Azure VPN Gateway
An Azure service that enables the connection of on-premises networks to Azure through site-to-site virtual private networks.
1,795 questions
BGP Routes not being set in AWS VPN Tunnel
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(236.8, 11%, 32%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EGB%3C/text%3E%3C/svg%3E)
Greg Bonk
86
Reputation points
I have an Azure VPN gateway that is talking to an AWS VPN. My azure VPN is in Active-Active and is configured with BGP to connect with 4 tunnels on the AWS Side.
While all four tunnels are 'connected' only two ( each one tunnel on a separate Customer gateway ) receive the BGP Routes.
Azure Virtual Network Gateway
Customer Gateway 1 on AWS
Customer Gateway 2 on AWS
as you can see there are two tunnels that are not getting the routes.
Azure VPN Gateway
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(134.4, 59%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ECM%3C/text%3E%3C/svg%3E)
ChaitanyaNaykodi-MSFT 27,476 Reputation points Microsoft Employee Moderator2023-12-13T03:22:16.8733333+00:00 Thank you for reaching out.
Have you followed this article here in setting up the VPN between Azure and AWS? Based on the comments at the bottom of the article can ensure the route propagation is enabled in the route table config.
You can also enable diagnostic logging for your VPN Gateway and check the RouteDiagnosticLog and check if routes are being exchanged.
Thank you!
-
Greg Bonk 86 Reputation points
2023-12-13T21:02:08.35+00:00 HI Chaitanya,
Yes I have reviewed that document as well as the more applicable https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-aws-bgp
Is there anything applicable here ?
-
Greg Bonk 86 Reputation points
2023-12-13T21:05:54.91+00:00 It looks like that only one side of the azure VPN is broadcasting routes.
-
ChaitanyaNaykodi-MSFT 27,476 Reputation points Microsoft Employee Moderator
2023-12-15T03:59:03.4733333+00:00 Thank you for getting back and sharing additional details.
Depending on your requirement can you please validate if the Propagate Default route is enabled as shown here? The Enable option allows the virtual hub to propagate a learned default route to this connection.
- All branch connections (Point-to-site, Site-to-site, and ExpressRoute) need to be associated to the Default route table. That way, all branches will learn the same prefixes.
- All branch connections need to propagate their routes to the same set of route tables. For example, if you decide that branches should propagate to the Default route table, this configuration should be consistent across all branches. As a result, all connections associated to the Default route table will be able to reach all of the branches.
Thank you!
-
Greg Bonk 86 Reputation points
2023-12-15T14:31:49.92+00:00 Yes, It appears that it is enabled.
-
ChaitanyaNaykodi-MSFT 27,476 Reputation points Microsoft Employee Moderator
2023-12-16T00:50:20.49+00:00 Thank you for getting back.
You can enable diagnostic logging for your VPN Gateway and check the RouteDiagnosticLog and check if you able to detect/observe any issues.
Also, if this does not help, to troubleshoot the exact issue I think we will need a specialized 1:1 session, where a support engineer can have a screen share session to pin point the issue. If you have a support plan you may file a support ticket, else could you please send an email to azcommunity@microsoft.com with the details below.
Subject : Attn Chaitanya
Thread URL: Link to this thread.
Subscription ID
Please let me know once you have done the same.
Sign in to comment
Sign in to answer