On-perm

B) Azure

C) 3rd Party vendor

  1. Currently traffic flows from A(on-perm) -> Express Route -> B(Azure) -> S2S conn 2 -> C (Vendor) and return traffic flow via C -> B -> A using the same path --> its working fine.
  2. Client want to test the ER failure situation, and they did some network level modification on on-perm and routed all the traffic from A(on-perm) -> Privat connection -> C (Vendor) -> S2S Conn2 -> B(Azure), traffic reached B(Azure), however return traffic failed to use the same path, we believe since ER circuit is in active state and ERGW take precede than VPN gateway. --> Failed.

we have query regarding point 2)

Query1) Traffic from A(on-perm) -> Privat connection -> C (Vendor) -> S2S Conn2 -> B(Azure S2S conn2), since already there is B(Azure S2S conn1) connection to A(on-perm), will traffic goes to source A(on-perm) using the B(Azure S2S conn1) or B(Azure S2S conn2), is there a option to set routing priority to use the B(Azure S2S conn2)?

Thanks

Veera.

Azure VPN Gateway
Azure VPN Gateway
An Azure service that enables the connection of on-premises networks to Azure through site-to-site virtual private networks.
1,447 questions
0 comments No comments
{count} votes

Accepted answer
  1. Luis Arias 5,981 Reputation points
    2023-11-30T14:21:46.56+00:00

    Hi Veera,

    Based on the information you’ve provided, it seems that you’re trying to test a failover scenario where traffic is rerouted from your on-premises network (A) to a third-party vendor © and then to Azure (B) via a private connection and Site-to-Site (S2S) connection. However, the return traffic is not following the same path.

    This could be due to the active state of the ExpressRoute (ER) circuit and the precedence of the ExpressRoute Gateway (ERGW) over the VPN gateway. The implications:

    • In Azure, the routing of traffic is determined by system routes, user-defined routes, and Border Gateway Protocol (BGP) routes, in that order so when there are multiple routes to the same destination, Azure selects the route type based on the priority order: User-defined routes > BGP routes > System routes

    https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview

    • If there are two S2S connections from Azure (B) to your on-premises network (A), the traffic will follow the route determined by Azure’s routing mechanisms. If both S2S connections are advertised with BGP, Azure VPN gateway will honor AS Path prepending to help make routing decisions. That's mean A shorter AS Path will be preferred in BGP path selection

    https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-vpn-faq#does-azure-vpn-gateway-honor-as-path-prepending-to-influence-routing-decisions-between-multiple-connections-to-my-on-premises-sites

    If you want to change the routing behaviour to prefer S2S connection 2, you might need to modify the BGP advertisements or use user-defined routes. However, manipulating routing might have unintended side effects. Therefore, be carefull with any change on BGP could impact your entire network.

    Here another question than you can check with information about active/active azure routing:

    https://learn.microsoft.com/en-us/answers/questions/487275/active-active-azure-s2s-vpn-and-asymmetric-routing

    Let me know if this information is helpful.

    Cheers,

    Luis


0 additional answers

Sort by: Most helpful